# LLM-Driven Reverse Engineering of Palo Alto Cortex XDR Yields Working EDR Evasion (SpecterOps)

> SpecterOps researcher Adam Chester used OpenAI's GPT-5.4-Cyber and GPT-5.5-Cyber models inside a custom agentic 'Day Shift' harness to systematically reverse engineer Palo Alto Cortex XDR, extracting 9,350 DSE rules (4,209 BIOC), 6,358 YARA signatures, and 7 tree-ensemble ML detection models. Decrypted CLIPS behavioral rules revealed an allowlisted output-path bypass: `reg save HKLM\SAM out.bin` is blocked, but `reg save HKLM\SAM C:\rcoc\sam.hive` dumps the SAM hive undetected.

- **Published:** 2026-09-19T00:00:00Z
- **Last reviewed:** 2026-09-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2576
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-cortex-xdr-llm-evasion-tl-2026-2576.webp?v=628e6483 (Threadlinqs threat intel: SpecterOps LLM Cortex XDR Evasion: Analysis & Hunting (TL-2026-2576) — High severity, 16 IOCs, 9 detection rules.)
- **ID:** TL-2026-2576
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 16

## Description

On 2026-06-29, SpecterOps published research by Adam Chester (TRACE team) demonstrating that current-generation coding-focused LLMs can be pointed at a commercial EDR product and, with minimal scaffolding, autonomously extract its entire detection surface. The 'Day Shift' harness ran OpenAI's GPT-5.4-Cyber (later migrated mid-analysis to GPT-5.5-Cyber) inside Codex-CLI, executing in Docker containers with a persistent mounted workspace and Binary Ninja exposed as an MCP tool for disassembly. The loop was coordinated through four markdown files (REPORT.md for findings, STATE.md for cross-iteration state tracking, CODEMAP.md for disassembly references, and AGENTS.md for model instructions) that let the LLM resume long-running reverse-engineering work across context resets.

Applied against Palo Alto Networks Cortex XDR, the harness identified cyinjct.dll as the shared user-mode hook-writer DLL, documenting its early inline hooks on LdrInitializeThunk, NtContinue, NtTestAlert, and KiUserApcDispatcher. It located and decrypted the product's three main detection stores: 6,358 YARA rules (AES-128-ECB with an embedded, static, fixed key), 9,350 DSE behavioral rules including 4,209 shipped BIOC rules (494 of which were disabled via local dynamic overlays), and 7 tree-ensemble ML scorers covering PE, PowerShell, VBS, and JavaScript content, each extracted with a working offline execution harness for direct testing.

The behavioral (CLIPS/BIOC) rule store required a distinct decryption chain: a 64-byte secret embedded in cysvc.dll, combined with derivation parameters recovered from the product's own Lua configuration, produced an AES-256-CBC key; after PKCS#7 unpadding and gzip inflation, the plaintext CLIPS rules were readable. Analysis of those rules surfaced a concrete, live-tested evasion: Cortex XDR's behavioral detection for SAM-hive credential dumping keys off destination path rather than the underlying registry-export behavior. `reg save HKLM\SAM out.bin` triggers detection, but routing the same export to an allowlisted-looking destination (`reg save HKLM\SAM C:\rcoc\sam.hive`) executes without alerting — a direct real-world instance of path-based allowlist evasion (T1036.005) enabling undetected OS credential dumping (T1003.002).

Beyond the registry-export finding, the write-up documents categories of user-mode EDR bypass the extracted rule set exposes: clean ntdll remapping, direct syscalls, manual (reflective) process mapping, and prologue restoration to undo inline hooks — techniques that collectively impair or route around the product's user-mode instrumentation (T1562.001, T1620, T1622, T1106). For the seven extracted ML scorers, the author reports that feature suppression and structural manipulation of PE/script objects is a substantially more effective evasion strategy than raw-byte perturbation, because the models are explicit, inspectable tree ensembles rather than opaque deep networks — full white-box access to model architecture, features, and decision thresholds (T1588.[none]/AML.T0044) directly enables crafted adversarial inputs (AML.T0043) that evade the classifiers (AML.T0015).

The author states this extraction approach — pointing an agentic LLM loop at a target EDR with no specialized scaffolding beyond the four-file harness — has been applied across what the post calls 'the big 5' EDR vendors during SpecterOps engagements, with the extracted rules, signatures, and models retained on internal SpecterOps infrastructure. No CVE was assigned and no Palo Alto Networks patch or advisory addressing this specific June 2026 disclosure had been published as of the July 2026 tl;dr sec coverage; this is a tradecraft/detection-evasion disclosure rather than a software vulnerability report. The finding sits alongside a distinct, earlier, and unrelated Cortex XDR detection-bypass disclosure: InfoGuard Labs privately reported a global command-line-argument whitelist (`:\Windows\ccmcache`) that suppressed roughly half of Cortex XDR's behavioral detections (affecting agent versions 8.7/8.8) in mid-2025, which Palo Alto Networks fixed at the end of February 2026 in Agent 9.1 / content version 2160 by removing the global whitelists and altering the encryption key derivation. That patch addressed the InfoGuard-reported whitelist bypass specifically and is not confirmed to address the SpecterOps LLM-extracted allowlisted-path finding covered here.

## MITRE ATT&CK

- T1588.007 Artificial Intelligence
- T1003.002 Security Account Manager
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1622 Debugger Evasion
- T1106 Native API
- T1518.001 Security Software Discovery
- AML.T0044 Full AI Model Access
- AML.T0015 Evade AI Model
- AML.T0043 Craft Adversarial Data
- AML.T0007 Discover AI Artifacts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Path-Agnostic SAM/SYSTEM/SECURITY Hive Export via reg save/export** (`TL-2026-2576-SPL-001`)

Detects `reg save`/`reg export` (or equivalent registry-export invocations) targeting the SAM, SYSTEM, or SECURITY registry hives regardless of destination path. Cortex XDR's shipped BIOC/CLIPS behavioral rules were found to key detection off the output path rather than the underlying registry-export behavior, so `reg save HKLM\SAM out.bin` is blocked while `reg save HKLM\SAM C:\rcoc\sam.hive` dumps the hive undetected. This rule alerts on the export behavior itself, closing that allowlisted-path evasion gap.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1003.002, T1036.005
- **Data sources:** sysmon, windows_security, edr_process_telemetry
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon OR index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval cmd=lower(CommandLine)
| where match(cmd, "reg(\.exe)?\s+(save|export)") AND (match(cmd, "hklm\\\\sam") OR match(cmd, "hklm\\\\system") OR match(cmd, "hklm\\\\security"))
| eval known_evasion_path=if(match(cmd, "c:\\\\rcoc\\\\"), "true", "false")
| table _time, ComputerName, User, ParentImage, Image, CommandLine, known_evasion_path
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("reg.exe")
| where ProcessCommandLine has_any ("save", "export")
| where ProcessCommandLine has_any ("HKLM\\SAM", "HKLM\\SYSTEM", "HKLM\\SECURITY", "hklm\\sam", "hklm\\system", "hklm\\security")
| extend KnownEvasionPath = iff(ProcessCommandLine has "rcoc", true, false)
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine, KnownEvasionPath
```

### Sigma

```yaml
title: Registry Hive Export of SAM/SYSTEM/SECURITY via reg.exe (Path-Agnostic)
id: 7a2e1b3c-4f5d-4a2b-9c1e-8d3f2a1b6c4e
status: experimental
description: >
  Detects reg save/reg export (or equivalent) targeting the SAM, SYSTEM, or SECURITY
  registry hives regardless of destination path. Closes a Cortex XDR behavioral-detection
  gap that keyed on destination path (e.g. an allowlisted-looking C:\rcoc\sam.hive)
  rather than the underlying export behavior, as disclosed by SpecterOps (June 2026).
references:
    - https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis/
    - https://attack.mitre.org/techniques/T1003/002/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-19
tags:
    - attack.credential-access
    - attack.t1003.002
    - attack.defense-evasion
    - attack.t1036.005
    - attack.tool.reg_exe
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith: '\reg.exe'
    selection_action:
        CommandLine|contains:
            - 'save'
            - 'export'
    selection_hive:
        CommandLine|contains:
            - 'HKLM\SAM'
            - 'HKLM\SYSTEM'
            - 'HKLM\SECURITY'
            - 'hklm\sam'
            - 'hklm\system'
            - 'hklm\security'
    condition: all of selection_*
falsepositives:
    - Authorized backup/imaging tooling exporting registry hives for legitimate DR or forensic purposes
    - Sanctioned patch-management or system-imaging scripts (validate against a maintained allowlist of signed automation, not destination path alone)
level: high
```

**Known false positives:**

- Authorized backup/DR imaging or forensic tooling exporting registry hives
- Sanctioned patch-management/system-imaging automation scripts performing legitimate hive backups

**Tuning notes:** Baseline and allowlist known-signed backup/imaging service accounts and their process lineage instead of the output directory, since destination path is exactly what the disclosed Cortex XDR bypass exploited; correlate with subsequent hive-file access or exfiltration for higher-confidence alerting; tune out approved SCCM/imaging maintenance windows.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Path-Agnostic SAM/SYSTEM/SECURITY Hive Export via reg save/export (locked: unlock with TL Creds)
- User-Mode EDR Hook Removal via Clean NTDLL Remap / Unbacked-Memory Direct Syscall (locked: unlock with TL Creds)
- Security Software Discovery Paired with Local EDR Binary/Rule-Store Access or RE Tooling (locked: unlock with TL Creds)
- Path-Agnostic SAM/SYSTEM/SECURITY Hive Export via reg save/export (locked: unlock with TL Creds)
- User-Mode EDR Hook Removal via Clean NTDLL Remap / Unbacked-Memory Direct Syscall (locked: unlock with TL Creds)
- Security Software Discovery Paired with Local EDR Binary/Rule-Store Access or RE Tooling (locked: unlock with TL Creds)
- User-Mode EDR Hook Removal via Clean NTDLL Remap / Unbacked-Memory Direct Syscall (locked: unlock with TL Creds)
- Security Software Discovery Paired with Local EDR Binary/Rule-Store Access or RE Tooling (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Accelerating EDR Evasion with LLM-Driven Analysis](https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis/)
- [tl;dr sec #338](https://tldrsec.com/p/tldr-sec-338)
- [Accelerating EDR Evasion with LLM-Driven Analysis (author mirror)](https://blog.xpnsec.com/accelerating-edr-evasion-with-llm/)
- [Introducing GhostWorks: A Practical AI Initiative from SpecterOps](https://specterops.io/blog/2026/06/09/introducing-ghostworks-ai-cybersecurity-research/)
- [AI-Powered Reverse Engineering Turns EDR Rule Analysis Into Automated Evasion Workflow](https://gbhackers.com/ai-powered-reverse-engineering/)
- [Researchers Uncover Ways to Decrypt Palo Alto Cortex XDR BIOC Rules for Evasion (related, earlier disclosure)](https://gbhackers.com/researchers-decrypt-palo-alto-cortex-xdr-bioc-rules-for-evasion/)
- [Decrypting and Abusing Predefined BIOCs in Palo Alto Cortex XDR (related, earlier disclosure)](https://labs.infoguard.ch/posts/decrypting-and-abusing_paloalto-cortex-xdr_behavioral-rules_biocs/)
- [Researchers Uncover Methods to Decrypt and Abuse Encrypted Palo Alto Cortex XDR BIOC Rules for Evasion (related, earlier disclosure)](https://cybersecuritynews.com/decrypt-and-exploit-cortex-xdr/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2576