GlobalProtect Gateway-Connect Events Matching CVE-2026-0257 Known IOCs or Default Placeholder Host IDs

Ankit Mehta@Secvyn

•updated Aug 11, 2026•6•2•10

This rule detects successful connection events to Palo Alto GlobalProtect gateways originating from known malicious source IP addresses associated with the exploitation of CVE-2026-0257, or connections initiated by hosts using suspicious or default placeholder device names/host IDs. It effectively identifies potential exploitation attempts or unauthorized access to corporate VPN gateways.