Sigma rule: Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation

Rule

Title

Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation

Status

test

Level

medium

Author

Andreas Braathen (mnemonic.io)

Date

2024-04-25

File

rules-emerging-threats/2024/Exploits/CVE-2024-3400/file_event_paloalto_globalprotect_exploit_cve_2024_3400_command_inject_file_creation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious file creations in the Palo Alto Networks PAN-OS' parent telemetry folder, which are processed by the vulnerable 'dt_curl' script if device telemetry is enabled.
As said script overrides the shell-subprocess restriction, arbitrary command execution may occur by carefully crafting filenames that are escaped through this function.

Log source

product

paloalto

service

globalprotect

category

file_event

definition

Requirements: file creation events need to be ingested from the Palo Alto GlobalProtect appliance

Detection

selection:
    TargetFilename|contains:
        - '{IFS}'
        - 'base64'
        - 'bash'
        - 'curl'
        - 'http'
    TargetFilename|startswith: '/opt/panlogs/tmp/device_telemetry/'
condition: selection

False positives (as the rule lists them)

• The PAN-OS device telemetry function does not enforce a standard filename convention, but observations are unlikely.

Tags

• attack.execution
• cve.2024-3400
• detection.emerging-threats

CVEs this rule names

• CVE-2024-3400

References

• https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
• https://nvd.nist.gov/vuln/detail/CVE-2024-3400

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2024/Exploits/CVE-2024-3400/file_event_paloalto_globalprotect_exploit_cve_2024_3400_command_inject_file_creation.yml