GlobalProtect VPN connection from 'kali' hostname client

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•1•0•13

Detects VPN connection events where the client hostname contains the string 'kali', which may indicate the use of a penetration testing operating system or a suspicious device connecting to the corporate network via Palo Alto Networks GlobalProtect.