TLDR Tech / InfoSec
Decrypting and Abusing Predefined BIOCs in Palo Alto Cortex XDR
InfoGuard Labs researchers decrypted the AES-256-CBC-encrypted CLIPS rule files shipped with Palo Alto Cortex XDR agents 8.7 and 8.8 (content version 1790-16658), exposing hardcoded global whitelists that exempted any process with `:\Windows\ccmcache` in its command line from roughly half of all BIOC detections, including LSASS dump prevention rules mapped to MITRE ATT&CK T1003/TA0006. The global whitelist has been removed in Cortex XDR Agent 9.1 with content version 2160, though individual rule exceptions remain exploitable by attackers with knowledge of the plaintext rules. Defenders running agents below 9.1 should prioritize upgrading immediately. Those on patched versions should audit process command-line telemetry for ccmcache path injection and treat any closed-box EDR as a single layer rather than a complete control.
Read the full story