Browser exploits protection
Browsers can be subject to exploitation attempts from malicious web pages and exploit kits that are embedded in compromised websites. By enabling this capability, the Cortex XDR agent automatically protects browsers from common exploitation attempts.
|  |  | — | — | — | |Logical exploits protection
Attackers can use existing mechanisms in the operating system—such as DLL-loading processes or built in system processes—to execute malicious code. By enabling this capability, the Cortex XDR agent automatically protects endpoints from attacks that try to leverage common operating system mechanisms for malicious purposes.
|  |  | — | — | — | |Known vulnerable processes protection
Common applications in the operating system, such as PDF readers, Office applications, and even processes that are a part of the operating system itself can contain bugs and vulnerabilities that an attacker can exploit. By enabling this capability, the Cortex XDR agent protects these processes from attacks which try to exploit known process vulnerabilities.
|  |  |  | — | — | |Exploit protection for additional processes
To extend protection to third-party processes that are not protected by the default policy from exploitation attempts, you can add additional processes to this capability.
|  |  |  | — | — | |Operating system exploit protection
Attackers commonly leverage the operating system itself to accomplish a malicious action. By enabling this capability, the Cortex XDR agent protects operating system mechanisms such as privilege escalation and prevents them from being used for malicious purposes.
|  |  |  | — | — | |Unpatched vulnerabilities protection
If you have Windows endpoints in your network that are unpatched and exposed to a known vulnerability, Palo Alto Networks strongly recommends that you upgrade to the latest Windows Update that has a fix for that vulnerability. If you choose not to patch the endpoint, the Unpatched Vulnerabilities Protection capability allows the Cortex XDR agent to apply a workaround to protect the endpoints from the known vulnerability.
|  | — | — | — | — | | Malware security profiles | | | | | | |Behavioral threat protection
Prevents sophisticated attacks that leverage built-in OS executables and common administration utilities by continuously monitoring endpoint activity for malicious causality chains.
|  |  |  | — | — | |Credential gathering protection
Targets attempts to access and harvest passwords and credentials.
|  |  |  | — | — | |Anti webshell protection
Prevents web shell attacks by continuously monitoring endpoints for processes that try to drop malicious files.
|  |  |  | — | — | |Financial malware threat protection
Targets attempts to access or steal financial or banking information.
|  |  |  | — | — | |Cryptominers protection
Prevents cryptomining by monitoring for processes which attempt to locate or steal cryptocurrencies.
|  |  |  | — | — | |In-process shellcode protection
Targets attempts to run in-process shellcodes that load malicious code.
|  | — | — | — | — | |Ransomware protection
Targets encryption based activity associated with ransomware to analyze and halt ransomware before any data loss occurs.
|  |  | — | — | — | |Prevent malicious child process execution
Prevents script-based attacks used to deliver malware by blocking known targeted processes from launching child processes commonly used to bypass traditional security approaches.
|  |  |  | — | — | |Portable executables and DLLs examination
Analyzes and prevents malicious executable and DLL files from running.
|  |  |  | — | — | |ELF files examination
Analyzes and prevents malicious ELF files from being executed or written to disk.
| — | — |  | — | — | |Local file threat examination
Analyzes and quarantines malicious PHP files arriving from the web server.
| — | — |  | — | — | |Office files examination
Analyzes and prevents malicious macros embedded in Microsoft Office files from running.
|  | — | — | — | — | |JScript files examination
Analyzes and prevent malicious JScript files from being executed or written to disk.
|  | — | — | — | — | |Mach-O files examination
Analyzes and prevents malicious mach-o files from loading and running.
| — |  |  | — | — | |DMG files examination
Analyzes and prevents malicious DMG files from running.
| — |  | — | — | — | |APK files examination
Analyzes and prevents malicious APK files from running.
| — | — | — |  | — | |Reverse shell protection
Detects suspicious or abnormal network activity from shell processes and terminate the malicious shell process.
| — | — |  | — | — | |Network packet inspection engine
Analyzes network packet data to detect malicious behavior.
|  | — | — | — | — | |Dynamic kernel protection
Protect the endpoint from kernel-level threats such as bootkits, rootkits, and susceptible drivers.
|  | — | — | — | — | |SMS and MMS malicious URL filtering
Filter, report, or block (iOS only) malicious URLs received in SMS/MMS messages.
| — | — | — |  | — | | **Spam reports** | — | — | — | — |  | | **Call and messages blocking** | — | — | — | — |  | | **Container-escaping attempts** | — | — |  | — | — | |Network URL filtering
URL filtering for supervised devices
| — | — | — | — |  | |Cryptocurrency wallets protection
Protection for cryptocurrency wallets stored on endpoints.
|  |  | — | — | — | |LDAP query protection
Analyze and act upon suspicious LDAP queries sent by the agent to a Domain Controller, to detect and block Active Directory reconnaissance attacks.
|  | — | — | — | — | |Malicious device protection
Protect your systems from unauthorized hardware attacks and malicious USB devices. The Malicious Device Prevention module identifies and blocks Human Interface Device (HID) tools, such as the "USB Rubber Ducky" that exploit device trust to inject unauthorized keystrokes and similar actions. This feature reduces the physical attack surface, and prevents hardware-based social engineering threats from compromising data.
| — |  | — | — | — | | Restrictions security profiles | | | | | | |Execution paths
Many attack scenarios are based on writing malicious executable files to certain folders such as the local temp or download folder and then running them. Use this capability to restrict the locations from which executable files can run.
|  | — | — | — | — | |Network locations
To prevent attack scenarios that are based on writing malicious files to remote folders, you can restrict access to all network locations except for those that you explicitly trust.
|  | — | — | — | — | |Removable media
To prevent malicious code from gaining access to endpoints using external media such as a removable drive, you can restrict the executable files, that users can launch from external drives attached to the endpoints in your network.
|  | — | — | — | — | |Optical drive
To prevent malicious code from gaining access to endpoints using optical disc drives (CD, DVD, and Blu-ray), you can restrict the executable files, that users can launch from optical disc drives connected to the endpoints in your network.
|  | — | — | — | — | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/endpoint-security/endpoint-protection/endpoint-protection-capabilities.md?ask=