Index / Disable or Modify Tools / Palo Alto Networks
Bypass Record

Disable or Modify Tools × Palo Alto Networks Cortex XDR Agent

A publicly-reported instance of Disable or Modify Tools bypassing Palo Alto Networks Cortex XDR Agent, recorded with its original source. Factual record; no assessment of any specific deployment.

Product
Palo Alto Networks Cortex XDR Agent
Technique
Disable or Modify Tools
MITRE ATT&CK
T1562.001
Confidence
High
Severity
Medium
Status
unknown
Disclosed
2025-02-12
Config / version noted
Not stated

Provenance

Reported as

allows a local non-administrative user to disable the agent

Mechanism

Improper check for unusual or exceptional conditions (CWE-754) in the agent's detection mechanism allows a low-privileged local user to disable the Cortex XDR agent, defeating endpoint detection.

Detection & mitigation

Monitor for unexpected termination or disabling of the Cortex XDR agent service (e.g., via Windows Event ID 7034/7036 for service stops, or process termination of cyserver.exe). Mitigation: Apply vendor patches (8.3.101-CE, 8.5.1, 8.6) and enforce least privilege to prevent non-admin users from interacting with security services.

Disable or Modify Tools has also been recorded against

Avast SoftwareCarbon BlackCheck PointCrowdStrikeEasyAntiCheatForcepointKasperskyMalwarebytesMicrosoftmultiple commercial EDR/AV vendorsPalo AltoRiot Games

This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.