BIOC
Informational
✕
Suspicious usage of cytool.exe
The Cortex XDR agent can be controlled by a command-line tool named cytool.exe. Attackers may use it to disable the Cortex XDR agent.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
Indicator:
Process action type = execution AND target process name = cytool.exe , cytool Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != *palo alto networks* AND cgo signer != *palo alto networks* AND initiator cmd != *zzzzInvokeManagedCustomActionOutOfProc* AND cgo cmd != *zzzzInvokeManagedCustomActionOutOfProc* Host host os = windows
Preventable: yes