This informational bulletin will be updated once ETAs and these software updates are available. New versions of Cortex XDR agent will be released to prevent this misuse of our software.Ĭortex XDR agent content update CU-910 further detects and prevents this DLL side-loading technique.

Palo Alto Networks is aware of the Rorschach ransomware that is using this DLL side-loading technique. = Agents with CU-240 or a later content update on Windows This issue is not applicable to Mac OS and Linux platforms. This issue does not represent a product vulnerability risk to customers using Cortex XDR agent.

The ransomware is detected and blocked by Cortex XDR agent 7.7 and later versions with CU-240 (released November, 2021) and later content updates. The security permissions and protections of the installed Cortex XDR agent prevent it. When the Cortex XDR agent is installed on Windows and the Cortex XDR Dump Service Tool process is running from the installation path, it is not possible to side-load DLLs with this technique. Rorschach ransomware uses a copy of this tool and this technique to evade detection on systems that do not have sufficient endpoint protection. When removed from its installation directory, the Cortex XDR Dump Service Tool (cydump.exe), which is included with Cortex XDR agent on Windows, can be used to load untrusted dynamic link libraries (DLLs) with a technique known as DLL side-loading. The Palo Alto Networks Product Security Assurance team is aware of an article that details a strain of ransomware dubbed “Rorschach.”

Fast copy software for windows 10