Disable or Modify Tools × Palo Alto Networks Cortex XDR

The tool requires local administrator privileges and can target specific EDR products like Cortex XDR and Windows Event Forwarding.

The tool leverages the Windows Filtering Platform (WFP) to create persistent or non-persistent firewall rules that block outbound traffic from the endpoint to known EDR cloud IP addresses and ports. It can automatically extract proxy configurations for Cortex XDR and Windows Event Collector (WEC) settings from the registry to generate blocking rules. By preventing the EDR agent from sending telemetry, alerts, and logs to the cloud, the tool effectively blinds the security monitoring without disabling or tampering with the agent itself.

Monitor for unexpected WFP filter additions or changes via Event ID 5157 (Windows Filtering Platform) and registry access to EDR proxy/WEC settings. Enforce least privilege to prevent local admin abuse and deploy EDR tamper protection to block unauthorized firewall rule creation.