Masquerading × Palo Alto Networks Cortex XDR

Cortex XDR Live Terminal feature can be abused as a command-and-control channel

The Live Terminal feature uses WebSocket connections without command signing. Attackers can intercept the initial WebSocket message and redirect the endpoint to an attacker-controlled server. A logic flaw in the server address validation (checking the full URL string instead of just the hostname) allows a crafted URL like 'attacker.com/test.paloaltonetworks.com' to pass the check. The trusted cortex-xdr-payload.exe then executes commands, enabling stealthy C2.

Monitor process creation events for cortex-xdr-payload.exe with a parent process other than cyserver.exe. Implement network detection rules to identify anomalous WebSocket connections to non-Palo Alto domains, and enforce TLS inspection on Cortex XDR traffic.