Palo Alto Networks Cortex CTF 2026
Writeups for Palo Alto Networks' Cortex CTF, a scenario-based investigation CTF played inside Cortex XSIAM and Cortex Cloud, covering a Microsoft 365 phishing-to-account-takeover case, an AWS attack path built from bad posture, and a code-to-cloud application breach.
Palo Alto Networks' Cortex CTF is not a jeopardy board of isolated puzzles. Each scenario drops you into a live Cortex tenant with a story, and every question is answered by investigating it: pivoting through cases, issues, asset pages, playbook runs and XQL.
I played it solo and solved every question in all three scenarios. Atlas Lion (Cortex XSIAM) follows a spear-phish against a Microsoft 365 user through impossible-travel logins, a rogue guest invite and Power Automate abuse. Attack Paths (Cortex Cloud) traces an internet-facing EC2 instance on IMDSv1 with an over-permissive IAM policy from exposure to remediation. The App Frontier (Cortex Cloud) maps a Finance-App across GitHub, GitHub Actions, ECR, EKS and EC2, from its riskiest asset back to a leaked key in Terraform.
Each writeup lists every flag, where it lives in the console, and the dead ends worth avoiding.
Challenges
Cortex Cloud
2 challenges · 75 pts- 35 ptsThe App FrontierA 7-question code-to-cloud scenario in the Palo Alto Networks Cortex CTF: map Finance-App from GitHub through GitHub Actions, ECR and EKS, find its riskiest asset and the CI instance behind it, triage the CVE shared by both core images, and trace an IMDSv1 fix from a playbook run to a Cortex-generated pull request.4 minMedium
- 40 ptsAttack PathsAn 8-question Cortex Cloud scenario in the Palo Alto Networks Cortex CTF: follow a public AWS EC2 instance from the rule that flagged it, through its VPC, the Terraform file that left IMDSv1 on, an over-permissive inline IAM policy, exploitable CVEs and a failed GDPR control, to the War Room command that enforced IMDSv2.4 minEasy