Palo Alto PAN-OS GlobalProtect Command Injection (CVE-2024-3400)

let suspiciousPaths = dynamic(['/ssl-vpn/hipreport.esp', '/global-protect/portal/css/bootstrap.min.css', '/global-protect/portal/js/']);
let knownBadIPs = dynamic([]);
union
(
    CommonSecurityLog
    | where DeviceVendor == "Palo Alto Networks"
    | where DeviceProduct == "PAN-OS"
    | where Activity has_any ("globalprotect", "sslvpn")
    | where Message has_any ("cmd", "shell", "python", "wget", "curl", "chmod", "/bin/sh", "base64")
    | where RequestURL has_any (suspiciousPaths)
    | project TimeGenerated, DeviceAction, SourceIP, DestinationIP, RequestURL, Message, DeviceVersion, Activity
),
(
    Syslog
    | where Facility == "daemon"
    | where SyslogMessage has "GlobalProtect"
    | where SyslogMessage has_any ("cmd", "/tmp/", "python3", "wget", "curl", ".sh", "base64", "chmod +x")
    | project TimeGenerated, HostName, SyslogMessage
),
(
    DeviceNetworkEvents
    | where RemoteUrl has_any (suspiciousPaths)
    | where InitiatingProcessFileName in~ ("python3", "python", "sh", "bash", "wget", "curl")
    | where DeviceName has_any ("panos", "gp-gateway", "panorama")
    | project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine
)
| extend SuspiciousIndicator = "CVE-2024-3400 GlobalProtect RCE"
| order by TimeGenerated desc

index=network (sourcetype="pan:traffic" OR sourcetype="pan:system" OR sourcetype="pan:threat" OR sourcetype="pan:log")
| eval is_gp_path=if(match(cs-uri-stem, "(?i)(hipreport\.esp|global-protect|ssl-vpn)"), 1, 0)
| eval has_inject=if(match(message, "(?i)(cmd|/bin/sh|python3?|wget|curl|base64|chmod|/tmp/|mkfifo)"), 1, 0)
| where is_gp_path=1 OR has_inject=1
| eval risk_score=if(is_gp_path=1 AND has_inject=1, 100, if(has_inject=1, 70, 30))
| eval cve="CVE-2024-3400"
| stats count AS event_count, values(src_ip) AS source_ips, values(message) AS messages, max(risk_score) AS max_risk by host, cve
| where max_risk >= 70
| sort -max_risk

sequence by host.name with maxspan=2m
  [network where network.protocol == "https"
   and url.path : ("/ssl-vpn/hipreport.esp", "/global-protect/*", "/ssl-vpn/*")
   and http.request.method : ("POST", "GET")
  ]
  [process where event.type == "start"
   and process.parent.name : ("pangps", "gpd", "pan_gp", "sslmgr")
   and process.name : ("sh", "bash", "python3", "python", "wget", "curl", "perl")
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  URL,
  "USERNAME",
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source,
  "devicetype",
  magnitude
FROM events
WHERE logsourcetypename(devicetype) ILIKE '%Palo Alto%'
  AND (
    URL ILIKE '%hipreport.esp%'
    OR URL ILIKE '%/global-protect/%'
    OR URL ILIKE '%/ssl-vpn/%'
  )
  AND (
    utf8(payload) ILIKE '%python%'
    OR utf8(payload) ILIKE '%/bin/sh%'
    OR utf8(payload) ILIKE '%wget%'
    OR utf8(payload) ILIKE '%curl%'
    OR utf8(payload) ILIKE '%base64%'
    OR utf8(payload) ILIKE '%chmod%'
    OR utf8(payload) ILIKE '%/tmp/%'
  )
  AND LOGSOURCETIME(starttime) > NOW() - 1 HOURS
ORDER BY magnitude DESC
LAST 3600 SECONDS

_sourceCategory=network/paloalto OR _sourceCategory=firewall/panos
| parse regex "(?<url>/(?:ssl-vpn|global-protect)[^\s\"]*)"
| where url matches "*/hipreport.esp*" or url matches "*/global-protect/*" or url matches "*/ssl-vpn/*"
| where _raw matches "*python*" or _raw matches "*/bin/sh*" or _raw matches "*wget*" or _raw matches "*curl *" or _raw matches "*base64*" or _raw matches "*chmod*" or _raw matches "*/tmp/*"
| extract field=_raw "src=(?<src_ip>[\d\.]+)"
| extract field=_raw "dst=(?<dst_ip>[\d\.]+)"
| count as hit_count by src_ip, dst_ip, url
| where hit_count > 0
| sort by hit_count desc

rule cve_2024_3400_globalprotect_rce {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2024-3400 exploitation — PAN-OS GlobalProtect command injection"
    severity = "CRITICAL"
    priority = "HIGH"
    cve = "CVE-2024-3400"
    mitre_attack = "T1190"

  events:
    (
      $e1.metadata.event_type = "NETWORK_HTTP"
      and re.regex($e1.target.url, `(?i)/(ssl-vpn/hipreport\.esp|global-protect/portal|global-protect/gateway)`)
      and $e1.target.port = 443
      and $e1.principal.ip = $src_ip
    )
    and
    (
      $e2.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e2.target.process.file.full_path, `(?i)(python3?|/bin/sh|/bin/bash|wget|curl)`)
      and $e2.principal.hostname = $host
    )

  match:
    $src_ip, $host over 5m

  outcome:
    $risk_score = max(95)
    $detection_name = "CVE-2024-3400 PAN-OS GlobalProtect RCE"

  condition:
    $e1 and $e2
}

#repo=base_activity
| event_type=NetworkConnect
| LocalPort=443
| RemoteAddressIP4=*
| ImageFileName=/(?i)(pangps|gpd|sslmgr|pan_gp)/
| join(
    event_type=ProcessRollup2
    | ImageFileName=/(?i)(python3?|wget|curl|\/bin\/sh|\/bin\/bash)/
    | ParentImageFileName=/(?i)(pangps|gpd|sslmgr)/
    , field=[aid, cid]
    , include=[ImageFileName, CommandLine, ParentImageFileName, UserName]
  )
| eval ThreatLabel="CVE-2024-3400 GlobalProtect RCE"
| groupBy([aid, ComputerName, ThreatLabel], function=[count(ImageFileName, as=process_count), collect(CommandLine)])
| where process_count > 0
| sort(process_count, order=desc)