* [Blog](https://www2.paloaltonetworks.com/blog) * [Security Operations](https://www2.paloaltonetworks.com/blog/security-operations/) * [Cloud Security](https://www2.paloaltonetworks.com/blog/category/cloud-security/) * Living Off the Cloud: Ana... # Living Off the Cloud: Analyzing AWS Systems Manager Attack Vectors [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fsecurity-operations%2Faws-systems-manager-attack-vectors%2F) [](https://twitter.com/share?text=Living+Off+the+Cloud%3A+Analyzing+AWS+Systems+Manager+Attack+Vectors&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fsecurity-operations%2Faws-systems-manager-attack-vectors%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2Fsecurity-operations%2Faws-systems-manager-attack-vectors%2F&title=Living+Off+the+Cloud%3A+Analyzing+AWS+Systems+Manager+Attack+Vectors&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www2.paloaltonetworks.com/blog/security-operations/aws-systems-manager-attack-vectors/&ts=markdown) \[\](mailto:?subject=Living Off the Cloud: Analyzing AWS Systems Manager Attack Vectors) Link copied By [Eden Elazar](https://www.paloaltonetworks.com/blog/author/eden-elazar/?ts=markdown "Posts by Eden Elazar") Aug 04, 2026 8 minutes [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown) [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown) [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [AWS Systems Manager](https://www.paloaltonetworks.com/blog/tag/aws-systems-manager/?ts=markdown) [Hybrid Cloud Security](https://www.paloaltonetworks.com/blog/tag/hybrid-cloud-security/?ts=markdown) [lateral movement](https://www.paloaltonetworks.com/blog/tag/lateral-movement/?ts=markdown) [SSM](https://www.paloaltonetworks.com/blog/tag/ssm/?ts=markdown) AWS Systems Manager (SSM) is a service that enables administrators to remotely manage and automate operations across EC2 instances and on-premises nodes. While SSM simplifies cloud operations, it is an attractive vector for adversaries. In this blog post, we will analyze how threat actors with access to SSM can abuse this service for "Living Off the Cloud" attacks. By leveraging native SSM features, adversaries can execute code and move laterally while evading traditional network and endpoint security controls. We examine on-premises compromise chains across two core attack vectors: 1. **Cloud to On-Premises:** control plane compromise allows attackers to use SSM to push malicious commands to local servers, bypassing strict perimeter firewalls from the inside out. 2. **On-Premises to Cloud:** compromised managed on-premises assets expose hybrid SSM credentials, allowing attackers to break out of the physical infrastructure and pivot to the connected AWS environment. # **Managing On-Premises Machines in AWS** ## [**Hybrid Activation**](https://docs.aws.amazon.com/systems-manager/latest/userguide/activations.html) AWS Systems Manager extends its capabilities to on-premises environments through Hybrid Activations, allowing physical servers and local virtual machines to be managed alongside cloud instances. To configure this, an administrator generated an activation code and activation ID from AWS for the locally installed SSM agent. Upon initialization, the SSM agent generates a unique public/private key pair directly on the host and hardware fingerprint derived from hardware identifiers, such as the machine ID, UUID, and MAC addresses. The agent then makes an outbound call to the AWS SSM endpoint, sending the activation ID, activation code, its newly generated public key, and the hardware fingerprint. Once AWS validates these credentials it registers the machine as a managed node identified by a distinct **mi-\*** prefix. ## **Authentication** Once registered, the machine maintains ongoing authentication with AWS through continuous, automated credential rotation. The SSM Agent uses its local private key to cryptographically sign a RequestManagedInstanceRoleToken API request, including its unique hardware fingerprint. Upon receipt, AWS verifies the cryptographic signature using the public key stored during onboarding and ensures the fingerprint matches the host. If everything matches, AWS returns temporary IAM security credentials associated with the IAM service role defined in the Hybrid Activation. # **SSM Attack Surface** Before examining attack techniques, it's worth understanding the SSM components that adversaries target most frequently. ![Diagram illustrating how AWS Systems Manager (SSM) features—Run Command, State Manager, and Session Manager—interact with SSM Documents to manage EC2 and on-premises instances.](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/07/word-image-363062-1.png) Figure 1. AWS SSM Services ## [**Run Command**](https://docs.aws.amazon.com/systems-manager/latest/userguide/run-command.html) [SSM documents](https://docs.aws.amazon.com/systems-manager/latest/userguide/documents.html) are JSON or YAML configuration files that define the specific actions AWS SSM executes on managed nodes. They essentially act as blueprints for tasks, such as running scripts, installing software, or applying security patches. Run Command allows execution of SSM Documents on one or more managed instances. AWS provides several built-in documents that enable code execution: * AWS-RunShellScript - executes shell commands on Linux instances * AWS-RunPowerShellScript - executes PowerShell commands on Windows instances * AWS-RunPythonScript - executes Python scripts * AWS-RunDocument - invokes other documents * AWS-RunRemoteScript - downloads and executes scripts from S3 bucket or GitHub ## [**Session Manager**](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html) Session Manager provides interactive shell access to managed instances through the SSM agent. It relies on the local SSM agent installed on a managed instance establishing an outbound WebSocket connection to the SSM service endpoint. When an authorized user initiates a session via the AWS Console (or CLI), AWS tunnels the interactive shell data through this existing outbound channel. From an attacker's perspective, this is an ideal lateral movement channel, as it eliminates the need for inbound ports, bastion hosts, and key management, by relying solely on IAM policies. ## [**State Manager**](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-state.html) State Manager applies SSM Documents to instances on a schedule or on demand through associations. For example, the AWS-GatherSoftwareInventory document is particularly interesting to attackers as it enumerates all installed software on managed instances, providing a map of the target environment's software. # **SSM Attack Vectors** In this section, we break down two scenarios abusing SSM. First, we'll walk through a cloud-to-on-premises attack that achieves code execution on a local machine, followed by an on-premises-to-cloud pivot that harvests valid AWS credentials straight from a compromised managed server. ## Control Plane to On-Premises In this scenario, a threat actor has successfully compromised an identity in AWS (via a leaked access key, a misconfigured IAM role, etc.), and leverages SSM to compromise on-premises managed servers. ![Flowchart illustrating an attack path where a compromised IAM identity is used to enumerate SSM-managed nodes, execute commands via SendCommand, and achieve full root/SYSTEM compromise of an EC2 instance.](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/07/word-image-363062-2.png) Figure 2. Cloud to On-premises Scenario #### Initial Access \& Reconnaissance Since cloud environments are more exposed to the Internet by design, attackers often find them easier to target and exploit. This may be used as a pivot to the corporate network using organization endpoints managed by SSM. The attacker authenticates to the AWS API using stolen IAM credentials. They immediately perform reconnaissance to map out EC2 instances and other managed machines in the AWS account, often by invoking API calls such as: * [**DescribeInstanceInformation**](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInstanceInformation.html)**,** [**DescribeInstanceProperties**](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInstanceProperties.html) - Lists all online managed nodes, including their OS version, IP addresses, and agent status. * [**ListAssociations**](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListAssociations.html) - Identifies automated tasks or scripts scheduled. * [**GetInventory**](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetInventory.html) - Gather host details such as OS, installed applications, network configuration ,etc. #### Command Execution Access to a managed instance typically requires network connectivity and valid SSH or RDP credentials. However, AWS Systems Manager Run Command bypasses these requirements. Because the SSM agent maintains an outbound connection to the AWS SSM endpoint over HTTPS, an attacker with permission to invoke SendCommand can execute commands on the instance without requiring inbound network access or operating system credentials. The attacker uses a document like AWS-RunShellScript or AWS-RunPowerShellScript to push commands to one or multiple instances simultaneously. aws ssm send-command \\ --instance-ids i-0123456789abcdef0 \\ --document-name "AWS-RunShellScript" \\ --parameters 'commands=\["whoami","hostname"\]' |---------|-------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 | aws ssm send-command \\ --instance-ids i-0123456789abcdef0 \\ --document-name "AWS-RunShellScript" \\ --parameters 'commands=\["whoami","hostname"\]' | An attacker can target instances based on AWS resource tags. By executing a single API call targeted, for example, at Key=Environment,Values=Production, they can simultaneously deliver a malicious payload to every managed node matching that tag. aws ssm send-command \\ --targets "Key=tag:Environment,Values=Production" \\ --document-name "AWS-RunShellScript" \\ --parameters 'commands=\["whoami"\]' |---------|-----------------------------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 4 | aws ssm send-command \\ --targets "Key=tag:Environment,Values=Production" \\ --document-name "AWS-RunShellScript" \\ --parameters 'commands=\["whoami"\]' | #### Local Host Compromise Because the SSM Agent natively runs with administrative privileges, any command executed via SendCommand runs in elevated context (root or SYSTEM). From here, the attacker may pivot through the internal network and target sensitive data either by installing malware, disrupting logging, or harvesting local credentials. ## On-Premises to Control Plane In this reverse scenario, the attacker begins with a foothold on a machine managed by SSM (either a cloud instance or a hybrid node), and uses SSM credentials to escalate into the control plane. ![Flowchart illustrating an attack path starting with a compromised SSM-managed machine, extracting cloud credentials, and pivoting to the cloud control plane.](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/07/word-image-363062-3.png) Figure 3. On-premises to Cloud Scenario #### Extracting Cloud Identity Tokens Once inside a managed node, the attacker is interested in retrieving temporary AWS credentials assigned to that node to pivot into the cloud. On-premises hybrid nodes use the SSM agent configured via a Hybrid Activation, which stores its registration and private keys locally. For example, on Linux systems, these files are located at /amazon/ssm/Vault/Store/RegistrationKey and /amazon/ssm/Vault/Store/InstanceFingerprint. The temporary token of the hybrid node is stored in /root/.aws/credentials. An attacker with local root can extract these credentials to invoke AWS API requests as the node's IAM role. #### Cloud Discovery from the Host Using the extracted AWS credentials, the attacker tests their permissions to see what parts of other AWS services they can reach. They usually access high value targets such as S3 buckets, RDS databases, or secrets from AWS Secrets Manager. # **Why Single Source Detection Falls Short** The individual techniques described above are valuable on their own, but they reach their full potential when correlated across data sources and time. Cloud audit logs alone tell you that an identity called SendCommand with AWS-RunPowerShellScript targeting three instances. They don't tell you that the resulting script downloaded a remote access tool, and established a C2 channel. Endpoint telemetry alone tells you that amazon-ssm-agent spawned powershell.exe, which spawned curl.exe to download an executable. It doesn't tell you which cloud identity initiated the command or whether that identity performed reconnaissance beforehand. Linking the cloud side SendCommand API call to the host side process execution events provides full attribution. The identity, the command, and its impact are visible in a single alert context. # **Summary** Effectively detecting SSM-based attacks requires correlating cloud telemetry with endpoint telemetry. This approach provides full visibility into the attack chain - from the initial cloud API command to the final impact on the host, ensuring that "Living Off the Cloud" techniques do not go unnoticed. Cortex Cloud® offers a comprehensive security solution with specialized detections for SSM-related attacks, enabling security analysts to effectively detect, respond to suspicious activity while ensuring seamless incident investigation and management. The complete list of these detections can be found under the **SSM Remote Management Analytics** tag. Check out Cortex Cloud® [here](https://www.paloaltonetworks.com/cortex/cloud) to learn more about our security solutions. ![Security dashboard showing an alert for an unusual process executed by AWS Systems Manager, complete with an AI incident summary and a node graph mapping Case #4828 to Lateral Movement, Execution, and Command \& Control alerts.](https://www.paloaltonetworks.com/blog/wp-content/uploads/2026/07/word-image-363062-4.jpeg) Figure 4. Cortex Cloud Security Case *** ** * ** *** ## Related Blogs ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [News and Events](https://www.paloaltonetworks.com/blog/security-operations/category/news-and-events/?ts=markdown), [Partner Integrations](https://www.paloaltonetworks.com/blog/security-operations/category/partner-integrations/?ts=markdown), [Unkategorisiert](https://www.paloaltonetworks.com/blog/category/unkategorisiert/?lang=ja&ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### Fighting AI with AI: Palo Alto Networks and Tenzai Collaborate to Defeat Autonomous Threats](https://www2.paloaltonetworks.com/blog/security-operations/fighting-ai-with-ai-palo-alto-networks-and-tenzai-collaborate-to-defeat-autonomous-threats/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Ransomware Attacks: Why Your Endpoint Protection Can't Keep Up](https://www2.paloaltonetworks.com/blog/security-operations/ransomware-attacks-why-your-endpoint-protection-cant-keep-up/) ### [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### Cortex ITDR: Cyber Threats in Microsoft Teams and Their Detection](https://www2.paloaltonetworks.com/blog/security-operations/cortex-itdr-cyber-threats-in-microsoft-teams-and-their-detection/) ### [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [News and Events](https://www.paloaltonetworks.com/blog/security-operations/category/news-and-events/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### Real-World Email Attacks Detected by Cortex Advanced Email Security](https://www2.paloaltonetworks.com/blog/security-operations/real-world-email-attacks-detected-by-cortex-advanced-email-security/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### The Case Files of Detective Aems: A Study in Digital Deduction](https://www2.paloaltonetworks.com/blog/security-operations/the-case-files-of-detective-aems-a-study-in-digital-deduction/) ### [AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [News and Events](https://www.paloaltonetworks.com/blog/security-operations/category/news-and-events/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Use-Cases](https://www.paloaltonetworks.com/blog/security-operations/category/use-cases/?ts=markdown) [#### From Silos to Synergy: How Cortex XDL Transforms XDR to Elevate Threat Detection](https://www2.paloaltonetworks.com/blog/security-operations/from-silos-to-synergy-how-cortex-xdl-transforms-xdr-to-elevate-threat-detection/) ### Subscribe to Security Operations Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www2.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language