Back Cybersecuritynews

Researchers Discover Ways to Decrypt and Exploit Encrypted Palo Alto Cortex XDR BIOC Rules

Cybersecuritynews •Abinaya • March 17, 2026

A critical evasion flaw in Palo Alto Networks’ Cortex XDR agent that allowed attackers to bypass behavioral detections completely. By reverse-engineering these encrypted rules, the InfoGuard Labs team discovered hardcoded global whitelists that enabled threat actors to execute malicious actions without triggering security alerts. Palo Alto Cortex XDR relies heavily on Behavioral Indicators of Compromise […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Evasion Flaw in Palo Alto Cortex XDR BIOC Rules Discovered Cybersecurity researchers have identified a significant evasion technique in Palo Alto Networks’ Cortex XDR agent, enabling attackers to bypass behavioral detections entirely. The vulnerability arises from the ability to decrypt and analyze the encrypted Behavioral Indicators of Compromise (BIOC) rules. By reverse-engineering these rules, analysts from InfoGuard Labs uncovered hardcoded global whitelists that allow threat actors to execute malicious actions without triggering alerts. This flaw poses a serious risk to organizations relying on Cortex XDR for threat detection and response. The research indicates that the exploitation of this vulnerability could lead to undetected attacks on critical systems. Palo Alto Networks has been made aware of the findings, but the current status of any patches or mitigations is not specified. Organizations using Cortex XDR are advised to review their security configurations and monitor for unusual activities. The full scope of the impact remains to be assessed as the research continues. 3 sources 65

Researchers Discover Ways to Decrypt and Exploit Encrypted Palo Alto Cortex XDR BIOC Rules

The full story

Extracted Entities

Attack Types (1)

Platforms (1)