Hunting on edge appliances: finding compromise on VPNs, firewalls and gateways

VPN gateways, firewalls, load balancers, remote support appliances and email gateways sit on the internet, hold credentials for the internal network and run closed operating systems without endpoint detection. That combination makes them the preferred entry point for both espionage and ransomware actors, and it makes them hard to investigate.

The numbers reflect it. In 2026 so far, at least 40 of the 295 additions to CISA's KEV catalog (about one in seven) concern internet-facing edge products such as VPN gateways, firewalls, load balancers, email gateways and remote access appliances, led by Cisco, Ivanti, Citrix and SonicWall. Since BOD 26-04 took effect on 10 June 2026, 20 of the roughly 30 edge-related additions carry a forensic triage requirement: CISA expects agencies to check for compromise, not only to patch. Verizon's 2025 DBIR found edge devices and VPNs involved in 22 percent of breaches that started with vulnerability exploitation, up from 3 percent a year earlier, with only about 54 percent of the relevant vulnerabilities fully remediated over the year.

Why the appliance itself is a poor witness

• No EDR. You cannot install an agent, and the vendor shell exposes only what the vendor chose to expose.
• Logs can be manipulated. In the Ivanti Connect Secure chain the actor tampered with appliance logs, and the vendor's integrity checker did not detect the activity.
• Evidence is volatile. Implants that live in memory or in the page cache disappear on reboot, and a reboot is often the first thing an upgrade does.
• Vendor IOC tools are useful but not conclusive. A clean result means "no known indicator found", not "not compromised".
• Crashes look like outages. Exploitation attempts against the Cisco ASA and NetScaler flaws in our dossiers show up as reloads and reboot loops, which operations teams tend to ticket as availability problems.

Hunt from the outside in

The most reliable evidence about an edge appliance is the telemetry it cannot touch: what other systems saw it do. Build hunts on these sources first, and treat on-box logs as a supplement.

Six hunts that work across vendors

The queries below are starting points. Index names, sourcetypes and field names differ between environments and must be mapped before use. Replace the example IP addresses and account names with your own appliance inventory.

1. Outbound connections initiated by the appliance

A VPN gateway or firewall management plane needs very few outbound destinations: vendor updates and licensing, NTP, DNS, syslog, the directory. Anything else, especially to the internet or to internal hosts it never talks to, deserves a look. This is the single most valuable edge hunt, because tunnelers and C2 implants have to talk to someone.

index=firewall action=allowed
    [| inputlookup edge_appliances.csv | rename ip AS src_ip | fields src_ip]
| lookup edge_egress_allowlist.csv dest_ip OUTPUT purpose
| where isnull(purpose)
| stats count min(_time) AS first_seen max(_time) AS last_seen values(dest_port) AS ports sum(bytes_out) AS bytes_out by src_ip dest_ip
| convert ctime(first_seen) ctime(last_seen)
| sort - bytes_out

2. Gaps in the log stream

Attackers who gain root on an appliance often stop or filter logging. A gap in an otherwise steady syslog stream is therefore a finding on its own, as is a reboot that coincides with it. Run this over at least the period since the vulnerability became exploitable.

| tstats count where index=edge by host _time span=5m
| sort 0 host _time
| streamstats current=f last(_time) AS prev_time by host
| eval gap_minutes=round((_time - prev_time) / 60)
| where gap_minutes > 15
| convert ctime(prev_time) ctime(_time)
| table host prev_time _time gap_minutes

3. Reboots and crashes outside maintenance windows

Memory corruption exploits fail often before they succeed. Unplanned reloads, crashed authentication daemons and boot messages are worth correlating with exploitation windows and with maintenance records. The search terms below cover Cisco ASA/FTD start-up messages and the NetScaler symptoms from our dossier; add your vendors' equivalents.

index=edge ("%ASA-6-199005" OR "%FTD-6-199005" OR "Startup begin" OR "nsaaad" OR "pitboss" OR "core dump" OR "System started")
| lookup maintenance_windows.csv host OUTPUT window_start window_end
| where isnull(window_start) OR _time < strptime(window_start, "%Y-%m-%dT%H:%M:%S") OR _time > strptime(window_end, "%Y-%m-%dT%H:%M:%S")
| stats count min(_time) AS first_seen max(_time) AS last_seen values(_raw) AS samples by host
| convert ctime(first_seen) ctime(last_seen)

4. Appliance service accounts behaving like attackers

VPN gateways and remote access appliances bind to the directory with a service account and sometimes store privileged credentials. After compromise, that account and the appliance's internal IP become the attacker's tools: LDAP queries for LAPS or BitLocker secrets, Kerberoasting and password spraying from the appliance were all documented in the Ivanti chain.

let EdgeIPs = dynamic(["10.10.0.10", "10.10.0.11"]);
let EdgeAccounts = dynamic(["svc-vpn-ldap", "svc-rs-bind"]);
IdentityQueryEvents
| where Timestamp > ago(30d)
| where AccountName in~ (EdgeAccounts) or IPAddress in (EdgeIPs)
| where Query has_any ("ms-Mcs-AdmPwd", "msLAPS-Password", "msLAPS-EncryptedPassword", "msFVE-RecoveryInformation", "servicePrincipalName")
| project Timestamp, AccountName, IPAddress, DestinationDeviceName, ActionType, Query

let EdgeIPs = dynamic(["10.10.0.10", "10.10.0.11"]);
SecurityEvent
| where TimeGenerated > ago(30d)
| where EventID == 4769
| where IpAddress has_any (EdgeIPs)
| summarize Services = dcount(ServiceName), Tickets = count(), RC4 = countif(TicketEncryptionType == "0x17") by IpAddress, TargetUserName, bin(TimeGenerated, 1h)
| where Services > 5 or RC4 > 0

5. VPN logins without a matching MFA sign-in

Authentication bypasses such as the SonicWall SAML/MFA flaw leave a simple trace: a successful VPN session for a user who did not complete a sign-in at the identity provider shortly before. User name formats differ between VPN and IdP, so normalise them first.

let vpn = CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceVendor in~ ("SonicWall", "Fortinet", "Palo Alto Networks", "Cisco")
| where Activity has_any ("login", "logon", "connected") and Activity !has "fail"
| project VpnTime = TimeGenerated, User = tolower(DestinationUserName), SourceIP;
let idp = SigninLogs
| where TimeGenerated > ago(14d) and ResultType == 0
| project IdpTime = TimeGenerated, User = tolower(tostring(split(UserPrincipalName, "@")[0]));
vpn
| join kind=leftouter idp on User
| extend DeltaMin = abs(datetime_diff("minute", VpnTime, IdpTime))
| summarize Matched = countif(DeltaMin <= 10) by VpnTime, User, SourceIP
| where Matched == 0

6. Administrative changes outside working hours

New local admins, changed authentication servers, added syslog destinations or modified ACLs are typical persistence and anti-forensics steps. On Cisco ASA, messages 111008 and 111010 record executed commands and configuration changes; most vendors have equivalents.

index=edge ("%ASA-5-111008" OR "%ASA-5-111010" OR "%FTD-5-111008" OR "%FTD-5-111010" OR "configuration changed" OR "admin login")
| eval hour = tonumber(strftime(_time, "%H")), weekday = strftime(_time, "%a")
| where hour < 7 OR hour >= 20 OR weekday IN ("Sat", "Sun")
| stats count values(user) AS users values(src_ip) AS sources min(_time) AS first_seen by host
| convert ctime(first_seen)

If you find something

• Preserve before you patch. Export configuration, collect vendor support bundles and crash files, and if the platform allows it, take memory and disk images or a VM snapshot including memory. Upgrades and reboots destroy volatile evidence.
• Contain at the perimeter, not on the box. Block management access and restrict egress on an upstream firewall; an attacker with root on the appliance can undo local changes.
• Involve the vendor and the authorities. Vendor PSIRT or TAC teams can examine file systems customers cannot see. National CERTs often have indicators that are not public yet.
• Rebuild rather than clean when compromise is confirmed or cannot be ruled out: flash a clean, current image and restore only configuration from before the exposure window.
• Rotate everything the appliance knew, after the rebuild: local admin accounts, directory bind accounts, RADIUS and TACACS secrets, certificates and private keys, API tokens, and credentials of users who authenticated through the device during the window.
• Follow the attacker inward. The appliance is usually only the entry point. Hunt on the systems its service accounts and VPN sessions reached.

Make the next investigation easier

Most of this work is only possible if it was prepared. The joint guidance on edge devices published in February 2025 by the Australian Signals Directorate, CISA, the UK NCSC and partners, and the NCSC's forensic specifications for network appliance vendors, describe what to demand from vendors and what to build yourself:

• Keep an inventory of every internet-facing appliance with model, version and owner, and match it daily against new KEV entries.
• Forward appliance logs in near real time over TLS to a system the appliance cannot modify, and alert when the stream stops.
• Define an egress allowlist per appliance and log everything else.
• Baseline normal behaviour: who logs in, when configurations change, which internal hosts the appliance talks to.
• Ask vendors before purchase whether they support remote logging of authentication, process and file events, configuration change logs with old and new values, and customer-initiated memory and storage acquisition.

Our dossiers on BeyondTrust Remote Support, Ivanti Connect Secure and PHP2Shell on PAN-OS contain vendor-specific artefacts and queries. For prioritising which edge findings to handle first, see EPSS vs CVSS vs KEV.