Cortex XDR Protection Disabled via Local Command

Lucas Pinho@lucaslapinho

•updated Aug 17, 2026•3•0•10

Detects the execution of the Cortex XDR agent administration tool (Cytool) with the 'protect disable' command line argument. This indicates an attempt to manually disable the security agent's protective features on an endpoint, which is a common technique used by adversaries to impair security controls.