How to Hunt VPN Logs for Sessions That Never Entered a Password

An authentication bypassAuthentication Bypass📖A security vulnerability that allows an attacker to circumvent the login verification process and gain unauthorized access to a system without providing valid credentials. on a VPN gateway leaves almost nothing behind. There are no failed logins, no lockouts, no helpdesk tickets about unexpected MFA prompts. The attacker's first event on your appliance is a successful authentication, and from then on they are a remote user like any other. The GlobalProtect bypass CVE-2026-0257, now exploited by both Qilin and Settra ransomware operations, is the current example, but the hunting method below applies to any remote-access platform where a session can be minted without a password.

This guide assumes you have GlobalProtect or equivalent logs for the period in question. If you do not, the first finding of your hunt is a logging gap, and the rest of this article is your argument for closing it.

Step 1: Establish the vulnerable window

Start from the vendor's advisory date, not from the day you patched. For CVE-2026-0257 that is 13 May 2026, with the earliest confirmed exploitation on 17 May according to Rapid7. The window closes when two things are both true: the fixed build is running, and every pre-existing session has been terminated. If you upgraded but never forced re-authentication, your window is still open.

Write the window down with timestamps and time zones before you start querying. Hunts that drift in scope produce findings nobody can act on.

Step 2: Pull every successful authentication, not just the suspicious ones

Export all successful portal and gateway authentication events for the window. On GlobalProtect that means the gateway-auth and login event types with a successful status. Keep the full record: username, source IP, client hostname, client OS, authentication method, assigned internal IP, and session start and end times.

Resist the temptation to filter to "unusual" sources at this stage. The point of exporting everything is to build the baseline you will compare against. For most organisations this is a few thousand to a few hundred thousand rows, which any SIEM or even a spreadsheet can handle.

Step 3: Split on authentication method

This is the pivot that makes a bypass hunt tractable. The GlobalProtect log records how a session was authenticated. Rapid7's analysis of exploited appliances found the forged sessions recorded with an authentication method of "Cookie", which is the authentication override path. Legitimate reconnects also use that method, so the field alone is not an indicator, but it halves your search space and tells you where the forgeries have to be hiding.

If your platform does not record the method, look for the absence of an upstream event instead. A session that should have required a SAML assertionSAML Assertion📖An XML document issued by an identity provider containing statements about a user's identity, attributes, and authentication status, used to grant access to service providers in SSO systems., a RADIUSRADIUS🌐Remote Authentication Dial-In User Service, the protocol network devices use to ask a central server whether a user or device should be granted access and with what attributes. Each device shares a secret with the server, so a compromised server exposes the secrets of every device that trusts it. exchange or an MFA push, and has no corresponding record in the identity provider or RADIUS server for that user at that time, was not authenticated the way your policy says it should be.

Step 4: Score each session against five signals

Go through the cookie-authenticated sessions and flag anything matching the following. One hit is a lead; two or more in the same session is a priority.

Source network. Legitimate remote users connect from residential ISPs, mobile carriers and known partner ranges. Attackers connect from hosting providers and VPS platforms. Rapid7 observed exploitation waves originating from Vultr and from Dromatics Systems; ReliaQuest's October indicators include four addresses in the 216.245.184.0/24 range. Enrich every source IP with ASN and organisation and flag anything that resolves to a hosting or cloud provider your users do not normally use.

Client hostname. Attack tooling announces itself. Arctic Wolf and ReliaQuest both observed forged sessions from hosts named kali. Rapid7 observed GP-CLIENT and DESKTOP-GP01. Beyond the specific strings, flag any hostname that does not match your corporate naming convention, any Windows default of the DESKTOP-plus-random-characters form, and any Linux client in an environment that issues only Windows and macOS laptops.

Client identifiers. Rapid7 found a spoofed MAC addressMAC Address🌐A unique hardware identifier assigned to every network interface. of aa:bb:cc:dd:ee:ff consistent across two exploitation waves. If your logs capture a client MAC or device identifier, look for obviously synthetic values and for the same identifier appearing from many different source IPs.

Sequential internal addressing. Arctic Wolf noted multiple internal VPN addresses assigned in sequence to the same external source. A real user reconnects occasionally; an attacker testing access or running several tools through the tunnel reconnects rapidly and collects a string of leases.

Account and timing. A cookie-authenticated login for a local administrator account, a service accountService Account🛡️A non-human operating system or application account under which a service runs. Its permissions define the blast radius of any exploit against that service, since attacker code executes with the service account's access to files, secrets, and the network., a departed employee or an account that has never used the VPN before is suspicious regardless of source. So is a first-ever login for an account at an hour that does not match its history.

Step 5: Follow every hit inward

A forged VPN session is initial access. The question that matters is what the attacker did with it, and the VPN log cannot tell you. For each flagged session, take the assigned internal IP and session times and pivot into the rest of your telemetry.

FirewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. and NetFlow: what internal hosts did the VPN address talk to, on which ports? SMB and RDP to many hosts from one VPN client is lateral movementLateral Movement🛡️Techniques attackers use to move through a network after initial compromise, seeking additional systems to control and data to steal., not remote work.

Windows security logs: look for network logons (type 3) and interactive logons from the VPN address range, and for the account named in the session authenticating to systems it has no business on. Arctic Wolf's Qilin cases moved with PsExec and RDP, which leaves service installation events and logon records.

Domain controllers: Arctic Wolf observed NTDS extraction with ntdsutil and LSASS memory dumps. Check for those processes, for unexpected volume shadow copies, and for Event ID 1102, the audit-log-cleared event that the same intrusions generated when the actor wiped logs before encrypting. How to Spot DCSyncDCSync🛡️A credential-theft technique in which an attacker impersonates a domain controller and asks a real one to replicate account data, including password hashes, over the normal Active Directory replication protocol. and Mailbox Harvesting After a Web Server Is Breached covers the Active Directory side in detail.

Backup servers: the June intrusions targeted Veeam infrastructure before encryptionEncryption🛡️The process of converting data into a coded format that can only be read with the correct decryption key.. Any VPN-sourced logon to a backup console or repository during the window deserves a full review.

Remote access tools and tunnels: AnyDesk, Ngrok, LogMeIn and MeshAgent were all deployed for persistence in the Qilin cases, and MeshAgent appears in Settra's toolset too. Search endpoint telemetry for installations of these during or after any flagged session.

Step 6: Decide, document, evict

For every flagged session, reach one of three conclusions and record it: confirmed legitimate (you reached the user and the device checks out), confirmed malicious (internal pivots show attacker activity), or unresolved. Unresolved is a valid outcome, but it should trigger a credential reset for the account and a closer look at the device.

Then, regardless of findings, terminate every active GlobalProtect session and force re-authentication, if you have not already. ReliaQuest's central recommendation for CVE-2026-0257 is that patching alone may not remove access established before remediation. Why Patching Your VPN Gateway Does Not Evict the Attacker Already Inside explains why this step should be unconditional.

Making the next hunt faster

Three changes turn this from a crisis exercise into a standing control. Ship VPN authentication logs to a central store with retention that outlasts your longest plausible dwell time; six months is a reasonable floor given that this CVE's window ran from May to October. Enrich source IPs with ASN at ingest so the hosting-provider test is a saved search rather than a manual join. And alert in real time on cookie-method or override-method authentications for privileged and service accounts, which should be rare enough to review individually. Understanding why the cookie carries so much weight, as set out in How a VPN Authentication Override CookieAuthentication Override Cookie🛡️An encrypted cookie a VPN portal or gateway issues after a successful login so the client can reconnect without re-entering credentials. It acts as a bearer token, so its confidentiality and integrity protection decide whether it can be stolen or forged. Works and Why a Forged One Is a Full Login, is the best argument for watching it closely.