Rapid7 Labs critical experimental sigma

CVE-2024-3400 - Palo Alto Networks Firewalls Command Injection

Detects GET requests to '/global-protect/login[or]logout.esp' that indicate possible exploitation of the vulnerability CVE-2024-3400.

View Source

Detection Logic

{
  "selection_method_and_response": null,
  "cs-method": "POST",
  "selection_uri": {
    "cs-uri-stem
| contains": [
      "/global-protect/login.esp",
      "/global-protect/logout.esp",
      "/ssl-vpn/hipreport.esp"
    ]
  },
  "condition": "selection_method_and_response and 1 of selection_uri"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...