LLM-Assisted Reverse Engineering of Palo Alto Cortex XDR Enables Targeted EDR Evasion (SpecterOps research, tl;dr sec #338)

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5519 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5519 SAM/SECURITY/SYSTEM Hive Export via reg.exe to Any Path (EDR-Independent)

Detects reg.exe 'save' or 'export' of the HKLM SAM, SECURITY or SYSTEM hives regardless of destination path. The SpecterOps/Cortex XDR research (TL-2026-5519) showed that 'reg save HKLM\SAM' is detected by the EDR while a variant writing to an allowlisted path (C:\rcoc\sam.hive) was not. This rule runs on raw Sysmon EID 1 and Windows Security 4688 command lines so it does not depend on any EDR verdict or path allowlist. Flags the known IOC path/filename (rcoc, sam.hive) as an extra field.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1003.002, T1003.004, T1059.003
• Data sources: sysmon, windows_security, defender_xdr_devices
• Severity: high
• Confidence: high

Splunk SPL

(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1) OR (index=wineventlog sourcetype="XmlWinEventLog:Security" EventCode=4688) earliest=-24h
| eval proc_cmd=coalesce(CommandLine, Process_Command_Line), actor=coalesce(User, SubjectUserName, Account_Name), parent=coalesce(ParentImage, ParentProcessName, Creator_Process_Name)
```TL-2026-5519: match reg save/export of SAM, SECURITY or whole SYSTEM hive; the dot wildcards stand in for backslash and quote characters so any destination path is covered```
| where match(proc_cmd, "(?i)(^|[^a-z0-9])reg(.exe)?.? +(save|export) +.?(hklm|hkey_local_machine).((sam|security)([^a-z0-9]|$)|system(.? |$))")
| rex field=proc_cmd "(?i)(sam|security|system).? +.?(?<dest_path>[^ ]+)"
| eval hive=case(match(proc_cmd, "(?i)(hklm|hkey_local_machine).sam"), "SAM", match(proc_cmd, "(?i)(hklm|hkey_local_machine).security"), "SECURITY", true(), "SYSTEM"), known_ioc=if(match(proc_cmd, "(?i)rcoc|sam[.]hive"), "yes", "no")
| stats count min(_time) as first_seen max(_time) as last_seen values(hive) as hives values(dest_path) as dest_paths values(known_ioc) as known_ioc values(proc_cmd) as commands by host, actor, parent
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine matches regex @'(?i)(^|[^a-z0-9])reg(.exe)?.? +(save|export) +.?(hklm|hkey_local_machine).((sam|security)([^a-z0-9]|$)|system(.? |$))'
| extend DestPath = extract(@'(?i)(sam|security|system).? +.?([^ ]+)', 2, ProcessCommandLine), KnownIocPath = ProcessCommandLine has_any ('rcoc', 'sam.hive')
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, DestPath, KnownIocPath
| order by Timestamp desc

Sigma

title: Registry Hive Export via reg.exe (SAM/SECURITY/SYSTEM) to Any Path
id: 6f1c2a3e-8b47-4d19-9a52-3c7e1d5b9f01
status: experimental
description: Detects reg.exe save/export of the SAM, SECURITY or SYSTEM hives regardless of output path, covering the allowlisted-path variant (C:\rcoc\sam.hive) reported in the SpecterOps Cortex XDR research (TL-2026-5519).
references:
  - https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis
  - https://attack.mitre.org/techniques/T1003/002/
author: Threadlinqs Team
date: 2026/11/09
tags:
  - attack.credential_access
  - attack.t1003.002
  - attack.t1003.004
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'
  selection_action:
    CommandLine|contains:
      - ' save '
      - ' export '
  selection_hive:
    CommandLine|contains:
      - 'hklm\sam'
      - 'hklm\security'
      - 'hklm\system '
      - 'hklm\system"'
      - 'hkey_local_machine\sam'
      - 'hkey_local_machine\security'
      - 'hkey_local_machine\system '
      - 'hkey_local_machine\system"'
  condition: all of selection_*
falsepositives:
  - Backup or imaging tooling that saves registry hives
  - Administrators performing authorised offline password audits
level: high

Known false positives:

• Backup, imaging or forensic tooling that exports SYSTEM/SAM hives for legitimate purposes
• Authorised red-team or purple-team credential-access exercises

Tuning notes: Allowlist only specific backup service accounts and parent processes, never destination paths (path allowlisting is the gap this research exploited). Enable Windows Security 4688 command-line auditing if Sysmon is not deployed. Use the known_ioc field (rcoc, sam.hive) to prioritise triage.

• 🔒 Alternate SAM/SYSTEM/NTDS Extraction via esentutl, Shadow Copy Reads and ntdsutil IFM · unlock with TL Creds
• 🔒 Cortex XDR Local Detection Content Copied or Accessed by Non-Vendor Process · unlock with TL Creds
• 🔒 Day Shift LLM Agent Harness State Files ([indicator], STATE.md, [indicator], AGENTS.md) · unlock with TL Creds
• 🔒 Registry Hive File Written by reg.exe or at Known IOC Path ([indicator]) · unlock with TL Creds
• 🔒 Cortex XDR Service Stop or Agent Protection Disable via sc, net or cytool · unlock with TL Creds
• 🔒 DNS Resolution of Community-Observed Sibling Domains (cdn-staticfiles.com, wiredrum.llc) · unlock with TL Creds
• 🔒 Security Software and Cortex XDR Discovery Command Cluster · unlock with TL Creds
• 🔒 Network Connections to Community-Observed Sibling Infrastructure (2.27.63.244, cdn-staticfiles.com, wiredrum.llc) · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5519.

Technical analysis

This is public research, not a CVE and not confirmed in-the-wild exploitation.

On 2026-06-29 SpecterOps published 'Accelerating EDR Evasion with LLM-Driven Analysis' by Adam Chester. It shows that a looping LLM agent can reverse engineer a commercial EDR agent largely unattended. The harness, called 'Day Shift', runs a single Codex-CLI agent in a Docker container inside a while loop. Each iteration restarts with fresh context and re-reads markdown state files (REPORT.md, STATE.md, CODEMAP.md, AGENTS.md) left by earlier runs. Binary Ninja is exposed to the agent through a custom MCP server. The models were OpenAI GPT-5.4-Cyber and later GPT-5.5-Cyber. The post presents this as a way to counter LLMs stopping early.

The case study is Palo Alto Networks Cortex XDR. According to the post and the tl;dr sec summary, everything was extracted from local files with no cloud access. The agent identified cyinjct.dll as the shared user-mode hook writer, which installs early inline hooks on functions such as LdrInitializeThunk and NtContinue. It found that YARA rulesets are stored in an encrypted wrapper that can be decrypted offline (about 6,358 rule inventory entries), and it wrote decryption tooling. The author validated the output by triggering a rule with a test string tied to a Mythic agent. The agent also found about 9,350 DSE behavioral rules, about 4,209 of them BIOC, with local overlays that disable some rules. Rule logic is exposed in plaintext Lua and JSON. Encrypted .clp blobs were decrypted into CLIPS (LISP-family) source, and 7 local ML models were extracted. The post describes these as tree-ensemble scorers with per-model thresholds, and the agent built working execution harnesses for them. Decryption keys and IVs are redacted and a full teardown was withheld.

The worked evasion example is credential dumping. Cortex detects `reg save HKLM\SAM`, but the decrypted CLIPS rule revealed an allowlisted destination path, and a variant writing to that path (C:\rcoc\sam.hive in the hunt data) was not detected. The author also previewed 'Upside Down', an early-stage simulation framework with Windows and EDR-emulation sub-agents that lets an LLM test extracted rules and iterate on evasions before touching a real environment. The tl;dr sec digest says the same process has already produced extracted rules and models for every major EDR vendor. This is a vendor-reported claim not independently verified here.

This follows TrustedSec's 2026-05-05 post 'The Defensive Stack is Exposed', which describes the same approach against five unnamed commercial endpoint products. It reports that work taking skilled reverse engineers weeks now takes days. The sources give no CVE, no disclosure timeline, no IOCs, and no Palo Alto Networks statement. A search on 2026-11-09 found no official response.

Defensive takeaways from the sources: treat the EDR as one layer; much of its value is remote telemetry rather than on-host rules; add preventative controls (application control in enforcement mode, LSA Protection, Credential Guard, ASR rules in block mode, LAPS); build SIEM detections that do not depend on EDR verdicts (raw Sysmon/Windows telemetry, LOLBin chains, SAM/SYSTEM/SECURITY hive export by any path); and run purple-team exercises that assume the EDR is silent.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.002 Security Account Manager

Execution

T1059.003 Windows Command Shell

Discovery

T1518.001 Security Software Discovery

Resource Development

T1588.007 Artificial Intelligence

Reconnaissance

T1592.002 Software

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• No CVE or vendor patch is identified in the sources; monitor Palo Alto Networks for Cortex XDR content or agent updates

Immediate actions

• Do not rely on a single EDR verdict for credential-access detection: alert on SAM, SYSTEM and SECURITY hive exports (reg save, reg export, esentutl, vssadmin/shadow copy access) regardless of destination path
• Ingest raw endpoint telemetry (Sysmon, Windows Security 4688 with command line, registry and file events) into the SIEM and write EDR-independent correlation rules
• Audit local administrator access, since SAM export needs high privilege

Workarounds

• Review custom Cortex XDR exclusions and allowlists for broad or user-writable path entries
• Supplement endpoint rules with cloud-side and network telemetry correlation

Longer-term hardening

• Layer preventative controls: WDAC/AppLocker in enforcement mode, LSA Protection, Credential Guard, ASR rules in block mode, LAPS with tiered administration
• Run purple-team exercises that assume the EDR is silent and validate path-allowlist and exclusion handling
• Deploy canary files and credentials and monitor network egress
• Strengthen identity-layer detection (token theft, service principal abuse, Kerberoasting, DCSync)
• Ask EDR vendors how they protect locally stored detection content and handle allowlists

Affected and fixed versions

• Palo Alto Networks — Cortex XDR agent (locally shipped detection content)
  Vulnerable versions: Version not stated in sources

Timeline

• 2026-05-05 TrustedSec publishes 'The Defensive Stack is Exposed', describing LLM-assisted reverse engineering of five unnamed commercial endpoint products and extraction of rules, models and allowlists.
• 2026-06-29 Post demonstrates that `reg save HKLM\SAM` is detected by Cortex XDR while a variant using an allowlisted output path found in the decrypted CLIPS rules is not; 'Upside Down' simulation framework previewed.
• 2026-06-29 SpecterOps (Adam Chester) publishes 'Accelerating EDR Evasion with LLM-Driven Analysis', using GPT-5.5-Cyber, Codex-CLI and Binary Ninja over MCP against Palo Alto Cortex XDR local files.
• 2026-07-03 @IT (Japan) reports on the research, framing it as a new challenge for defensive products rather than a specific vulnerability.
• 2026-07-23 tl;dr sec #338 features the research, noting an agent in a simple loop extracted 9,350 DSE rules, 4,209 BIOC rules, 6,358 YARA signatures and 7 ML models.
• 2026-11-09 No official Palo Alto Networks statement, CVE or advisory regarding this research was found in a web search; status kept at MONITORING.

Sources cited

• SpecterOps - Accelerating EDR Evasion with LLM-Driven Analysis (Adam Chester) specterops.io · Research · 2026-06-29
• TrustedSec - The Defensive Stack is Exposed: LLMs, Reverse Engineering, and the End of Opaque Defense (Justin Elze) trustedsec.com · Research · 2026-05-05
• Related public research (not reviewed in full): Decrypting and abusing Palo Alto Cortex XDR fr0stb1rd.is-a.dev · Blog
• tl;dr sec #338 - OpenAI and Hugging Face, Accelerating EDR Evasion, Google's Mantis tldrsec.com · News · 2026-07-23
• @IT - LLMでEDRを丸裸に (Japanese coverage of the SpecterOps research) atmarkit.itmedia.co.jp · News · 2026-07-03

More in threat intel

• Operation Snowball: Autonomous AI-Driven Intrusion Campaign Exploiting Cisco BroadWorks XSP (CVE-2026-20320) Against European Telecom
• FATF Targets Global Scam Compounds: Trafficked-Labor Fraud Operations Backed by Crypto, Instant Payments and AI-Enabled Content
• NVIDIA Board Opens Independent Investigation into Reported Foreign Intelligence Targeting of CEO Jensen Huang
• Credential-Theft and Remote Access Abuse: Infostealers, ClickFix, ScreenConnect RMM Abuse and AiTM Phishing (Elastic Security Labs, Nov 2026)
• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)