Suspicious Palo Alto GlobalProtect Session Unmarshal Path Traversal and Command Injection Attempts

title: Suspicious Palo Alto GlobalProtect Session Unmarshal Path Traversal and Command Injection Attempts
id: c89e9496-0d1a-45c6-a398-43e153320759
status: test
description: This rule flags potential exploitation activity against Palo Alto GlobalProtect by matching telemetry indicative of directory traversal or OS command injection behavior. It looks for log entries containing specific failed-unmarshal session patterns that include traversal sequences, as well as combinations of command-leaning strings (e.g., base64, bash, curl, http, {IFS}) occurring within the GlobalProtect device telemetry temporary path. The detection relies on ingested GlobalProtect appliance logs (including mp-log and gpsvc.log) that contain the matched string patterns.
references:
  - https://security.paloaltonetworks.com/CVE-2024-3400
  - https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
  - https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-3400/paloalto_globalprotect_exploit_cve_2024_3400_command_injection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-04-18
modified: 2025-11-22
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - cve.2024-3400
  - detection.emerging-threats
  - attack.stealth
logsource:
  category: appliance
  product: paloalto
  service: globalprotect
  definition: 'Requirements: Palo Alto GlobalProtect "mp-log" and "gpsvc.log" log files need to be ingested'
detection:
  keywords_generic:
    - failed to unmarshal session(../
    - failed to unmarshal session(./../
    - failed to unmarshal session(/..
    - failed to unmarshal session(%2E%2E%2F
    - failed to unmarshal session(%2F%2E%2E
    - failed to unmarshal session(%2E%2F%2E%2E%2F
    - failed to unmarshal session(%252E%252E%252F
    - failed to unmarshal session(%252F%252E%252E
    - failed to unmarshal session(%252E%252F%252E%252E%252F
  keywords_telemetry_exploit:
    - "{IFS}"
    - base64
    - bash
    - curl
    - http
  keywords_telemetry_path:
    - /opt/panlogs/tmp/device_telemetry/
  condition: keywords_generic or (keywords_telemetry_exploit and keywords_telemetry_path)
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f130a5f1-73ba-42f0-bf1e-b66a8361cb8f
    type: derived