Bypass Record
EDR Unhooking × Palo Alto Networks Cortex XDR
A publicly-reported instance of EDR Unhooking bypassing Palo Alto Networks Cortex XDR, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
A C# implementation that loads shellcode using a method that evades detection by Cortex XDR and Sophos EDR. The exact technique is not detailed in the article, but it likely involves process injection or API unhooking to bypass user-mode hooks.
Detection & mitigation
Monitor for suspicious process behavior such as unexpected process injections, memory allocation with RWX permissions, or API unhooking attempts. Ensure EDR signatures and behavioral models are updated to detect the specific loader patterns.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.