Researchers Decrypt and Exploit Encrypted Palo Alto Cortex XDR BIOC Rules

InfoGuard Labs reverse-engineered Palo Alto Cortex XDR agent versions 8.7/8.8, decrypted the encrypted behavioral rule set, and found a hardcoded global allowlist that excludes processes whose command line contains "\\Windows\\ccmcache" from monitoring; this single exception bypassed roughly half of the platform's behavioral detections and was demonstrated to allow undetected LSASS dumping. The flaw was responsibly disclosed in July 2025 and patched by Palo Alto in February 2026.