Researchers extract and read the hidden detection rules in Cortex XDR

An analysis shows how the predefined behavioural rules (BIOCs) in Palo Alto Cortex XDR can be extracted from the agent, decrypted and understood outside the platform. The rules are designed to detect attacker behaviour rather than static indicators, are distributed to customers through content updates, and are normally opaque to users. By exposing the detection logic itself, the researchers show the same knowledge can be used to test and potentially evade detections, by adjusting behaviour to stay under thresholds or avoid specific conditions.

What this means for your organisation

Many organisations treat their EDR or XDR platform as a finished answer to detection and let the vendor's rule set be the entire control. This analysis shows vendor logic is not a secret an attacker cannot obtain. For a management team asked how well the organisation detects attacks, the point is not that the product is poor, but that a single layer of vendor rules is not a detection strategy on its own. Detection capability has to be measured, not assumed.

Berigo recommends

• Supplement the vendor rule set with your own detections tied to your systems and working patterns.
• Keep independent detection sources such as identity platform, network and cloud logs, so one failing layer does not leave you blind.
• Test detection capability regularly with simulated attack techniques, and follow up on what actually raised an alert.
• Ask the vendor to account for how quickly the rule set is updated when new techniques become known.