Modern exploits often bypass Data Execution Prevention (DEP) by using ROP (Return-Oriented Programming) chains. This involves stringing together small pieces of legitimate code (gadgets) already present in memory.

The Defense: Cortex XDR includes specialized EPMs to break these chains. Stack Pivot Protection detects when an attacker tries to redirect the stack pointer to a controlled memory area.

JMP2RET: This specific module monitors for common ROP 'gadgets' like 'Jump to Return' instructions that are used to seize control of the execution flow.

Zero-Day Protection: Because these modules focus on the technique of the exploit rather than a specific file signature, they are highly effective at stopping 'Zero-Day' exploits before a patch is even available.