Palo Alto GlobalProtect PAN-OS Device Telemetry File Creation with Command Injection Filename Markers
Detects suspicious GlobalProtect device telemetry file creations with filenames containing CVE-2024-3400 command-injection indicators.
FreeReviewedSigma · Medium · v5
- Product
- paloalto
- Category
- file_event
- Author
- Andreas Braathen (mnemonic.io) (SigmaHQ), DRL 1.1
- Published
- 2024-04-25
- Updated
- 2026-07-31
What it detects
This rule flags file creation events under the PAN-OS device telemetry temporary directory associated with GlobalProtect telemetry processing. It specifically matches target filenames that start with /opt/panlogs/tmp/device_telemetry/ and contain markers such as {IFS}, base64, bash, curl, or http that could be used to craft injection payloads. The detection relies on file_event telemetry with the TargetFilename field from the GlobalProtect appliance.
Reporting behind it
- labs.watchtowr.comhttps://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2024-3400
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-3400/file_event_paloalto_globalprotect_exploit_cve_2024_3400_command_inject_file_creation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
palo-alto-globalprotect-file-creation-indicators-of-cve-2024-3400-os-command-inj-bcd95697
title: Palo Alto GlobalProtect PAN-OS Device Telemetry File Creation with Command Injection Filename Markers
id: 55c68e83-2a99-4acf-b931-984b108b9e6f
status: test
description: This rule flags file creation events under the PAN-OS device telemetry temporary directory associated with GlobalProtect telemetry processing. It specifically matches target filenames that start with /opt/panlogs/tmp/device_telemetry/ and contain markers such as {IFS}, base64, bash, curl, or http that could be used to craft injection payloads. The detection relies on file_event telemetry with the TargetFilename field from the GlobalProtect appliance.
references:
- https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
- https://nvd.nist.gov/vuln/detail/CVE-2024-3400
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-3400/file_event_paloalto_globalprotect_exploit_cve_2024_3400_command_inject_file_creation.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2024-04-25
tags:
- attack.execution
- cve.2024-3400
- detection.emerging-threats
logsource:
product: paloalto
service: globalprotect
category: file_event
definition: "Requirements: file creation events need to be ingested from the Palo Alto GlobalProtect appliance"
detection:
selection:
TargetFilename|contains:
- "{IFS}"
- base64
- bash
- curl
- http
TargetFilename|startswith: /opt/panlogs/tmp/device_telemetry/
condition: selection
falsepositives:
- The PAN-OS device telemetry function does not enforce a standard filename convention, but observations are unlikely.
level: medium
license: DRL-1.1
related:
- id: bcd95697-e3e7-4c6f-8584-8e3503e6929f
type: derived