Palo Alto GlobalProtect PAN-OS Device Telemetry File Creation with Command Injection Filename Markers

title: Palo Alto GlobalProtect PAN-OS Device Telemetry File Creation with Command Injection Filename Markers
id: 55c68e83-2a99-4acf-b931-984b108b9e6f
status: test
description: This rule flags file creation events under the PAN-OS device telemetry temporary directory associated with GlobalProtect telemetry processing. It specifically matches target filenames that start with /opt/panlogs/tmp/device_telemetry/ and contain markers such as {IFS}, base64, bash, curl, or http that could be used to craft injection payloads. The detection relies on file_event telemetry with the TargetFilename field from the GlobalProtect appliance.
references:
  - https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
  - https://nvd.nist.gov/vuln/detail/CVE-2024-3400
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-3400/file_event_paloalto_globalprotect_exploit_cve_2024_3400_command_inject_file_creation.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2024-04-25
tags:
  - attack.execution
  - cve.2024-3400
  - detection.emerging-threats
logsource:
  product: paloalto
  service: globalprotect
  category: file_event
  definition: "Requirements: file creation events need to be ingested from the Palo Alto GlobalProtect appliance"
detection:
  selection:
    TargetFilename|contains:
      - "{IFS}"
      - base64
      - bash
      - curl
      - http
    TargetFilename|startswith: /opt/panlogs/tmp/device_telemetry/
  condition: selection
falsepositives:
  - The PAN-OS device telemetry function does not enforce a standard filename convention, but observations are unlikely.
level: medium
license: DRL-1.1
related:
  - id: bcd95697-e3e7-4c6f-8584-8e3503e6929f
    type: derived