--- title: Accelerating EDR Evasion with LLM-Driven Analysis description: A SpecterOps red team researcher describes using LLM agents (GPT-5.4-Cyber and later GPT-5.5-Cyber run inside Codex-CLI with Binary Ninja over MCP) in an... canonical: https://daily.dev/posts/accelerating-edr-evasion-with-llm-driven-analysis-5vxrsowul twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Accelerating EDR Evasion with LLM-Driven Analysis | daily.dev og:description: A SpecterOps red team researcher describes using LLM agents (GPT-5.4-Cyber and later GPT-5.5-Cyber run inside Codex-CLI with Binary Ninja over MCP) in an... og:url: https://daily.dev/posts/accelerating-edr-evasion-with-llm-driven-analysis-5vxrsowul og:image: https://api.daily.dev/og/posts/5vXrsOwuL.png og:image:alt: Accelerating EDR Evasion with LLM-Driven Analysis og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Accelerating EDR Evasion with LLM-Driven Analysis **[SpecterOps](https://daily.dev/sources/specterops)** · 17 min read · 0 upvotes · 0 comments ## Summary A SpecterOps red team researcher describes using LLM agents (GPT-5.4-Cyber and later GPT-5.5-Cyber run inside Codex-CLI with Binary Ninja over MCP) in an automated loop harness called 'Day Shift' to reverse engineer and evade endpoint detection and response (EDR) products, focusing on Palo Alto Cortex XDR. The harness autonomously extracted and decrypted YARA rules, behavioral DSE/BIOC detection rules, seven local ML classifier models, and CLIPS-based CLP rule blobs, then validated the extracted rules by triggering and bypassing real detections (e.g., SAM hive export evasion). The piece also previews a Ghostworks project simulating a mock Windows/EDR environment to test evasions before touching real targets, and argues that LLM-driven EDR reversing is now practical and will force endpoint security vendors to rethink their reliance on on-host detection. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can LLMs be used to automatically reverse engineer and bypass EDR products like Palo Alto Cortex XDR? Yes, an automated loop harness running GPT-5.5-Cyber inside Codex-CLI with Binary Ninja exposed over MCP was used to extract and decrypt Cortex XDR's YARA rules, 9,350 DSE behavioral rules including 4,209 BIOC rules, seven local ML classifier models, and encrypted CLIPS-based CLP rule blobs, then validated the extracted rules by triggering and evading real detections such as a SAM hive export alert. _Security researchers tracking AI-driven offense and defense shifts follow this kind of research on daily.dev._ ### How do EDR products like Cortex XDR protect their local YARA rules and detection signatures from being read? Cortex XDR stores YARA signature files locally wrapped with an 'ENCY' header, encrypted using AES-128-ECB with an embedded key, then gzip-inflated; a plaintext rule inventory file (yara_data.json) also lists 6,358 rule entries with id, action, and ti_action fields, all recoverable offline without contacting the Cortex backend. _Developers hardening endpoint agents against local extraction can dig into these encryption tradeoffs on daily.dev._ ### What kind of machine learning models does Cortex XDR use for local malware detection? Cortex XDR uses tree-ensemble scorers rather than neural networks for local file analysis, walking serialized decision trees and applying a sigmoid function to the summed leaf values. Separate models handle different file types via tlaplugin.dll (PE/documents) and tlapluginv2.dll (scripts), for example a PE model using parser family 1 with 22,977 features and a 0.88 threshold. _Teams evaluating ML-based malware detection internals can keep up with findings like this on daily.dev._ ## Similar posts on daily.dev - [On the Coming Industrialisation of Exploit Generation with LLMs](https://daily.dev/posts/on-the-coming-industrialisation-of-exploit-generation-with-llms-wkt9zuzy1) · Hacker News · 2 upvotes · 0 comments - [LLM-Generated Mythic Agents Enable Disposable Red-Team Tooling](https://daily.dev/posts/llm-generated-mythic-agents-enable-disposable-red-team-tooling-bx5ghnvyo) · Security Boulevard · 0 upvotes · 0 comments - [The EDR blind spot: 3 ways browser attacks evade endpoint telemetry](https://daily.dev/posts/the-edr-blind-spot-3-ways-browser-attacks-evade-endpoint-telemetry-v11w3g13y) · BleepingComputer · 0 upvotes · 0 comments - [Leveraging Generative AI to Reverse Engineer XLoader](https://daily.dev/posts/leveraging-generative-ai-to-reverse-engineer-xloader-migzufok2) · Check Point Research · 0 upvotes · 0 comments - [How AI Coding Tools Crushed the Endpoint Security Fortress](https://daily.dev/posts/how-ai-coding-tools-crushed-the-endpoint-security-fortress-oivfawpcr) · Dark Reading · 1 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#reverse-engineering](https://daily.dev/tags/reverse-engineering), [#red-teaming](https://daily.dev/tags/red-teaming) [View this post on daily.dev](https://daily.dev/posts/accelerating-edr-evasion-with-llm-driven-analysis-5vxrsowul) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Accelerating EDR Evasion with LLM-Driven Analysis","url":"https://daily.dev/posts/accelerating-edr-evasion-with-llm-driven-analysis-5vxrsowul","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/accelerating-edr-evasion-with-llm-driven-analysis-5vxrsowul"},"datePublished":"2026-08-23T12:16:29.046Z","dateModified":"2026-08-23T12:17:29.988Z","description":"A SpecterOps red team researcher describes using LLM agents (GPT-5.4-Cyber and later GPT-5.5-Cyber run inside Codex-CLI with Binary Ninja over MCP) in an...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0ee5ad69ca90f2a2a86c5f5bb4b5ecac?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0ee5ad69ca90f2a2a86c5f5bb4b5ecac?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SpecterOps","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SpecterOps","logo":"https://media.daily.dev/image/upload/s--lR36Z4gn--/f_auto,q_auto/v1787487384/logos/specterops?_a=BAMAMicg0","url":"https://daily.dev/sources/specterops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/accelerating-edr-evasion-with-llm-driven-analysis-5vxrsowul","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,reverse-engineering,red-teaming","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SpecterOps","item":"https://daily.dev/sources/specterops"},{"@type":"ListItem","position":3,"name":"Accelerating EDR Evasion with LLM-Driven Analysis"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/accelerating-edr-evasion-with-llm-driven-analysis-5vxrsowul#faq","mainEntity":[{"@type":"Question","name":"Can LLMs be used to automatically reverse engineer and bypass EDR products like Palo Alto Cortex XDR?","acceptedAnswer":{"@type":"Answer","text":"Yes, an automated loop harness running GPT-5.5-Cyber inside Codex-CLI with Binary Ninja exposed over MCP was used to extract and decrypt Cortex XDR's YARA rules, 9,350 DSE behavioral rules including 4,209 BIOC rules, seven local ML classifier models, and encrypted CLIPS-based CLP rule blobs, then validated the extracted rules by triggering and evading real detections such as a SAM hive export alert. Security researchers tracking AI-driven offense and defense shifts follow this kind of research on daily.dev."}},{"@type":"Question","name":"How do EDR products like Cortex XDR protect their local YARA rules and detection signatures from being read?","acceptedAnswer":{"@type":"Answer","text":"Cortex XDR stores YARA signature files locally wrapped with an 'ENCY' header, encrypted using AES-128-ECB with an embedded key, then gzip-inflated; a plaintext rule inventory file (yara_data.json) also lists 6,358 rule entries with id, action, and ti_action fields, all recoverable offline without contacting the Cortex backend. Developers hardening endpoint agents against local extraction can dig into these encryption tradeoffs on daily.dev."}},{"@type":"Question","name":"What kind of machine learning models does Cortex XDR use for local malware detection?","acceptedAnswer":{"@type":"Answer","text":"Cortex XDR uses tree-ensemble scorers rather than neural networks for local file analysis, walking serialized decision trees and applying a sigmoid function to the summed leaf values. Separate models handle different file types via tlaplugin.dll (PE/documents) and tlapluginv2.dll (scripts), for example a PE model using parser family 1 with 22,977 features and a 0.88 threshold. Teams evaluating ML-based malware detection internals can keep up with findings like this on daily.dev."}}]} ```