Ransomware TTP Series: PAN-OS GlobalProtect Auth Bypass Exploitation (Qilin, CVE-2026-0257)
Detects signs of exploitation targeting a PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257). The rule identifies an initial network request with invalid or malformed session cookies aimed at GlobalProtect endpoints, followed immediately by unauthorized access attempts to administrative portal interfaces from the same source IP address.
YARA-L
