LLM-Driven Reverse Engineering of Palo Alto Cortex XDR Yields Working EDR Evasion (SpecterOps)

Key facts for Cortex XDR LLM evasion

Detection coverage for Cortex XDR LLM evasion

As of 2026-09-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2576 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Path-Agnostic SAM/SYSTEM/SECURITY Hive Export via reg save/export

Detects `reg save`/`reg export` (or equivalent registry-export invocations) targeting the SAM, SYSTEM, or SECURITY registry hives regardless of destination path. Cortex XDR's shipped BIOC/CLIPS behavioral rules were found to key detection off the output path rather than the underlying registry-export behavior, so `reg save HKLM\SAM out.bin` is blocked while `reg save HKLM\SAM C:\rcoc\sam.hive` dumps the hive undetected. This rule alerts on the export behavior itself, closing that allowlisted-path evasion gap.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1003.002, T1036.005
• Data sources: sysmon, windows_security, edr_process_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon OR index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval cmd=lower(CommandLine)
| where match(cmd, "reg(\.exe)?\s+(save|export)") AND (match(cmd, "hklm\\\\sam") OR match(cmd, "hklm\\\\system") OR match(cmd, "hklm\\\\security"))
| eval known_evasion_path=if(match(cmd, "c:\\\\rcoc\\\\"), "true", "false")
| table _time, ComputerName, User, ParentImage, Image, CommandLine, known_evasion_path
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("reg.exe")
| where ProcessCommandLine has_any ("save", "export")
| where ProcessCommandLine has_any ("HKLM\\SAM", "HKLM\\SYSTEM", "HKLM\\SECURITY", "hklm\\sam", "hklm\\system", "hklm\\security")
| extend KnownEvasionPath = iff(ProcessCommandLine has "rcoc", true, false)
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine, KnownEvasionPath

Sigma

title: Registry Hive Export of SAM/SYSTEM/SECURITY via reg.exe (Path-Agnostic)
id: 7a2e1b3c-4f5d-4a2b-9c1e-8d3f2a1b6c4e
status: experimental
description: >
  Detects reg save/reg export (or equivalent) targeting the SAM, SYSTEM, or SECURITY
  registry hives regardless of destination path. Closes a Cortex XDR behavioral-detection
  gap that keyed on destination path (e.g. an allowlisted-looking C:\rcoc\sam.hive)
  rather than the underlying export behavior, as disclosed by SpecterOps (June 2026).
references:
    - https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis/
    - https://attack.mitre.org/techniques/T1003/002/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-19
tags:
    - attack.credential-access
    - attack.t1003.002
    - attack.defense-evasion
    - attack.t1036.005
    - attack.tool.reg_exe
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith: '\reg.exe'
    selection_action:
        CommandLine|contains:
            - 'save'
            - 'export'
    selection_hive:
        CommandLine|contains:
            - 'HKLM\SAM'
            - 'HKLM\SYSTEM'
            - 'HKLM\SECURITY'
            - 'hklm\sam'
            - 'hklm\system'
            - 'hklm\security'
    condition: all of selection_*
falsepositives:
    - Authorized backup/imaging tooling exporting registry hives for legitimate DR or forensic purposes
    - Sanctioned patch-management or system-imaging scripts (validate against a maintained allowlist of signed automation, not destination path alone)
level: high

Known false positives:

• Authorized backup/DR imaging or forensic tooling exporting registry hives
• Sanctioned patch-management/system-imaging automation scripts performing legitimate hive backups

Tuning notes: Baseline and allowlist known-signed backup/imaging service accounts and their process lineage instead of the output directory, since destination path is exactly what the disclosed Cortex XDR bypass exploited; correlate with subsequent hive-file access or exfiltration for higher-confidence alerting; tune out approved SCCM/imaging maintenance windows.

• 🔒 Path-Agnostic SAM/SYSTEM/SECURITY Hive Export via reg save/export · unlock with TL Creds
• 🔒 User-Mode EDR Hook Removal via Clean NTDLL Remap / Unbacked-Memory Direct Syscall · unlock with TL Creds
• 🔒 Security Software Discovery Paired with Local EDR Binary/Rule-Store Access or RE Tooling · unlock with TL Creds
• 🔒 Path-Agnostic SAM/SYSTEM/SECURITY Hive Export via reg save/export · unlock with TL Creds
• 🔒 User-Mode EDR Hook Removal via Clean NTDLL Remap / Unbacked-Memory Direct Syscall · unlock with TL Creds
• 🔒 Security Software Discovery Paired with Local EDR Binary/Rule-Store Access or RE Tooling · unlock with TL Creds
• 🔒 User-Mode EDR Hook Removal via Clean NTDLL Remap / Unbacked-Memory Direct Syscall · unlock with TL Creds
• 🔒 Security Software Discovery Paired with Local EDR Binary/Rule-Store Access or RE Tooling · unlock with TL Creds

Indicators of compromise for Cortex XDR LLM evasion

As of 2026-09-19, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-2576.

How Cortex XDR LLM evasion works

Decrypted CLIPS behavioral rules revealed an allowlisted output-path bypass: `reg save HKLM\SAM out.bin` is blocked, but `reg save HKLM\SAM C:\rcoc\sam.hive` dumps the SAM hive undetected.

On 2026-06-29, SpecterOps published research by Adam Chester (TRACE team) demonstrating that current-generation coding-focused LLMs can be pointed at a commercial EDR product and, with minimal scaffolding, autonomously extract its entire detection surface. The 'Day Shift' harness ran OpenAI's GPT-5.4-Cyber (later migrated mid-analysis to GPT-5.5-Cyber) inside Codex-CLI, executing in Docker containers with a persistent mounted workspace and Binary Ninja exposed as an MCP tool for disassembly. The loop was coordinated through four markdown files (REPORT.md for findings, STATE.md for cross-iteration state tracking, CODEMAP.md for disassembly references, and AGENTS.md for model instructions) that let the LLM resume long-running reverse-engineering work across context resets.

Applied against Palo Alto Networks Cortex XDR, the harness identified cyinjct.dll as the shared user-mode hook-writer DLL, documenting its early inline hooks on LdrInitializeThunk, NtContinue, NtTestAlert, and KiUserApcDispatcher. It located and decrypted the product's three main detection stores: 6,358 YARA rules (AES-128-ECB with an embedded, static, fixed key), 9,350 DSE behavioral rules including 4,209 shipped BIOC rules (494 of which were disabled via local dynamic overlays), and 7 tree-ensemble ML scorers covering PE, PowerShell, VBS, and JavaScript content, each extracted with a working offline execution harness for direct testing.

The behavioral (CLIPS/BIOC) rule store required a distinct decryption chain: a 64-byte secret embedded in cysvc.dll, combined with derivation parameters recovered from the product's own Lua configuration, produced an AES-256-CBC key; after PKCS#7 unpadding and gzip inflation, the plaintext CLIPS rules were readable. Analysis of those rules surfaced a concrete, live-tested evasion: Cortex XDR's behavioral detection for SAM-hive credential dumping keys off destination path rather than the underlying registry-export behavior. `reg save HKLM\SAM out.bin` triggers detection, but routing the same export to an allowlisted-looking destination (`reg save HKLM\SAM C:\rcoc\sam.hive`) executes without alerting — a direct real-world instance of path-based allowlist evasion (T1036.005) enabling undetected OS credential dumping (T1003.002).

Beyond the registry-export finding, the write-up documents categories of user-mode EDR bypass the extracted rule set exposes: clean ntdll remapping, direct syscalls, manual (reflective) process mapping, and prologue restoration to undo inline hooks — techniques that collectively impair or route around the product's user-mode instrumentation (T1562.001, T1620, T1622, T1106). For the seven extracted ML scorers, the author reports that feature suppression and structural manipulation of PE/script objects is a substantially more effective evasion strategy than raw-byte perturbation, because the models are explicit, inspectable tree ensembles rather than opaque deep networks — full white-box access to model architecture, features, and decision thresholds (T1588.[none]/AML.T0044) directly enables crafted adversarial inputs (AML.T0043) that evade the classifiers (AML.T0015).

The author states this extraction approach — pointing an agentic LLM loop at a target EDR with no specialized scaffolding beyond the four-file harness — has been applied across what the post calls 'the big 5' EDR vendors during SpecterOps engagements, with the extracted rules, signatures, and models retained on internal SpecterOps infrastructure. No CVE was assigned and no Palo Alto Networks patch or advisory addressing this specific June 2026 disclosure had been published as of the July 2026 tl;dr sec coverage; this is a tradecraft/detection-evasion disclosure rather than a software vulnerability report. The finding sits alongside a distinct, earlier, and unrelated Cortex XDR detection-bypass disclosure: InfoGuard Labs privately reported a global command-line-argument whitelist (`:\Windows\ccmcache`) that suppressed roughly half of Cortex XDR's behavioral detections (affecting agent versions 8.7/8.8) in mid-2025, which Palo Alto Networks fixed at the end of February 2026 in Agent 9.1 / content version 2160 by removing the global whitelists and altering the encryption key derivation. That patch addressed the InfoGuard-reported whitelist bypass specifically and is not confirmed to address the SpecterOps LLM-extracted allowlisted-path finding covered here.

MITRE ATT&CK / ATLAS techniques by tactic:

Discovery

AML.T0007 Discover AI Artifacts; T1518.001 Security Software Discovery

initial-access

AML.T0015 Evade AI Model

AI Attack Staging

AML.T0043 Craft Adversarial Data

AI Model Access

AML.T0044 Full AI Model Access

Credential Access

T1003.002 Security Account Manager

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1620 Reflective Code Loading; T1622 Debugger Evasion

Execution

T1106 Native API

Resource Development

T1588.007 Artificial Intelligence

defense-impairment

T1685 Disable or Modify Tools

Remediation for Cortex XDR LLM evasion

Patches

• No vendor patch or advisory addressing the SpecterOps June 2026 LLM-extracted allowlisted-path SAM-dump bypass had been published as of the July 2026 coverage reviewed.
• A related but distinct Cortex XDR global-whitelist bypass (reported separately by InfoGuard Labs, affecting the `:\Windows\ccmcache` command-line allowlist) was fixed by Palo Alto Networks in Cortex XDR Agent 9.1 with content version 2160 (end of February 2026), which removed the global whitelists and altered the BIOC/CLIPS encryption key derivation process.

Immediate actions

• Do not rely on destination-path allowlists for behavioral detection of sensitive registry exports; alert on `reg save`/`reg export` (and equivalent API calls) against HKLM\SAM, HKLM\SYSTEM, and HKLM\SECURITY regardless of the output path, including paths under commonly allowlisted maintenance/patch-tooling directories.
• Hunt retrospectively for registry hive exports to non-standard or newly-created directories (e.g. paths resembling `C:\rcoc\`) that would not have matched prior path-based detection logic.
• Treat vendor-supplied EDR rule/YARA/ML-model content as recoverable by a sufficiently motivated adversary; do not depend on secrecy of detection logic as a primary control.

Workarounds

• Configure custom, non-path-dependent behavioral rules (via SIEM/XDR correlation outside the native Cortex rule engine) for `reg save`/`reg.exe export` targeting SAM/SYSTEM/SECURITY hives.
• Restrict write access to directories that would plausibly be added to future allowlists, and monitor for creation of new directories immediately followed by registry-export activity.

Longer-term hardening

• Layer EDR behavioral detection with independent, out-of-band monitoring (e.g. Windows Event Log auditing for SAM/SECURITY hive access, Sysmon FileCreate/RegistryEvent correlation) that does not share the same rule engine or allowlist logic as the EDR being evaded.
• For vendors: strengthen at-rest protection of shipped detection content (move away from static/embedded symmetric keys such as AES-128-ECB with a fixed key) and assume LLM-accelerated reverse engineering materially lowers the cost of full rule-set extraction going forward.
• For defenders: pressure-test EDR behavioral rules against known allowlist-evasion patterns (path substitution, parent-process spoofing, argument obfuscation) as part of periodic detection engineering validation, not only signature-based coverage.

Affected and fixed versions

• Palo Alto Networks — Cortex XDR
  Vulnerable versions: not publicly specified by SpecterOps in the June 2026 disclosure
  Fixed in: not publicly confirmed as of the July 2026 tl;dr sec coverage

Timeline of Cortex XDR LLM evasion

• 2025-07-01 InfoGuard Labs privately discloses to locked-ioc-5 a separate, earlier Cortex XDR BIOC global-whitelist bypass (command-line argument containing ':\Windows\ccmcache' suppresses roughly half of behavioral detections), affecting agent versions 8.7/8.8. This is a distinct researcher and technique from the locked-ioc-13 LLM-driven finding below.
• 2026-02-28 locked-ioc-5 ships Cortex XDR Agent 9.1 with content version 2160, removing the global command-line whitelists reported by InfoGuard Labs and altering the CLIPS/BIOC encryption key derivation process. This patch addresses the InfoGuard-reported issue and is not confirmed to cover the locked-ioc-13 allowlisted-path finding disclosed four months later.
• 2026-06-09 locked-ioc-13 publishes 'Introducing GhostWorks,' a practical AI cybersecurity research initiative, establishing the context for its subsequent LLM-driven EDR analysis work.
• 2026-06-29 locked-ioc-13 publishes 'Accelerating EDR Evasion with LLM-Driven Analysis' by locked-ioc-11, disclosing the locked-ioc-8/locked-ioc-9-driven extraction of Cortex XDR's DSE/BIOC rules, YARA signatures, and ML models, and demonstrating the allowlisted-path SAM-hive-dump bypass (`reg save HKLM\SAM locked-ioc-7`).
• 2026-07-23 The tl;dr sec newsletter (#338) covers and amplifies the locked-ioc-13 research, noting the simplicity of the agentic extraction loop relative to prior manual EDR reverse-engineering efforts.
• 2026-07-30 locked-ioc-11 republishes the same analysis on his personal XPN Infosec blog, adding file-path detail on the extracted Cortex XDR artifacts (locked-ioc-12, locked-ioc-14).

Sources cited for Cortex XDR LLM evasion

• Accelerating EDR Evasion with LLM-Driven Analysis specterops.io · Research · 2026-06-29
• Decrypting and Abusing Predefined BIOCs in Palo Alto Cortex XDR (related, earlier disclosure) labs.infoguard.ch · Research
• Accelerating EDR Evasion with LLM-Driven Analysis (author mirror) blog.xpnsec.com · Blog · 2026-07-30
• Introducing GhostWorks: A Practical AI Initiative from SpecterOps specterops.io · Blog · 2026-06-09
• AI-Powered Reverse Engineering Turns EDR Rule Analysis Into Automated Evasion Workflow gbhackers.com · News
• Researchers Uncover Ways to Decrypt Palo Alto Cortex XDR BIOC Rules for Evasion (related, earlier disclosure) gbhackers.com · News
• Researchers Uncover Methods to Decrypt and Abuse Encrypted Palo Alto Cortex XDR BIOC Rules for Evasion (related, earlier disclosure) cybersecuritynews.com · News
• tl;dr sec #338 tldrsec.com · Newsletter · 2026-07-23

More in threat intel

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• ARTEX agentic AI offensive framework abuse expands as Storm-3358 targets financial sector
• Brute Force Attacks Against Internet-Exposed RDP/RD Gateway/RDWeb, SSH and macOS Logins (Huntress Brute Force Sentry)
• OpenAI GPT-6 Cyber AI Model Finds 81 Firefox Flaws and Develops Root Exploits for 948 Linux Kernel Flaws
• France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism

Previous and next in threat intel

• France Dark Web Threat Landscape: Ransomware and Hacktivist Activity Surges 4x Over 24 Months Previous report
• Google Gemini AI Model Autonomously Breached Three Real Companies During Authorized Security Evaluation Next report