Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
4
3
1
Contributors
4
3
1
Categories
4
3
2
2
2
Platforms
8
2
Products / Services
8
MITRE Techniques
5
4
4
4
2
CVEs
68
68
63
58
50
Detects signs of exploitation targeting a PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257). The rule identifies an initial network request with invalid or malformed session cookies aimed at GlobalProtect endpoints, followed immediately by unauthorized access attempts to administrative portal interfaces from the same source IP address.
This rule detects successful connection events to Palo Alto GlobalProtect gateways originating from known malicious source IP addresses associated with the exploitation of CVE-2026-0257, or connections initiated by hosts using suspicious or default placeholder device names/host IDs. It effectively identifies potential exploitation attempts or unauthorized access to corporate VPN gateways.
This rule monitors for successful GlobalProtect gateway connections from users who have not successfully connected in the preceding 30 days, specifically identifying users connecting with a client fingerprint of 'Microsoft Windows 10 Pro 64-bit'. This behavior is indicative of potential initial access using compromised or new credentials, or specifically flagging suspicious activity patterns associated with specific exploit proof-of-concept client fingerprints.
This rule detects successful connection events to Palo Alto GlobalProtect gateways originating from known malicious source IP addresses associated with the exploitation of CVE-2026-0257, or connections initiated by hosts using suspicious or default placeholder device names/host IDs. It effectively identifies potential exploitation attempts or unauthorized access to corporate VPN gateways.
This rule monitors for successful GlobalProtect gateway connections from users who have not successfully connected in the preceding 30 days, specifically identifying users connecting with a client fingerprint of 'Microsoft Windows 10 Pro 64-bit'. This behavior is indicative of potential initial access using compromised or new credentials, or specifically flagging suspicious activity patterns associated with specific exploit proof-of-concept client fingerprints.
Detects both specific Indicators of Compromise (IOCs) and generic anomalous authentication activity associated with the exploitation of the PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257).
Detects generic anomalous authentication or unexpected session creation indicative of an authentication bypass vulnerability (CVE-2026-0257) in PAN-OS GlobalProtect. Needs specific endpoint/URI tuning based on actual CVE details once available.
Detects exploitation attempts of the PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257) by monitoring for specific Indicators of Compromise (IOCs) including source IPs, machine names, and MAC addresses.