Week of February 10, 2025

A vulnerability in the Cortex XDR agent on Windows allows a local non-administrative user to disable the agent. This could be exploited by malware to evade detection and perform malicious activity. Palo Alto Networks has released patches in versions 8.3.101-CE, 8.5.1, and 8.6.

Researchers developed a tool to abuse the Windows Filtering Platform (WFP) to disable EDR network containment, block EDR telemetry, and isolate devices. The technique targets WFP filters used by EDR software, demonstrating how an attacker with local admin rights can evade detection and response capabilities.

InfoGuard Labs analyzed the attack surface of EDR drivers from a low-privileged user perspective. They identified a minor authentication issue in the Windows driver of Palo Alto Cortex XDR, assigned CVE-2024-5905. The research also found a PPL bypass and detection bypass via early startup, and snapshot fuzzing of Sophos Intercept X mini-filter driver.