Update Cortex XDR Windows telemetry mappings — 13 sub-categories upgraded

[malwr4n6]

Description

This PR updates the Palo Alto Cortex XDR telemetry matrix mappings for Windows across 13 sub-categories, upgrading entries previously marked Partially, Via EventLogs, or No to Yes based on direct verification via the EDR Telemetry test script (Atomic Red Team) and Cortex XDR cloud console log export.

Evidence will be shared privately with the maintainer on request.

Environment Details

• Operating System: Windows 10
• Endpoint Type: Workstation
• Vendor/Sensor: Palo Alto Networks Cortex XDR Agent
• Agent Version: 9.2.0.120
• Content Version: 2260-36267
• Operational Status: Protected
• Test Framework: EDR Telemetry Project Script (Atomic Red Team)
• Log Export: Cortex XDR Cloud Console — 9,824 rows captured during test session (Jul 9 2026)

Sub-Categories Updated (13)

Category	Sub-Category	Old Value	New Value	Evidence
Process Activity	Process Tampering Activity	Partially	Yes	action_type=Process Injection (2 rows); T1055.012 Process Hollowing
User Account Activity	Local Account Creation	Via EventLogs	Yes	Event Log — "A user account was created"; T1136.001 Test 9
User Account Activity	Local Account Modification	Via EventLogs	Yes	Event Log — "A user account was changed" (6 entries); T1098 Test 1
User Account Activity	Local Account Deletion	Via EventLogs	Yes	Event Log — "A user account was deleted"; T1098 cleanup
Driver/Module Activity	Driver Unloaded	No	Yes	Event Log — Script-Block driver unload via Invoke-Mimikatz; T1562.001 Test 10
Device Operations	Virtual Disk Mount	Partially	Yes	Event Log — Mount-DiskImage T1553.005.iso (97 Script-Block entries); T1553.005 Test 1
Other Relevant Events	Group Policy Modification	Via EventLogs	Yes	Event Log + Set Registry Value (1,145 rows); T1484.001 Test 1
Named Pipe Activity	Pipe Creation	No	Yes	Event Log — Script-Block pipe operations (1,650 Event Log rows); T1559 Test 1
Named Pipe Activity	Pipe Connection	No	Yes	Event Log — Script-Block pipe operations (1,650 Event Log rows); T1559 Test 1
WMI Activity	WmiEventConsumerToFilter	Via EnablingTelemetry	Yes	Event Log — AtomicRedTeam-WMIPersistence-CommandLineEventConsumer (165 entries); T1546.003 Test 1
WMI Activity	WmiEventConsumer	Via EnablingTelemetry	Yes	Event Log — WMI persistence Script-Block (110 WMIPersistence entries); T1546.004
WMI Activity	WmiEventFilter	Via EnablingTelemetry	Yes	Event Log — WMI persistence Script-Block; T1546.005
BITS Jobs Activity	BITS Jobs Activity	Via EnablingTelemetry	Yes	Event Log — BITS Script-Block in 1,650 Event Log rows; T1197 Test 3 ExitCode 0

Not Yet Confirmed (left unchanged)

• IMPHASH → No
• Driver Modification → No
• USB Device Unmount / USB Device Mount → Partially
• Volume Shadow Copy Deletion → No

Final State

• Yes: 52 (was 39) | Via X / No: 5 | Empty: 0