Palo Alto GlobalProtect File Creation Indicators of CVE-2024-3400 OS Command Injection

Detects suspicious GlobalProtect device telemetry file creations with filenames containing CVE-2024-3400 command-injection indicators.

FreeUnreviewedSigmamediumv1

palo-alto-globalprotect-file-creation-indicators-of-cve-2024-3400-os-command-inj-bcd95697

title: Palo Alto GlobalProtect File Creation Indicators of CVE-2024-3400 OS Command Injection
id: 55c68e83-2a99-4acf-b931-984b108b9e6f
status: test
description: This rule flags file creation events for paths under /opt/panlogs/tmp/device_telemetry/ where the target filename contains common command-injection-related strings such as {IFS}, base64, bash, curl, and http. Such patterns may indicate an attempt to reach the vulnerable dt_curl processing path used when device telemetry is enabled. The detection relies on Palo Alto GlobalProtect file event telemetry with the recorded TargetFilename for the created file.
references:
  - https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
  - https://nvd.nist.gov/vuln/detail/CVE-2024-3400
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-3400/file_event_paloalto_globalprotect_exploit_cve_2024_3400_command_inject_file_creation.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2024-04-25
tags:
  - attack.execution
  - cve.2024-3400
  - detection.emerging-threats
logsource:
  product: paloalto
  service: globalprotect
  category: file_event
  definition: "Requirements: file creation events need to be ingested from the Palo Alto GlobalProtect appliance"
detection:
  selection:
    TargetFilename|contains:
      - "{IFS}"
      - base64
      - bash
      - curl
      - http
    TargetFilename|startswith: /opt/panlogs/tmp/device_telemetry/
  condition: selection
falsepositives:
  - The PAN-OS device telemetry function does not enforce a standard filename convention, but observations are unlikely.
level: medium
license: DRL-1.1
related:
  - id: bcd95697-e3e7-4c6f-8584-8e3503e6929f
    type: derived

What it detects

This rule flags file creation events for paths under /opt/panlogs/tmp/device_telemetry/ where the target filename contains common command-injection-related strings such as {IFS}, base64, bash, curl, and http. Such patterns may indicate an attempt to reach the vulnerable dt_curl processing path used when device telemetry is enabled. The detection relies on Palo Alto GlobalProtect file event telemetry with the recorded TargetFilename for the created file.

Known false positives

The PAN-OS device telemetry function does not enforce a standard filename convention, but observations are unlikely.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.