LLM-Driven Reverse Engineering of Palo Alto Cortex XDR Yields Working EDR Evasion (SpecterOps)
LLM-Driven Reverse Engineering of Palo Alto Cortex XDR (TL-2026-2576) is a high-severity tracked intrusion set, first published 2026-09-19. It has no confirmed attribution, affects Palo Alto Networks Cortex XDR, maps to 12 MITRE ATT&CK / ATLAS techniques (AML.T0007, AML.T0015, AML.T0043), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-2576
- Threat ID
- TL-2026-2576
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- 2026-09-19
- Last reviewed
- 2026-09-19
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in LLM-Driven Reverse Engineering of Palo Alto Cortex XDR
Malware and tooling: FindPOS, Binary Ninja, Codex-CLI, Day Shift harness, GPT-5.4-Cyber, GPT-5.5-Cyber
SpecterOps researcher Adam Chester used OpenAI's GPT-5.4-Cyber and GPT-5.5-Cyber models inside a custom agentic 'Day Shift' harness to systematically reverse engineer Palo Alto Cortex XDR, extracting 9,350 DSE rules (4,209 BIOC), 6,358 YARA signatures, and 7 tree-ensemble ML detection models. Decrypted CLIPS behavioral rules revealed an allowlisted output-path bypass: `reg save HKLM\SAM out.bin` is blocked, but `reg save HKLM\SAM C:\rcoc\sam.hive` dumps the SAM hive undetected.
How LLM-Driven Reverse Engineering of Palo Alto Cortex XDR works
On 2026-06-29, SpecterOps published research by Adam Chester (TRACE team) demonstrating that current-generation coding-focused LLMs can be pointed at a commercial EDR product and, with minimal scaffolding, autonomously extract its entire detection surface. The 'Day Shift' harness ran OpenAI's GPT-5.4-Cyber (later migrated mid-analysis to GPT-5.5-Cyber) inside Codex-CLI, executing in Docker containers with a persistent mounted workspace and Binary Ninja exposed as an MCP tool for disassembly. The loop was coordinated through four markdown files (REPORT.md for findings, STATE.md for cross-iteration state tracking, CODEMAP.md for disassembly references, and AGENTS.md for model instructions) that let the LLM resume long-running reverse-engineering work across context resets.
Applied against Palo Alto Networks Cortex XDR, the harness identified cyinjct.dll as the shared user-mode hook-writer DLL, documenting its early inline hooks on LdrInitializeThunk, NtContinue, NtTestAlert, and KiUserApcDispatcher. It located and decrypted the product's three main detection stores: 6,358 YARA rules (AES-128-ECB with an embedded, static, fixed key), 9,350 DSE behavioral rules including 4,209 shipped BIOC rules (494 of which were disabled via local dynamic overlays), and 7 tree-ensemble ML scorers covering PE, PowerShell, VBS, and JavaScript content, each extracted with a working offline execution harness for direct testing.
The behavioral (CLIPS/BIOC) rule store required a distinct decryption chain: a 64-byte secret embedded in cysvc.dll, combined with derivation parameters recovered from the product's own Lua configuration, produced an AES-256-CBC key; after PKCS#7 unpadding and gzip inflation, the plaintext CLIPS rules were readable. Analysis of those rules surfaced a concrete, live-tested evasion: Cortex XDR's behavioral detection for SAM-hive credential dumping keys off destination path rather than the underlying registry-export behavior. `reg save HKLM\SAM out.bin` triggers detection, but routing the same export to an allowlisted-looking destination (`reg save HKLM\SAM C:\rcoc\sam.hive`) executes without alerting — a direct real-world instance of path-based allowlist evasion (T1036.005) enabling undetected OS credential dumping (T1003.002).
Beyond the registry-export finding, the write-up documents categories of user-mode EDR bypass the extracted rule set exposes: clean ntdll remapping, direct syscalls, manual (reflective) process mapping, and prologue restoration to undo inline hooks — techniques that collectively impair or route around the product's user-mode instrumentation (T1562.001, T1620, T1622, T1106). For the seven extracted ML scorers, the author reports that feature suppression and structural manipulation of PE/script objects is a substantially more effective evasion strategy than raw-byte perturbation, because the models are explicit, inspectable tree ensembles rather than opaque deep networks — full white-box access to model architecture, features, and decision thresholds (T1588.[none]/AML.T0044) directly enables crafted adversarial inputs (AML.T0043) that evade the classifiers (AML.T0015).
The author states this extraction approach — pointing an agentic LLM loop at a target EDR with no specialized scaffolding beyond the four-file harness — has been applied across what the post calls 'the big 5' EDR vendors during SpecterOps engagements, with the extracted rules, signatures, and models retained on internal SpecterOps infrastructure. No CVE was assigned and no Palo Alto Networks patch or advisory addressing this specific June 2026 disclosure had been published as of the July 2026 tl;dr sec coverage; this is a tradecraft/detection-evasion disclosure rather than a software vulnerability report. The finding sits alongside a distinct, earlier, and unrelated Cortex XDR detection-bypass disclosure: InfoGuard Labs privately reported a global command-line-argument whitelist (`:\Windows\ccmcache`) that suppressed roughly half of Cortex XDR's behavioral detections (affecting agent versions 8.7/8.8) in mid-2025, which Palo Alto Networks fixed at the end of February 2026 in Agent 9.1 / content version 2160 by removing the global whitelists and altering the encryption key derivation. That patch addressed the InfoGuard-reported whitelist bypass specifically and is not confirmed to address the SpecterOps LLM-extracted allowlisted-path finding covered here.
MITRE ATT&CK / ATLAS techniques used in TL-2026-2576
Discovery
AML.T0007 Discover AI Artifacts; T1518.001 Security Software Discovery
initial-access
AML.T0015 Evade AI Model
AI Attack Staging
AML.T0043 Craft Adversarial Data
AI Model Access
AML.T0044 Full AI Model Access
Credential Access
T1003.002 Security Account Manager
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1620 Reflective Code Loading; T1622 Debugger Evasion
Execution
Resource Development
T1588.007 Artificial Intelligence
defense-impairment
Affected products and versions in LLM-Driven Reverse Engineering of Palo Alto Cortex XDR
- Palo Alto Networks — Cortex XDR
Vulnerable versions: not publicly specified by SpecterOps in the June 2026 disclosure
Fixed in: not publicly confirmed as of the July 2026 tl;dr sec coverage
Remediation for LLM-Driven Reverse Engineering of Palo Alto Cortex XDR
Patches
- No vendor patch or advisory addressing the SpecterOps June 2026 LLM-extracted allowlisted-path SAM-dump bypass had been published as of the July 2026 coverage reviewed.
- A related but distinct Cortex XDR global-whitelist bypass (reported separately by InfoGuard Labs, affecting the `:\Windows\ccmcache` command-line allowlist) was fixed by Palo Alto Networks in Cortex XDR Agent 9.1 with content version 2160 (end of February 2026), which removed the global whitelists and altered the BIOC/CLIPS encryption key derivation process.
Immediate actions
- Do not rely on destination-path allowlists for behavioral detection of sensitive registry exports; alert on `reg save`/`reg export` (and equivalent API calls) against HKLM\SAM, HKLM\SYSTEM, and HKLM\SECURITY regardless of the output path, including paths under commonly allowlisted maintenance/patch-tooling directories.
- Hunt retrospectively for registry hive exports to non-standard or newly-created directories (e.g. paths resembling `C:\rcoc\`) that would not have matched prior path-based detection logic.
- Treat vendor-supplied EDR rule/YARA/ML-model content as recoverable by a sufficiently motivated adversary; do not depend on secrecy of detection logic as a primary control.
Workarounds
- Configure custom, non-path-dependent behavioral rules (via SIEM/XDR correlation outside the native Cortex rule engine) for `reg save`/`reg.exe export` targeting SAM/SYSTEM/SECURITY hives.
- Restrict write access to directories that would plausibly be added to future allowlists, and monitor for creation of new directories immediately followed by registry-export activity.
Longer-term hardening
- Layer EDR behavioral detection with independent, out-of-band monitoring (e.g. Windows Event Log auditing for SAM/SECURITY hive access, Sysmon FileCreate/RegistryEvent correlation) that does not share the same rule engine or allowlist logic as the EDR being evaded.
- For vendors: strengthen at-rest protection of shipped detection content (move away from static/embedded symmetric keys such as AES-128-ECB with a fixed key) and assume LLM-accelerated reverse engineering materially lowers the cost of full rule-set extraction going forward.
- For defenders: pressure-test EDR behavioral rules against known allowlist-evasion patterns (path substitution, parent-process spoofing, argument obfuscation) as part of periodic detection engineering validation, not only signature-based coverage.
Weaknesses (CWE) in LLM-Driven Reverse Engineering of Palo Alto Cortex XDR
CWE-321
Timeline of LLM-Driven Reverse Engineering of Palo Alto Cortex XDR
- InfoGuard Labs privately discloses to Palo Alto Networks a separate, earlier Cortex XDR BIOC global-whitelist bypass (command-line argument containing ':\Windows\ccmcache' suppresses roughly half of behavioral detections), affecting agent versions 8.7/8.8. This is a distinct researcher and technique from the SpecterOps LLM-driven finding below.
- Palo Alto Networks ships Cortex XDR Agent 9.1 with content version 2160, removing the global command-line whitelists reported by InfoGuard Labs and altering the CLIPS/BIOC encryption key derivation process. This patch addresses the InfoGuard-reported issue and is not confirmed to cover the SpecterOps allowlisted-path finding disclosed four months later.
- SpecterOps publishes 'Introducing GhostWorks,' a practical AI cybersecurity research initiative, establishing the context for its subsequent LLM-driven EDR analysis work.
- SpecterOps publishes 'Accelerating EDR Evasion with LLM-Driven Analysis' by Adam Chester, disclosing the GPT-5.4-Cyber/GPT-5.5-Cyber-driven extraction of Cortex XDR's DSE/BIOC rules, YARA signatures, and ML models, and demonstrating the allowlisted-path SAM-hive-dump bypass (`reg save HKLM\SAM C:\rcoc\sam.hive`).
- The tl;dr sec newsletter (#338) covers and amplifies the SpecterOps research, noting the simplicity of the agentic extraction loop relative to prior manual EDR reverse-engineering efforts.
- Adam Chester republishes the same analysis on his personal XPN Infosec blog, adding file-path detail on the extracted Cortex XDR artifacts (cyinjct.dll, cysvc.dll).
Sources cited for LLM-Driven Reverse Engineering of Palo Alto Cortex XDR
- Accelerating EDR Evasion with LLM-Driven Analysis
- tl;dr sec #338
- Accelerating EDR Evasion with LLM-Driven Analysis (author mirror)
- Introducing GhostWorks: A Practical AI Initiative from SpecterOps
- AI-Powered Reverse Engineering Turns EDR Rule Analysis Into Automated Evasion Workflow
- Researchers Uncover Ways to Decrypt Palo Alto Cortex XDR BIOC Rules for Evasion (related, earlier disclosure)
- Decrypting and Abusing Predefined BIOCs in Palo Alto Cortex XDR (related, earlier disclosure)
- Researchers Uncover Methods to Decrypt and Abuse Encrypted Palo Alto Cortex XDR BIOC Rules for Evasion (related, earlier disclosure)
More in threat intel
- France Dark Web Threat Landscape: Ransomware and Hacktivist Activity Surges 4x Over 24 Months
- FBI, DOJ, and RCMP Seize NightmareStresser DDoS-for-Hire Domains in Latest Operation PowerOFF Action
- Rehub: Russian-Language Ransomware-as-a-Service Marketplace Absorbing RAMP's Displaced Operators
- VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy Service for Ransomware Prep and Credential Theft
- Blockchain-Based C2 Evolution: Nation-State Actors Adopt Smart-Contract C2 (EtherHiding, JADESNOW/INVISIBLEFERRET, SharkStealer)
Detection coverage for TL-2026-2576
As of 2026-09-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2576 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.