Unable to bypass Cortex XDR about mortar

[lawrenceamer]

Cortex respond to this with a fix, currently, i am working on a new bypass to push into my early access repo

[Cy-Beard]

I see the repo has been updated in May. Was a fix also added?
I also attempted this in a live environment for purple teaming engagements and was unsuccessful. But I am unsure if its the rule itself or cortex itself that flagged it.

Metasploit was able to create the session but once cortex flagged it, it killed it as well.

[lawrenceamer]

@Cy-Beard, I am sure there is a way to bypass cortex using a shell injector, just need to figure out how, unfortunately not willing to post that in public, good luck