Bypass Record
Tamper-Protection Bypass × Palo Alto Networks Cortex XDR
A publicly-reported instance of Tamper-Protection Bypass bypassing Palo Alto Networks Cortex XDR, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The attacker uses a hard link to redirect file access, bypassing folder-level anti-tampering protection to edit plaintext Lua rule files. By removing rules and triggering a reload, a vulnerable driver is loaded, granting full control. The XDR's password is changed to prevent removal, and communication to servers is blocked while the agent appears operational.
Detection & mitigation
Monitor for unexpected modifications to Cortex XDR Lua rule files (e.g., via file integrity monitoring on the agent's content directory) and alert on hard link creation targeting protected paths. Enforce strict access controls and apply vendor patches to prevent anti-tampering bypass.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.