Sigma medium test sigma

Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation

Detects suspicious file creations in the Palo Alto Networks PAN-OS' parent telemetry folder, which are processed by the vulnerable 'dt_curl' script if device telemetry is enabled. As said script overrides the shell-subprocess restriction, arbitrary command execution may occur by carefully crafting filenames that are escaped through this function.

View Source

Detection Logic

{
  "selection": {
    "TargetFilename
| contains": [
      "{IFS}",
      "base64",
      "bash",
      "curl",
      "http"
    ],
    "TargetFilename
| startswith": "/opt/panlogs/tmp/device_telemetry/"
  },
  "condition": "selection"
}

False Positives

  • ⚠ The PAN-OS device telemetry function does not enforce a standard filename convention, but observations are unlikely.

Field Validations

Loading…

Comments (0)

Loading comments...