--- title: "Threat Hunt Plan: Palo Alto Networks PAN-OS Management Interface — Authenticated Remote Code Execution" description: This hunt determines whether an authenticated attacker has reached a Palo Alto Networks PAN-OS management interface and executed code (CVE-2026-0322, CVSS v4.0 8.6), --- [Advisories | 1898 & Co.](https://1898advisories.burnsmcd.com) # [Threat Hunt Plan: Palo Alto Networks PAN-OS Management Interface — Authenticated Remote Code Execution](https://1898advisories.burnsmcd.com/threat-hunt-plan-palo-alto-networks-pan-os-management-interface-authenticated-remote-code-execution) Written by [The 1898 & Co. Team](https://1898advisories.burnsmcd.com/author/1898-co-team) | October 19, 2026 Date: 2026-10-16 | Revision 1.0 #### Hunt Objective and Scope This hunt determines whether an authenticated attacker has reached a Palo Alto Networks PAN-OS management interface and executed code (CVE-2026-0322, CVSS v4.0 8.6), and whether any post-exploitation activity has pivoted from a firewall or Panorama appliance into internal or OT network segments. In scope are all PAN-OS instances on PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances, the administrative workstations and jump boxes that reach their management interfaces, the management network segment itself, and any internal or OT hosts reachable from an appliance management or data-plane address. Cloud NGFW and Prisma Access are out of scope (not affected). Time window: the vendor confirms very limited in-the-wild exploitation but does not publish an exploitation-start date, so the window is set conservatively to begin 2026-09-14 (approximately 30 days before the 2026-10-14 disclosure) and run to the present; adjust the start earlier if local evidence indicates earlier activity. The true first-exploitation date is unknown and the pre-floor portion of the window is Non-Conclusive. Data floor pre-flight (run before any event-based leg; record the data floor as a DATE, never a duration): a time picker is not retention. Measure the oldest retained event per family and bound every event-based clause at that data floor. Throughout, 10.10.9.1 is used as an illustrative appliance management address — substitute your actual firewall/Panorama management IP at run time. `#event_simpleName=/^(NetworkConnectIP4|NetworkReceiveAcceptIP4|ProcessRollup2|UserLogon)$/ | groupBy([#event_simpleName], function=min(@timestamp, as=oldest), limit=max)`   Hypothesis kind matters: event-based clauses (a specific inbound connection, a login at a point in time) are bounded by the measured floor and are Non-Conclusive before it. State-based clauses (an administrator account that exists now, a configuration value present now, a replaced on-box binary) can be re-queried as current state regardless of the floor. Each hypothesis below states which kind it is. A critical sensor gap applies throughout: PAN-OS firewalls and Panorama appliances do not run the CrowdStrike Falcon sensor, so their own on-box process, file, and execution telemetry is NOT available via CQL — the appliance itself is hunted through its forwarded PAN-OS syslog/management logs, while CQL hunts the surrounding Falcon-sensored hosts (admin workstations, jump boxes, and the internal/OT hosts an appliance connects to). #### Hypotheses and Hunt Procedures **Hypothesis 1:** An external actor can reach an internet-facing PAN-OS management interface, observable as an exposed management web service in passive internet-scan indices. Execute FIRST; its output scopes the internal hypotheses. (State-based: current exposure is re-queryable now.) **MITRE ATT&CK:** Reconnaissance | T1595 Active Scanning — defender-side passive discovery of what an actor would enumerate. Initial Access | T1133 External Remote Services — an internet-exposed management interface is the actor's likely entry path. ICS | T0883 Internet Accessible Device — where the appliance fronts or reaches a control network. **Collection Queries** — passive external indices (STRICTLY passive; never probe target infrastructure). Author unscoped first to prove the filter matches the product, then scope with your own anchors. API keys are referenced by env-var name only (SHODAN\_API\_KEY, CENSYS\_API\_SECRET, CENSYS\_ORG\_ID, NETLAS\_API\_KEY) — never inline a key. `Shodan (unscoped, proves the filter): http.title:"GlobalProtect Portal" http.component:"PAN-OS"`   `Shodan (management UI; PAN-OS web interface): http.html:"Palo Alto Networks" http.title:"Login" port:443`   `Shodan (scope to your own space — use ONE anchor per query, never AND two): http.title:"GlobalProtect Portal" net: http.title:"GlobalProtect Portal" org:""`   `Censys CenQL (current host.services form — do NOT cross with legacy services.*): host.services.software.product: "PAN-OS" host.services: (port = "443" and software.product: "PAN-OS") host.services.software.product: "PAN-OS" and (host.autonomous_system.asn = or host.ip: "")`   `Netlas: http.title:"GlobalProtect Portal" host: AND port:(443 OR 4443)`   `// Cross-reference every exposed instance + version banner against the CISA Known Exploited // Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) and // CVE-2026-0322. A KEV match is presumptive actor-associated initial-access risk; rank by // ransomware ratio, not entry count.`   Analysis Queries (full workflow in easm-reference/easm\_methodology.md §3–§8): - Attribute each hit with at least two independent ownership signals (PTR, ASN, certificate CN/SAN, WHOIS/RDAP, your own cloud inventory) before reporting; shared hosting and CDN break attribution in both directions, so an unattributable hit is Non-Conclusive, not negative. - Version-triage each PAN-OS banner against the fixed-version table and record the index scan timestamp; a banner is stale in both directions, so an in-range banner is a prompt to verify current state and a fixed banner is not proof of safety if the scan predates the window. - Corroborate in at least two of Shodan / Censys / Netlas before escalating; absence from one index is only evidence that index did not observe the host. - Historical pivot: establish whether the exposure spans the 2026-09-14-to-present window; continuous exposure across it means the instance was presumptively enumerated. - Pivot every confirmed-owned, in-range instance into Hypotheses 2 and 3 as a priority target and hunt it exhaustively; where it fronts or reaches OT workloads, document the blast radius — internet reachability of infrastructure serving a control environment is a finding in its own right under IEC 62443 and NERC CIP, independent of confirmed exploitation. → Expected Positive shape: a Shodan/Censys hit on an IP that resolves to your organization (two independent anchors agree) presenting a PAN-OS management or GlobalProtect service whose version banner falls in the affected range, with a scan timestamp inside the hunt window. **Control** — unscoped-population twin proves the filter is not silently empty: run the product filter with NO ownership anchor first and confirm it returns the global PAN-OS population; only then apply your CIDR/ASN/org scope. A scoped zero is meaningful only if the unscoped filter is non-zero. **Verdict criteria:** Positive — at least one two-engine-corroborated, two-anchor-attributed in-range instance within the window; Negative — the unscoped filter is non-zero AND no owned in-range instance appears in any engine across the window; Non-Conclusive — only one engine or one ownership anchor available, or the public-IP/cloud inventory is incomplete; missing authoritative public-IP inventory prevents determining whether an unattributed hit is yours. **Hypothesis 2:** An authenticated attacker has reached a PAN-OS management interface from an anomalous source and executed code with root privileges, observable as management-plane logins from untrusted or vendor-reported source addresses, out-of-change-window configuration commits, and anomalous management-interface sessions in forwarded PAN-OS logs. (Event-based for the login/session evidence — bounded by the data floor; state-based for new administrator accounts and persisted configuration — re-queryable now.) **MITRE ATT&CK:** Initial Access | T1190 Exploit Public-Facing Application — the management interface is the exploited public-facing service. Execution | T1059 Command and Scripting Interpreter — code injection yields command execution as root on the device. **Collection Queries:** **CrowdStrike Falcon LogScale** (CQL) — the firewall/Panorama has no Falcon sensor, so hunt the Falcon-sensored admin workstations and jump boxes that initiate connections TO the management interface (connection initiated by the endpoint → NetworkConnectIP4, RemoteAddressIP4 = the appliance reached): `#event_simpleName=NetworkConnectIP4 event_platform=Win | RemoteAddressIP4 = "10.10.9.1" | RemotePort = 443 | join(query=` [View full post](https://1898advisories.burnsmcd.com/threat-hunt-plan-palo-alto-networks-pan-os-management-interface-authenticated-remote-code-execution) ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "The 1898 & Co. Team" }, "dateModified" : "2026-10-19T15:27:32.010Z", "datePublished" : "2026-10-19T15:27:31Z", "headline" : "Threat Hunt Plan: Palo Alto Networks PAN-OS Management Interface — Authenticated Remote Code Execution", "image" : { "@type" : "ImageObject", "height" : 60, "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png", "width" : 60 }, "mainEntityOfPage" : "https://1898advisories.burnsmcd.com/threat-hunt-plan-palo-alto-networks-pan-os-management-interface-authenticated-remote-code-execution", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "height" : 60, "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png", "width" : 60 }, "name" : "Advisories | 1898 & Co." } } ```