# LLM-Assisted Reverse Engineering of Palo Alto Cortex XDR Enables Targeted EDR Evasion (SpecterOps research, tl;dr sec #338)

> SpecterOps' Adam Chester used OpenAI GPT-5.4-Cyber/GPT-5.5-Cyber with Codex-CLI and Binary Ninja over MCP to extract Cortex XDR's locally shipped detection logic (YARA, DSE/BIOC, CLIPS rules and 7 ML models) and to identify allowlist gaps, such as a `reg save HKLM\SAM` export that is detected versus an allowlisted-path variant that was not. This is public research, not a CVE and not confirmed in-the-wild exploitation.

- **Published:** 2026-11-09T03:21:59Z
- **Last reviewed:** 2026-11-09T03:21:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5519
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5519.png
- **ID:** TL-2026-5519
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 12

## Description

On 2026-06-29 SpecterOps published 'Accelerating EDR Evasion with LLM-Driven Analysis' by Adam Chester. It shows that a looping LLM agent can reverse engineer a commercial EDR agent largely unattended. The harness, called 'Day Shift', runs a single Codex-CLI agent in a Docker container inside a while loop. Each iteration restarts with fresh context and re-reads markdown state files (REPORT.md, STATE.md, CODEMAP.md, AGENTS.md) left by earlier runs. Binary Ninja is exposed to the agent through a custom MCP server. The models were OpenAI GPT-5.4-Cyber and later GPT-5.5-Cyber. The post presents this as a way to counter LLMs stopping early.

The case study is Palo Alto Networks Cortex XDR. According to the post and the tl;dr sec summary, everything was extracted from local files with no cloud access. The agent identified cyinjct.dll as the shared user-mode hook writer, which installs early inline hooks on functions such as LdrInitializeThunk and NtContinue. It found that YARA rulesets are stored in an encrypted wrapper that can be decrypted offline (about 6,358 rule inventory entries), and it wrote decryption tooling. The author validated the output by triggering a rule with a test string tied to a Mythic agent. The agent also found about 9,350 DSE behavioral rules, about 4,209 of them BIOC, with local overlays that disable some rules. Rule logic is exposed in plaintext Lua and JSON. Encrypted .clp blobs were decrypted into CLIPS (LISP-family) source, and 7 local ML models were extracted. The post describes these as tree-ensemble scorers with per-model thresholds, and the agent built working execution harnesses for them. Decryption keys and IVs are redacted and a full teardown was withheld.

The worked evasion example is credential dumping. Cortex detects `reg save HKLM\SAM`, but the decrypted CLIPS rule revealed an allowlisted destination path, and a variant writing to that path (C:\rcoc\sam.hive in the hunt data) was not detected. The author also previewed 'Upside Down', an early-stage simulation framework with Windows and EDR-emulation sub-agents that lets an LLM test extracted rules and iterate on evasions before touching a real environment. The tl;dr sec digest says the same process has already produced extracted rules and models for every major EDR vendor. This is a vendor-reported claim not independently verified here.

This follows TrustedSec's 2026-05-05 post 'The Defensive Stack is Exposed', which describes the same approach against five unnamed commercial endpoint products. It reports that work taking skilled reverse engineers weeks now takes days. The sources give no CVE, no disclosure timeline, no IOCs, and no Palo Alto Networks statement. A search on 2026-11-09 found no official response.

Defensive takeaways from the sources: treat the EDR as one layer; much of its value is remote telemetry rather than on-host rules; add preventative controls (application control in enforcement mode, LSA Protection, Credential Guard, ASR rules in block mode, LAPS); build SIEM detections that do not depend on EDR verdicts (raw Sysmon/Windows telemetry, LOLBin chains, SAM/SYSTEM/SECURITY hive export by any path); and run purple-team exercises that assume the EDR is silent.

## MITRE ATT&CK

- T1592.002 Software
- T1588.007 Artificial Intelligence
- T1059.003 Windows Command Shell
- T1685 Disable or Modify Tools
- T1003.002 Security Account Manager
- T1518.001 Security Software Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5519 SAM/SECURITY/SYSTEM Hive Export via reg.exe to Any Path (EDR-Independent)** (`TL-2026-5519-SPL-001`)

Detects reg.exe 'save' or 'export' of the HKLM SAM, SECURITY or SYSTEM hives regardless of destination path. The SpecterOps/Cortex XDR research (TL-2026-5519) showed that 'reg save HKLM\SAM' is detected by the EDR while a variant writing to an allowlisted path (C:\rcoc\sam.hive) was not. This rule runs on raw Sysmon EID 1 and Windows Security 4688 command lines so it does not depend on any EDR verdict or path allowlist. Flags the known IOC path/filename (rcoc, sam.hive) as an extra field.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1003.002, T1003.004, T1059.003
- **Data sources:** sysmon, windows_security, defender_xdr_devices
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1) OR (index=wineventlog sourcetype="XmlWinEventLog:Security" EventCode=4688) earliest=-24h
| eval proc_cmd=coalesce(CommandLine, Process_Command_Line), actor=coalesce(User, SubjectUserName, Account_Name), parent=coalesce(ParentImage, ParentProcessName, Creator_Process_Name)
```TL-2026-5519: match reg save/export of SAM, SECURITY or whole SYSTEM hive; the dot wildcards stand in for backslash and quote characters so any destination path is covered```
| where match(proc_cmd, "(?i)(^|[^a-z0-9])reg(.exe)?.? +(save|export) +.?(hklm|hkey_local_machine).((sam|security)([^a-z0-9]|$)|system(.? |$))")
| rex field=proc_cmd "(?i)(sam|security|system).? +.?(?<dest_path>[^ ]+)"
| eval hive=case(match(proc_cmd, "(?i)(hklm|hkey_local_machine).sam"), "SAM", match(proc_cmd, "(?i)(hklm|hkey_local_machine).security"), "SECURITY", true(), "SYSTEM"), known_ioc=if(match(proc_cmd, "(?i)rcoc|sam[.]hive"), "yes", "no")
| stats count min(_time) as first_seen max(_time) as last_seen values(hive) as hives values(dest_path) as dest_paths values(known_ioc) as known_ioc values(proc_cmd) as commands by host, actor, parent
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine matches regex @'(?i)(^|[^a-z0-9])reg(.exe)?.? +(save|export) +.?(hklm|hkey_local_machine).((sam|security)([^a-z0-9]|$)|system(.? |$))'
| extend DestPath = extract(@'(?i)(sam|security|system).? +.?([^ ]+)', 2, ProcessCommandLine), KnownIocPath = ProcessCommandLine has_any ('rcoc', 'sam.hive')
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, DestPath, KnownIocPath
| order by Timestamp desc
```

### Sigma

```yaml
title: Registry Hive Export via reg.exe (SAM/SECURITY/SYSTEM) to Any Path
id: 6f1c2a3e-8b47-4d19-9a52-3c7e1d5b9f01
status: experimental
description: Detects reg.exe save/export of the SAM, SECURITY or SYSTEM hives regardless of output path, covering the allowlisted-path variant (C:\rcoc\sam.hive) reported in the SpecterOps Cortex XDR research (TL-2026-5519).
references:
  - https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis
  - https://attack.mitre.org/techniques/T1003/002/
author: Threadlinqs Team
date: 2026/11/09
tags:
  - attack.credential_access
  - attack.t1003.002
  - attack.t1003.004
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'
  selection_action:
    CommandLine|contains:
      - ' save '
      - ' export '
  selection_hive:
    CommandLine|contains:
      - 'hklm\sam'
      - 'hklm\security'
      - 'hklm\system '
      - 'hklm\system"'
      - 'hkey_local_machine\sam'
      - 'hkey_local_machine\security'
      - 'hkey_local_machine\system '
      - 'hkey_local_machine\system"'
  condition: all of selection_*
falsepositives:
  - Backup or imaging tooling that saves registry hives
  - Administrators performing authorised offline password audits
level: high
```

**Known false positives:**

- Backup, imaging or forensic tooling that exports SYSTEM/SAM hives for legitimate purposes
- Authorised red-team or purple-team credential-access exercises

**Tuning notes:** Allowlist only specific backup service accounts and parent processes, never destination paths (path allowlisting is the gap this research exploited). Enable Windows Security 4688 command-line auditing if Sysmon is not deployed. Use the known_ioc field (rcoc, sam.hive) to prioritise triage.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Alternate SAM/SYSTEM/NTDS Extraction via esentutl, Shadow Copy Reads and ntdsutil IFM (locked: unlock with TL Creds)
- Cortex XDR Local Detection Content Copied or Accessed by Non-Vendor Process (locked: unlock with TL Creds)
- Day Shift LLM Agent Harness State Files ([indicator], STATE.md, [indicator], AGENTS.md) (locked: unlock with TL Creds)
- Registry Hive File Written by reg.exe or at Known IOC Path ([indicator]) (locked: unlock with TL Creds)
- Cortex XDR Service Stop or Agent Protection Disable via sc, net or cytool (locked: unlock with TL Creds)
- DNS Resolution of Community-Observed Sibling Domains (cdn-staticfiles.com, wiredrum.llc) (locked: unlock with TL Creds)
- Security Software and Cortex XDR Discovery Command Cluster (locked: unlock with TL Creds)
- Network Connections to Community-Observed Sibling Infrastructure (2.27.63.244, cdn-staticfiles.com, wiredrum.llc) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [SpecterOps - Accelerating EDR Evasion with LLM-Driven Analysis (Adam Chester)](https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis)
- [tl;dr sec #338 - OpenAI and Hugging Face, Accelerating EDR Evasion, Google's Mantis](https://tldrsec.com/p/tldr-sec-338)
- [TrustedSec - The Defensive Stack is Exposed: LLMs, Reverse Engineering, and the End of Opaque Defense (Justin Elze)](https://trustedsec.com/blog/the-defensive-stack-is-exposed)
- [@IT - LLMでEDRを丸裸に (Japanese coverage of the SpecterOps research)](https://atmarkit.itmedia.co.jp/ait/articles/2607/03/news040.html)
- [Related public research (not reviewed in full): Decrypting and abusing Palo Alto Cortex XDR](https://fr0stb1rd.is-a.dev/posts/decrypting-and-abusing-paloalto-cortex-xdr/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5519