> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/cortex-xdr-agent-detection-techniques.md).

# Cortex XDR agent detection techniques

Learn how the Cortex XDR agent in Cortex XDR detects and prevents malware, exploits, ransomware, fileless attacks, and credential theft.

The Cortex XDR agent is a native endpoint protection platform (EPP) and EDR agent. It doesn't rely on a single technique. It combines several layers of signature, machine-learning, behavioral, and technique-based protection so it can stop known and unknown threats before and during execution. A separate antivirus product is not required.

### Detection and prevention layers

| Layer                           | Technique                                                                         | What it stops                                                                            |
| ------------------------------- | --------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| Threat intelligence             | Hash verdicts from WildFire and your allow and block lists                        | Known-malicious and known-good files                                                     |
| Local analysis                  | Static analysis with machine learning and pattern-matching rules, on the endpoint | Unknown malware before it runs, including when the endpoint is offline                   |
| WildFire                        | Cloud sandbox analysis of unknown files                                           | Zero-day malware. Verdict changes are pushed back to endpoints.                          |
| Behavioral threat protection    | Monitors causality chains of processes, files, registry, and network activity     | Living-off-the-land and fileless attacks, script and macro abuse, and multi-step attacks |
| Exploit protection              | Blocks exploitation *techniques* in protected processes, not specific CVEs        | Memory-corruption and logic-flaw exploits, including against unpatched software          |
| Anti-ransomware                 | Monitors and halts encryption-like behavior                                       | Ransomware before data loss                                                              |
| Credential-gathering protection | Blocks attempts to access credential stores                                       | Credential theft tools                                                                   |
| Child process protection        | Blocks targeted processes from launching commonly abused child processes          | For example, an Office macro launching a script interpreter                              |

Which modules are available depends on the operating system and the security profiles you assign. For the full list per platform, see [Endpoint protection capabilities](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/endpoint-protection-capabilities) and Endpoint protection modules.

### Fileless and memory-based attacks

Fileless and in-memory attacks are handled by several layers working together:

* **Behavioral threat protection** detects malicious sequences of activity, regardless of whether a file is written to disk.
* **Malware protection for scripts and macros** examines PowerShell, JScript, VBScript, and Office macros on Windows.
* **Exploit protection** includes in-process shellcode protection on Windows and memory protection modules on Linux.

### Ransomware

The Cortex XDR agent blocks ransomware in layers. Local analysis and WildFire stop known and unknown ransomware binaries before they run. Behavioral threat protection and the anti-ransomware module stop encryption activity that starts at runtime. In Cortex XDR, you can then contain the endpoint with [endpoint isolation](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/response-actions/isolate-an-endpoint).

### On-demand and periodic scans

The Cortex XDR agent prevents threats at execution time, so a scheduled full-disk scan is not required for protection. To find dormant malware, enable a **Periodic Scan** (weekly or monthly) in the malware security profile, or [scan an endpoint on demand](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-endpoints/scan-an-endpoint-for-malware).

See also [File analysis and protection flow](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-protection/file-analysis-and-protection-flow).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/insights-and-tips-cortex-xdr/endpoint-and-cortex-xdr-agent-management/cortex-xdr-agent-detection-techniques.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.