MITRE ATT&CK Technique
T1556
1 query tagged with this technique.
View on MITRE ATT&CK →
-
Analytics Rules
Detect Vpn Session Without Prior Authentication
PAN-OS GlobalProtect VPN sessions established without a matching auth event in the preceding 5 minutes — the shape of CVE-2026-0257. Uses windowed leftouter, not range-predicate leftanti.