How Cortex XDR BIOC Rules Could Become an Attack Surface

A study found that Cortex XDR BIOC detection rules—intended to be stored encrypted—can be decrypted and examined, exposing the internal detection logic. This disclosure could enable attackers to reverse-engineer and evade or manipulate endpoint detection, posing a risk across sectors that rely on EDR platforms, though the research does not report widespread active exploitation.