Threat Hunt Plan: Palo Alto Networks PAN-OS Management Interface — Authenticated Remote Code Execution

Date: 2026-10-16 | Revision 1.0

Hunt Objective and Scope

This hunt determines whether an authenticated attacker has reached a Palo Alto Networks PAN-OS management interface and executed code (CVE-2026-0322, CVSS v4.0 8.6), and whether any post-exploitation activity has pivoted from a firewall or Panorama appliance into internal or OT network segments. In scope are all PAN-OS instances on PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances, the administrative workstations and jump boxes that reach their management interfaces, the management network segment itself, and any internal or OT hosts reachable from an appliance management or data-plane address. Cloud NGFW and Prisma Access are out of scope (not affected).

Time window: the vendor confirms very limited in-the-wild exploitation but does not publish an exploitation-start date, so the window is set conservatively to begin 2026-09-14 (approximately 30 days before the 2026-10-14 disclosure) and run to the present; adjust the start earlier if local evidence indicates earlier activity. The true first-exploitation date is unknown and the pre-floor portion of the window is Non-Conclusive.

Data floor pre-flight (run before any event-based leg; record the data floor as a DATE, never a duration): a time picker is not retention. Measure the oldest retained event per family and bound every event-based clause at that data floor. Throughout, 10.10.9.1 is used as an illustrative appliance management address — substitute your actual firewall/Panorama management IP at run time.

Hypothesis kind matters: event-based clauses (a specific inbound connection, a login at a point in time) are bounded by the measured floor and are Non-Conclusive before it. State-based clauses (an administrator account that exists now, a configuration value present now, a replaced on-box binary) can be re-queried as current state regardless of the floor. Each hypothesis below states which kind it is. A critical sensor gap applies throughout: PAN-OS firewalls and Panorama appliances do not run the CrowdStrike Falcon sensor, so their own on-box process, file, and execution telemetry is NOT available via CQL — the appliance itself is hunted through its forwarded PAN-OS syslog/management logs, while CQL hunts the surrounding Falcon-sensored hosts (admin workstations, jump boxes, and the internal/OT hosts an appliance connects to).

Hypotheses and Hunt Procedures

Hypothesis 1: An external actor can reach an internet-facing PAN-OS management interface, observable as an exposed management web service in passive internet-scan indices. Execute FIRST; its output scopes the internal hypotheses. (State-based: current exposure is re-queryable now.)

MITRE ATT&CK: Reconnaissance | T1595 Active Scanning — defender-side passive discovery of what an actor would enumerate. Initial Access | T1133 External Remote Services — an internet-exposed management interface is the actor's likely entry path. ICS | T0883 Internet Accessible Device — where the appliance fronts or reaches a control network.

Collection Queries — passive external indices (STRICTLY passive; never probe target infrastructure). Author unscoped first to prove the filter matches the product, then scope with your own anchors. API keys are referenced by env-var name only (SHODAN_API_KEY, CENSYS_API_SECRET, CENSYS_ORG_ID, NETLAS_API_KEY) — never inline a key.

Analysis Queries (full workflow in easm-reference/easm_methodology.md §3–§8):

• Attribute each hit with at least two independent ownership signals (PTR, ASN, certificate CN/SAN, WHOIS/RDAP, your own cloud inventory) before reporting; shared hosting and CDN break attribution in both directions, so an unattributable hit is Non-Conclusive, not negative.
• Version-triage each PAN-OS banner against the fixed-version table and record the index scan timestamp; a banner is stale in both directions, so an in-range banner is a prompt to verify current state and a fixed banner is not proof of safety if the scan predates the window.
• Corroborate in at least two of Shodan / Censys / Netlas before escalating; absence from one index is only evidence that index did not observe the host.
• Historical pivot: establish whether the exposure spans the 2026-09-14-to-present window; continuous exposure across it means the instance was presumptively enumerated.
• Pivot every confirmed-owned, in-range instance into Hypotheses 2 and 3 as a priority target and hunt it exhaustively; where it fronts or reaches OT workloads, document the blast radius — internet reachability of infrastructure serving a control environment is a finding in its own right under IEC 62443 and NERC CIP, independent of confirmed exploitation.

→ Expected Positive shape: a Shodan/Censys hit on an IP that resolves to your organization (two independent anchors agree) presenting a PAN-OS management or GlobalProtect service whose version banner falls in the affected range, with a scan timestamp inside the hunt window.

Control — unscoped-population twin proves the filter is not silently empty: run the product filter with NO ownership anchor first and confirm it returns the global PAN-OS population; only then apply your CIDR/ASN/org scope. A scoped zero is meaningful only if the unscoped filter is non-zero.

Verdict criteria: Positive — at least one two-engine-corroborated, two-anchor-attributed in-range instance within the window; Negative — the unscoped filter is non-zero AND no owned in-range instance appears in any engine across the window; Non-Conclusive — only one engine or one ownership anchor available, or the public-IP/cloud inventory is incomplete; missing authoritative public-IP inventory prevents determining whether an unattributed hit is yours.

Hypothesis 2: An authenticated attacker has reached a PAN-OS management interface from an anomalous source and executed code with root privileges, observable as management-plane logins from untrusted or vendor-reported source addresses, out-of-change-window configuration commits, and anomalous management-interface sessions in forwarded PAN-OS logs. (Event-based for the login/session evidence — bounded by the data floor; state-based for new administrator accounts and persisted configuration — re-queryable now.)

MITRE ATT&CK: Initial Access | T1190 Exploit Public-Facing Application — the management interface is the exploited public-facing service. Execution | T1059 Command and Scripting Interpreter — code injection yields command execution as root on the device.

Collection Queries:

CrowdStrike Falcon LogScale (CQL) — the firewall/Panorama has no Falcon sensor, so hunt the Falcon-sensored admin workstations and jump boxes that initiate connections TO the management interface (connection initiated by the endpoint → NetworkConnectIP4, RemoteAddressIP4 = the appliance reached):

→ Expected Positive shape: a management-interface connection from a host or process that is not a sanctioned admin workstation/jump box — e.g. RemotePort 443 to the appliance launched by an unexpected FileName (a scripting interpreter, a non-browser binary) or from a workstation outside the admin population.

Datadog — PAN-OS management-plane authentication and configuration logs forwarded via the Palo Alto integration or syslog (the appliance's own activity; it has no Falcon telemetry). Live Process Monitoring is not applicable to the appliance.

Windows Event collection on admin workstations / jump boxes (identify which endpoints reach the management interface, then review their logon and process activity):

OT/ICS data collection (only where the appliance fronts or reaches a control network — read the platform card for the verified export path before running):

• OT Data Collection: Claroty CTD — export connections where the source is the appliance management/data IP into OT zones over the hunt window; note CTD (on-prem) and xDome (SaaS) have sharply different PCAP retention — do not collapse to generic "Claroty".
• OT Data Collection: Dragos Platform — pull detections and the asset's communication summary for the appliance address; review for new east-west flows into the control zone.
• OT Data Collection: Nozomi Guardian — export the appliance node's links and session records to the OT segment for the window.

BPF packet capture on the management segment (VLAN-aware two-branch form is required; pair the host-scoped capture with an unscoped control):

Analysis Queries:

CrowdStrike Falcon LogScale (CQL) — rank admin-workstation sources reaching the management interface to surface rare/unexpected initiators:

→ Expected Positive shape: a ComputerName with a very low connection count to the management interface that is not a known administrative host — a single or first-seen initiator during the window.

Datadog Log Analytics — management-plane authentication over time and by source:

Datadog Audit Trail — note the data source: Datadog Audit Trail records Datadog platform activity, NOT PAN-OS console logins, so it is used only to detect tampering with the monitoring pipeline itself during the window:

Datadog Monitor (one per hypothesis):

Windows Event Log analysis on admin workstations:

Wireshark / tshark analysis of the management-segment capture (anchor on the TLS record content type + version byte, not the port; read the negotiated version off the ServerHello, not tls.record.version):

→ Expected Positive shape: a ClientHello to the management IP whose SNI or source address does not correspond to a sanctioned admin host, clustered around an anomalous login time.

Control — field-presence and family-presence on the same window and scope: a zero from the management-login legs is meaningful only if the source data is present. Prove the CQL family is populated (#event_simpleName=NetworkConnectIP4 event_platform=Win | head(1)), prove the filtered field exists (#event_simpleName=NetworkConnectIP4 | RemoteAddressIP4 = /./ | count()), and in Datadog confirm source:pan.panos @evt.name:auth returns the baseline admin-login population before trusting any filtered zero. If the PAN-OS integration/syslog is not forwarding, this leg is Non-Conclusive, not Negative.

Verdict criteria: Positive — a management-interface authentication or session from a vendor-reported source address or an unsanctioned initiator, and/or a configuration commit outside the change window correlated to it; Negative — the hit set is empty AND the controls (CQL family + field, Datadog auth baseline) are non-zero across the window; Non-Conclusive — PAN-OS logs not forwarded, or the event-based evidence falls before the data floor; missing PAN-OS management-log forwarding prevents determining whether the interface was accessed.

Hypothesis 3: Following management-plane compromise, an attacker has used the firewall or Panorama appliance as a pivot and credential source into internal or OT segments, observable on Falcon-sensored internal hosts as inbound connections and authentications originating FROM the appliance address. (Event-based for the connection/auth evidence — bounded by the floor; state-based for any new accounts or credential-dump tooling present now.)

MITRE ATT&CK: Lateral Movement | T1021 Remote Services — the appliance initiates connections into internal/OT hosts. Credential Access | T1003 OS Credential Dumping — harvested device or directory credentials reused from the appliance foothold.

Collection Queries:

CrowdStrike Falcon LogScale (CQL) — a connection FROM the appliance TO an internal host is received by that host, so the correct event is NetworkReceiveAcceptIP4 with RemoteAddressIP4 = the appliance address and LocalPort = the service reached (direction matters — this is not NetworkConnectIP4):

→ Expected Positive shape: an internal host accepting an SSH/SMB/RDP/WinRM connection from the appliance management address, or a UserLogon on an internal host whose RemoteAddressIP4 equals the appliance address — neither of which a firewall legitimately originates.

YARA memory scan on internal hosts the appliance touched (credential-access tooling in LSASS; the appliance itself cannot be scanned this way):

OT/ICS data collection (where the appliance reaches a control network):

• OT Data Collection: Claroty CTD — export any session where the source is the appliance address into OT zones; treat a management/firewall address initiating control-protocol sessions as a finding.
• OT Data Collection: Dragos Platform — review detections for east-west traffic from the appliance address and correlate with any protocol-anomaly detections.

Analysis Queries:

CrowdStrike Falcon LogScale (CQL) — timeline the appliance-sourced inbound connections to spot a burst consistent with hands-on lateral movement:

→ Expected Positive shape: a cluster of appliance-sourced inbound sessions across multiple internal hosts and service ports within a short window — a fan-out pattern uncharacteristic of a firewall.

Datadog Log Analytics — internal authentications attributed to the appliance source address:

Datadog Monitor:

OT network and protocol analysis (where applicable): baseline the appliance address against its normal east-west profile; a firewall or Panorama address initiating EtherNet/IP, Modbus, or S7 sessions into a control zone is a high-severity deviation. Correlate with historian/SCADA alarm timelines over the same window.

Control — unscoped behavioural twin and family/field presence: prove NetworkReceiveAcceptIP4 is populated and that RemoteAddressIP4 carries values (#event_simpleName=NetworkReceiveAcceptIP4 | RemoteAddressIP4 = /./ | count()) on the same window before trusting a zero; run the appliance-sourced query unscoped (any RemoteAddressIP4) to confirm the inbound-connection population exists. A zero whose control is 0 or unrun is Non-Conclusive.

Verdict criteria: Positive — at least one internal or OT host with an inbound connection or authentication sourced from the appliance address to a lateral-movement service port, or a YARA credential-dump hit on a touched host; Negative — the hit set is empty AND the controls are non-zero across the window; Non-Conclusive — the appliance address is not known, internal-host Falcon coverage is incomplete, or evidence falls before the data floor; missing appliance-address attribution prevents determining the pivot source.

Threat Actor Profile

Opportunistic and access-broker actors: An authenticated-RCE flaw in a widely deployed perimeter appliance with confirmed in-the-wild exploitation is attractive to financially motivated access brokers and ransomware affiliates, who routinely weaponize edge-device vulnerabilities to obtain durable network footholds that they monetize or resell. The privilege requirement (valid administrator credentials) is typically satisfied through prior credential theft, phishing, credential reuse, or a chained earlier flaw; sophistication ranges from moderate (credential-stuffing against an exposed management interface) to high where the RCE is combined with an authentication-bypass primitive.

Nation-state and state-aligned actors: Palo Alto Networks management interfaces and Panorama consoles sit at a network chokepoint and have repeatedly drawn interest from state-aligned clusters that value the position for traffic inspection, credential harvesting, and segmentation bypass — activity consistent with the broader pattern of edge-appliance targeting documented by multiple vendors and government agencies. Treat vendor cluster names as overlaps rather than government attributions; this advisory itself carries no named-actor attribution, so this profile is a risk model, not an identification. The appliance-as-credential-source pattern is the primary post-exploitation concern: authentications originating FROM the appliance address into internal or OT segments (Hypothesis 3) are the highest-confidence pivot signal.

Access path and TTPs common to both: reach the management interface over the network (frequently from the internet where the interface is exposed — Hypothesis 1), authenticate with valid or stolen administrator credentials, exploit CVE-2026-0322 to gain root-level code execution, then disable or alter security policy, harvest device and directory credentials, and pivot deeper. Because the vendor publishes no full workaround, removal of management-interface exposure and prompt patching are the load-bearing defenses.

Data Sources Required

Network: full-packet capture on the management segment (PCAP), firewall and NetFlow records for connections to/from management interfaces, and DNS resolution logs for any appliance-sourced lookups.

Endpoint: CrowdStrike Falcon telemetry on administrative workstations, jump boxes, and internal servers (NetworkConnectIP4, NetworkReceiveAcceptIP4, ProcessRollup2, UserLogon); Windows Security event logs (4624, 4648) from the same hosts. Note the appliance exclusion: PAN-OS firewalls and Panorama do not carry the Falcon sensor.

Appliance/device logs: PAN-OS management-plane system, configuration, and authentication logs forwarded via the Palo Alto Networks Datadog integration (source:pan.panos) or syslog — without this forwarding, Hypotheses 2 and 3 cannot be evaluated for the appliance itself and report Non-Conclusive.

OT/ICS (where an appliance fronts or reaches a control network): Claroty CTD/xDome, Dragos, or Nozomi Guardian exports of connections and sessions sourced from the appliance address; historian and SCADA alarm logs for correlation.

External attack surface (Hypothesis 1): the passive internet-scan indices queried read-only (Shodan, Censys, Netlas), the CISA Known Exploited Vulnerabilities catalog, and the organization's authoritative public-IP and cloud asset inventories — the last of which is required for ownership attribution; without it, the exposure determination cannot be completed.

Detection Signatures

SIGMA Rule 1 — management-interface access from CVE-2026-0322-associated source addresses (firewall logsource):

SIGMA Rule 2 — administrator login to the management interface from a non-RFC1918 source (authentication logsource):

SIGMA Rule 3 — credential-dumping tooling on an internal host reached from the appliance (process_creation logsource):

Snort/Suricata Rule 1 — inbound TLS ClientHello to a PAN-OS management interface from an external source (annotate: fires only where the sensor sees the management segment unencrypted at the network layer; the TLS record anchor identifies the handshake regardless of port):

Snort/Suricata Rule 2 — outbound connection from the PAN-OS management address to an external host (post-exploitation egress; a firewall management plane should not initiate arbitrary outbound sessions):

YARA Rule 1 (file/disk) — PAN-OS post-exploitation drop artifacts. This rule targets staged scripts or ELF payloads written to the appliance management plane and recovered from a forensic image or exported file set (the appliance cannot be scanned live via EDR). The condition ORs a set of post-exploit shell/loader strings and requires the file to be small, since staged droppers and webshells are typically compact; the size ceiling is the false-positive mitigation that keeps it off large legitimate binaries.

YARA Rule 2 (process memory) — the standing lateral-movement/credential-access rule required whenever a hypothesis involves T1003/T1021 (Hypothesis 3). It covers the four canonical Windows LSASS-tooling branches plus a memory-read-API catch-all; the branch structure lets any single tool signature trigger while the catch-all needs an LSASS reference plus one tool string so a lone API name does not fire. Note the SeDebugPrivilege requirement for live scanning and the CrowdStrike Falcon RTR option for remote execution. This rule targets Windows LSASS tooling and will not match Linux /proc credential dumping; scope it to Windows hosts.

Indicators of Compromise

Network IoCs: management-interface authentications or connections involving the vendor-reported source addresses 66.42.72.14, 208.83.239.114, and 149.248.47.234; any administrator login to a PAN-OS management interface from a non-RFC1918 source; outbound sessions initiated by a firewall or Panorama management address to an external host.

Host/appliance IoCs: PAN-OS configuration commits outside the approved change window; new or modified administrator accounts; Threat Prevention IDs 510046 and 510047 firing (content version 9159-10287 or later, with SSL Decryption enabled); unexpected on-box processes or files recoverable from a forensic image of the management plane.

OT/operational IoCs (behavioral): a firewall or Panorama management address initiating control-protocol sessions (EtherNet/IP, Modbus, S7, DNP3) into an OT zone; appliance-sourced authentications into internal or OT hosts on lateral-movement service ports (22/445/3389/5985/5986); a cluster of appliance-sourced inbound connections fanning out across multiple internal hosts in a short window.

False Positive Baseline

1. Sanctioned administrators reaching the management interface from approved jump boxes or an internal management VLAN — enumerate the jump-box/admin-workstation set and suppress those sources, alerting only on initiators outside it.

2. Corporate egress addresses: administrators connecting through a NAT/VPN egress that presents as a non-RFC1918 address can trip the external-source rule — allowlist the organization's known egress addresses.

3. Scheduled configuration automation (Panorama pushes, Terraform/Ansible against the API) producing configuration commits that resemble out-of-window changes — baseline the automation accounts and their change windows.

4. IT-sanctioned crash-dump collection using comsvcs.dll MiniDump against non-LSASS processes, or vendor support tooling that reads process memory — scope the credential-dump detections to LSASS targets and known-good operators.

5. Legitimate management traffic from monitoring systems (SNMP pollers, NMS, backup collectors) that connect to the appliance on schedule — baseline these sources so their connections are not read as anomalous initiators.

6. EASM misattribution: a PAN-OS instance on shared hosting, a CDN, or a carrier range that is not actually yours — require two independent ownership anchors before treating an exposed instance as in-scope.

Escalation Criteria

1. Any management-interface authentication or connection from a vendor-reported source address (66.42.72.14, 208.83.239.114, 149.248.47.234) — engage incident response immediately.

2. Any PAN-OS configuration commit outside the approved change window, or any new/modified administrator account, with no corresponding authorized change record.

3. Any inbound connection or authentication on an internal or OT host whose source address is a firewall or Panorama management/data-plane address.

4. Any appliance-sourced control-protocol session (EtherNet/IP, Modbus, S7, DNP3) into an OT zone.

5. Any YARA hit on rule PANOS_MGMT_PostExploit_Dropper against a management-plane forensic image or exported file set — treat the appliance as compromised and preserve evidence before remediation.

6. Any YARA hit on rule Credential_Dump_Tool_Memory_Artifacts against LSASS on an internal host that was reached from the appliance address — escalate to credential-compromise handling and begin domain-wide credential rotation.

7. Two-engine-corroborated, in-range, owned PAN-OS management exposure spanning the hunt window (Hypothesis 1) — prioritize exposure removal and exhaustive internal hunting of that instance.

Hunt Completion Criteria and Reporting

The hunt is complete when every hypothesis has a recorded verdict derived from its Verdict criteria, each supported by the queries that were actually run to a Done status (a LogScale aggregate renders progressively, so a partial result can look final — capture the status bar in every screenshot), and when every control query has been run and its result recorded.

The report must: give a verdict per hypothesis (Positive / Negative / Non-Conclusive — never "Inconclusive"); make any absence claim only from a single-predicate filter (filter for the indicator and count), never by reading a distribution table; record every limitation with its direction (for example, "an IDS on the management segment sees the TLS handshake but not the decrypted session unless keys are provided"; "the EASM sweep sees only what the indices observed and only across the IP inventory supplied"); report every leg whose control was zero or not run as Non-Conclusive and name the missing input (PAN-OS log forwarding, internal-host Falcon coverage, appliance-address attribution, the data floor); and note where a verdict is bounded by the data floor versus re-queryable as current state. Verdicts are per hypothesis — a residual finding in a secondary leg does not downgrade a primary verdict, and a leg that merely tests our own collection (log forwarding, sensor coverage) reports a coverage gap, never a Positive. Recommend running the Hypothesis 1 external-exposure sweep as a recurring control, since exposure removal is one of only two defenses the vendor offers.

Advisory IoC Reference