GlobalProtect Process Spawning Command Shell

Kaung Khant Ko@kaungkhantko

•updated Sep 8, 2026•1•0•2

Detects instances where the GlobalProtect VPN client executable spawns a Windows command shell (cmd.exe). This behavior is highly suspicious as a legitimate VPN client typically does not launch interactive shells, and this pattern has been associated with the execution of malicious payloads such as fake MSI installers.