Sigma high test sigma

Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection

Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect. This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.

View Source

Detection Logic

{
  "keywords_generic": [
    "failed to unmarshal session(../",
    "failed to unmarshal session(./../",
    "failed to unmarshal session(/..",
    "failed to unmarshal session(%2E%2E%2F",
    "failed to unmarshal session(%2F%2E%2E",
    "failed to unmarshal session(%2E%2F%2E%2E%2F",
    "failed to unmarshal session(%252E%252E%252F",
    "failed to unmarshal session(%252F%252E%252E",
    "failed to unmarshal session(%252E%252F%252E%252E%252F"
  ],
  "keywords_telemetry_exploit": [
    "{IFS}",
    "base64",
    "bash",
    "curl",
    "http"
  ],
  "keywords_telemetry_path": [
    "/opt/panlogs/tmp/device_telemetry/"
  ],
  "condition": "keywords_generic or (keywords_telemetry_exploit and keywords_telemetry_path)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...