Palo Alto PAN-OS Potential Exploitation Activity

nomit vyas@xoxo

•updated Jun 25, 2026•1•0•12

This rule detects potential exploitation of Palo Alto PAN-OS vulnerabilities. It monitors for unusual inbound network traffic on ports 6081/6082 from non-RFC1918 (external) IP addresses and identifies specific user-agent strings associated with observed exploit attempts in the wild.