Palo Alto GlobalProtect OS Command Injection Indicators via CVE-2024-3400

title: Palo Alto GlobalProtect OS Command Injection Indicators via CVE-2024-3400
id: c89e9496-0d1a-45c6-a398-43e153320759
status: test
description: This rule flags potential exploitation attempts targeting Palo Alto GlobalProtect by looking for telemetry strings consistent with directory traversal and OS command injection behavior. Attackers may use traversal or injection payloads to manipulate backend processing and execute unintended commands. It relies on GlobalProtect appliance logs (mp-log and gpsvc.log) containing specific failed unmarshal patterns and, alternatively, exploit-adjacent strings observed within device telemetry under /opt/panlogs/tmp/device_telemetry/.
references:
  - https://security.paloaltonetworks.com/CVE-2024-3400
  - https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
  - https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-3400/paloalto_globalprotect_exploit_cve_2024_3400_command_injection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-04-18
modified: 2025-11-22
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - cve.2024-3400
  - detection.emerging-threats
  - attack.stealth
logsource:
  category: appliance
  product: paloalto
  service: globalprotect
  definition: 'Requirements: Palo Alto GlobalProtect "mp-log" and "gpsvc.log" log files need to be ingested'
detection:
  keywords_generic:
    - failed to unmarshal session(../
    - failed to unmarshal session(./../
    - failed to unmarshal session(/..
    - failed to unmarshal session(%2E%2E%2F
    - failed to unmarshal session(%2F%2E%2E
    - failed to unmarshal session(%2E%2F%2E%2E%2F
    - failed to unmarshal session(%252E%252E%252F
    - failed to unmarshal session(%252F%252E%252E
    - failed to unmarshal session(%252E%252F%252E%252E%252F
  keywords_telemetry_exploit:
    - "{IFS}"
    - base64
    - bash
    - curl
    - http
  keywords_telemetry_path:
    - /opt/panlogs/tmp/device_telemetry/
  condition: keywords_generic or (keywords_telemetry_exploit and keywords_telemetry_path)
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f130a5f1-73ba-42f0-bf1e-b66a8361cb8f
    type: derived