How to prevent ADFSjacking with Cortex XDR. Is it possible?

kenlacrosse — Wed, 20 Aug 2025 18:27:30 GMT

Just reviewed an article on ADFSjacking in Office365. Is this something that can be prevented or blocked using Cortex XDR and/or the Advanced Threat Detection or Advanced URL Filtering add-ons for PAN NGFW?

Re: How to prevent ADFSjacking with Cortex XDR. Is it possible?

eluis — Thu, 21 Aug 2025 15:02:46 GMT

Hi @kenlacrosse

Cortex XDR cannot outright “block” ADFS jacking, since it’s not a malware signature but an abuse of identity federation.

However, XDR can help detect the techniques around it (like credential dumping, DLL injection, or suspicious PowerShell use) and increase visibility into ADFS activity with the right BIOCs and log integrations.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

topic How to prevent ADFSjacking with Cortex XDR. Is it possible? in Cortex XDR Discussions

How to prevent ADFSjacking with Cortex XDR. Is it possible?

Re: How to prevent ADFSjacking with Cortex XDR. Is it possible?