Bypass Record
Disable or Modify Tools × Palo Alto Networks Cortex XDR Agent
A publicly-reported instance of Disable or Modify Tools bypassing Palo Alto Networks Cortex XDR Agent, recorded with its original source. Factual record; no assessment of any specific deployment.
Reported as
A null pointer dereference in the Cortex XDR agent can be triggered by a local low-privileged user, causing the agent to crash. This disables the endpoint detection capability, allowing malware to operate undetected.
Mechanism
A null pointer dereference in the Cortex XDR agent can be triggered by a local low-privileged user, causing the agent to crash. This disables the endpoint detection capability, allowing malware to operate undetected.
Detection & mitigation
Monitor for unexpected termination of Cortex XDR agent processes (e.g., cyserver.exe) using Windows Event ID 4689 or Sysmon Event ID 5. Mitigate by applying vendor patches (8.6.1, 8.5.2, or later hotfixes) and enforcing agent tamper protection policies.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.