Does the Cortex XDR Agent work in Windows Safe Mode?

RFeyertag — Wed, 10 Aug 2022 16:00:36 GMT

Hello dear Community,

https://attack.mitre.org/techniques/T1562/009/

Rob

Re: Does the Cortex XDR Agent work in Windows Safe Mode?

mfakhouri — Thu, 11 Aug 2022 13:05:07 GMT

Hi Rob,

The Cortex XDR Agent is currently not designed to function with Windows Safe Mode.

The following tests were performed on a Windows 10 endpoint that was booted into Windows Safe Mode with the Cortex XDR agent installed.

Figure 1: The tray application was not open upon the Safe Mode boot. After navigating to and running the tray executable file in C:\Project Files\ Palo Alto Networks\Traps, the menu displays that Advanced Endpoint Protection is disabled and that connection to the service is not available.

Figure 2: Cyserver.exe is the main process executable responsible for starting the Cortex XDR Service as of agent release 7.1 (see references for more information). After attempting to start the “cyserver” service from the command line with net start, there is a system error reading that “This service cannot be started in Safe Mode”.

Figure 3: Cytool is a command line interface tool that offers management with the components of Cortex XDR when operating in the directory C:\Project Files\ Palo Alto Networks\Traps. “cytool enum” enumerates protected processes (as seen in the cytool documentation listed below), but in this case the system cannot find the file specified to execute the command.

Since this test was done on a Windows 10 endpoint in particular, I would be interested to hear what Windows version you had in mind for the Windows Safe Mode Boot functionality.

Reference:

Cyserver.exe process details

https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-1/cortex-xdr-agent-release-notes/cortex-xdr-agent-release-information/changes-to-default-behavior#id1787F023048

Cytool functionality on Windows endpoints

https://docs.paloaltonetworks.com/cortex/cortex-xdr/5-0/cortex-xdr-agent-admin/traps-agent-for-windows/troubleshoot-traps-for-windows/cytool

Re: Does the Cortex XDR Agent work in Windows Safe Mode?

RFeyertag — Thu, 11 Aug 2022 14:24:46 GMT

Exactly this answers my question, thank you very much!

@PA: will there be a version which works in safe mode with networking?

Re: Does the Cortex XDR Agent work in Windows Safe Mode?

afurze — Thu, 11 Aug 2022 17:13:04 GMT

Hi RFeyertag,

Please reach out to your SE/account team for discussions on product feedback and roadmap.

topic Re: Does the Cortex XDR Agent work in Windows Safe Mode? in Cortex XDR Discussions

Does the Cortex XDR Agent work in Windows Safe Mode?

Re: Does the Cortex XDR Agent work in Windows Safe Mode?

Re: Does the Cortex XDR Agent work in Windows Safe Mode?

Re: Does the Cortex XDR Agent work in Windows Safe Mode?