Suspicious GlobalProtect Registry Run Key Modification

Kaung Khant Ko@kaungkhantko

•updated Sep 8, 2026•1•0•1

Detects the creation or modification of Windows Registry RunOnce keys using the value name 'GlobalProtectVPN', intended to execute 'GlobalProtect.exe'. This pattern is associated with malware masquerading as legitimate GlobalProtect VPN software to achieve persistence upon user logon.