Hackers Exploit Cortex XDR Live Terminal for C2 Communications

Cybersecurity: Cortex XDR Live Terminal Exploitation

Recent findings reveal that malicious actors can exploit the Cortex XDR Live Terminal feature as a covert command-and-control (C2) channel. This technique leverages the feature’s legitimate functionalities to conduct harmful activities under the guise of regular operations.

The Cortex XDR Live Terminal allows administrators remote shell access to endpoints for investigation and response. When a session is initiated, the agent connects to an operations socket and downloads a helper executable to facilitate various actions, such as command execution and file system browsing.

For attackers with local administrator privileges, this feature becomes a potential pre-installed C2 implant, as it is signed and trusted by the endpoint detection and response (EDR) system. Communication occurs over outbound TLS on port 443, often without deep TLS interception, enhancing stealth capabilities.

Analysis shows that Live Terminal communication uses WebSockets over HTTPS without strong certificate or CA pinning. This vulnerability allows attackers to intercept and manipulate traffic by modifying the internal CA store or by adding custom certificates for traffic inspection.

The protocol itself operates over a simple, unsigned command channel. Without cryptographic command signing or mutual authentication, attackers can redirect the agent to a rogue server to execute arbitrary commands.

One method involves a cross-tenant hijack, where an attacker uses their own Cortex tenant to initiate a legitimate session, intercepts the WebSocket message containing host and token parameters, and repurposes these for unauthorized access.

Another approach involves replicating the server-side WebSocket logic. Due to the straightforward protocol lacking signatures, attackers can create a server to accept connections from agents and issue command instructions.

Exploiting this feature generally requires local administrator privileges and may trigger default content rules designed to detect abnormal process spawning. However, attackers with sufficient privileges may bypass these defenses.

To counteract potential exploitation, it is essential to implement secure-by-design features in EDR remote-access tools, such as strict certificate pinning and signed commands. Monitoring process-creation telemetry for unusual parent-child chains and scrutinizing outbound connections to Live Terminal endpoints are recommended practices.

Based on reporting by GBHackers.