Back Gbhackers

Researchers Uncover Ways to Decrypt Palo Alto Cortex XDR BIOC Rules for Evasion

Gbhackers •Divya • March 17, 2026

Cybersecurity researchers have discovered a critical evasion technique in Palo Alto Networks’ Cortex XDR agent that allowed attackers to completely bypass behavioral detections. The research demonstrates how predefined Behavioral Indicators of Compromise (BIOC) rules, shipped encrypted by Palo Alto, could be decrypted and analyzed. By reverse-engineering these rules, analysts identified hardcoded global whitelists that provided […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Evasion Flaw in Palo Alto Cortex XDR BIOC Rules Discovered Cybersecurity researchers have identified a significant evasion technique in Palo Alto Networks’ Cortex XDR agent, enabling attackers to bypass behavioral detections entirely. The vulnerability arises from the ability to decrypt and analyze the encrypted Behavioral Indicators of Compromise (BIOC) rules. By reverse-engineering these rules, analysts from InfoGuard Labs uncovered hardcoded global whitelists that allow threat actors to execute malicious actions without triggering alerts. This flaw poses a serious risk to organizations relying on Cortex XDR for threat detection and response. The research indicates that the exploitation of this vulnerability could lead to undetected attacks on critical systems. Palo Alto Networks has been made aware of the findings, but the current status of any patches or mitigations is not specified. Organizations using Cortex XDR are advised to review their security configurations and monitor for unusual activities. The full scope of the impact remains to be assessed as the research continues. 3 sources 65

Extracted Entities

Platforms (1)

Cortex XDR