Suspicious Palo Alto GlobalProtect Session Unmarshal Path Traversal and Command Injection Attempts
Detects GlobalProtect logs with directory traversal/command injection-style indicators tied to CVE-2024-3400 behavior.
FreeReviewedSigma · High · v5
- Product
- paloalto
- Category
- appliance
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-04-18
- Updated
- 2026-07-31
What it detects
This rule flags potential exploitation activity against Palo Alto GlobalProtect by matching telemetry indicative of directory traversal or OS command injection behavior. It looks for log entries containing specific failed-unmarshal session patterns that include traversal sequences, as well as combinations of command-leaning strings (e.g., base64, bash, curl, http, {IFS}) occurring within the GlobalProtect device telemetry temporary path. The detection relies on ingested GlobalProtect appliance logs (including mp-log and gpsvc.log) that contain the matched string patterns.
Reporting behind it
- security.paloaltonetworks.comhttps://security.paloaltonetworks.com/CVE-2024-3400
- labs.watchtowr.comhttps://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
- attackerkb.comhttps://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-3400/paloalto_globalprotect_exploit_cve_2024_3400_command_injection.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
palo-alto-globalprotect-os-command-injection-indicators-via-cve-2024-3400-f130a5f1
title: Suspicious Palo Alto GlobalProtect Session Unmarshal Path Traversal and Command Injection Attempts
id: c89e9496-0d1a-45c6-a398-43e153320759
status: test
description: This rule flags potential exploitation activity against Palo Alto GlobalProtect by matching telemetry indicative of directory traversal or OS command injection behavior. It looks for log entries containing specific failed-unmarshal session patterns that include traversal sequences, as well as combinations of command-leaning strings (e.g., base64, bash, curl, http, {IFS}) occurring within the GlobalProtect device telemetry temporary path. The detection relies on ingested GlobalProtect appliance logs (including mp-log and gpsvc.log) that contain the matched string patterns.
references:
- https://security.paloaltonetworks.com/CVE-2024-3400
- https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
- https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-3400/paloalto_globalprotect_exploit_cve_2024_3400_command_injection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-04-18
modified: 2025-11-22
tags:
- attack.initial-access
- attack.persistence
- attack.privilege-escalation
- cve.2024-3400
- detection.emerging-threats
- attack.stealth
logsource:
category: appliance
product: paloalto
service: globalprotect
definition: 'Requirements: Palo Alto GlobalProtect "mp-log" and "gpsvc.log" log files need to be ingested'
detection:
keywords_generic:
- failed to unmarshal session(../
- failed to unmarshal session(./../
- failed to unmarshal session(/..
- failed to unmarshal session(%2E%2E%2F
- failed to unmarshal session(%2F%2E%2E
- failed to unmarshal session(%2E%2F%2E%2E%2F
- failed to unmarshal session(%252E%252E%252F
- failed to unmarshal session(%252F%252E%252E
- failed to unmarshal session(%252E%252F%252E%252E%252F
keywords_telemetry_exploit:
- "{IFS}"
- base64
- bash
- curl
- http
keywords_telemetry_path:
- /opt/panlogs/tmp/device_telemetry/
condition: keywords_generic or (keywords_telemetry_exploit and keywords_telemetry_path)
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: f130a5f1-73ba-42f0-bf1e-b66a8361cb8f
type: derived