Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2024-3400.
Upgrade to ProDetect Palo Alto PAN-OS GlobalProtect Command Injection (CVE-2024-3400) in Microsoft Sentinel
CVE-2024-3400 is a critical unauthenticated remote code execution vulnerability (CVSS 10.0) in Palo Alto Networks PAN-OS GlobalProtect gateway. A command injection flaw in the GlobalProtect feature allows an unauthenticated attacker to execute arbitrary OS commands as root by sending specially crafted HTTPS requests. Actively exploited in the wild as part of Operation MidnightEclipse by threat actor UTA0218, attackers have deployed a Python-based backdoor (UPSTYLE) and conducted lateral movement. Affected versions include PAN-OS 10.2.x < 10.2.9-h1, 11.0.x < 11.0.4-h1, and 11.1.x < 11.1.2-h3.
MITRE ATT&CK
KQL Detection Query
let suspiciousPaths = dynamic(['/ssl-vpn/hipreport.esp', '/global-protect/portal/css/bootstrap.min.css', '/global-protect/portal/js/']);
let knownBadIPs = dynamic([]);
union
(
CommonSecurityLog
| where DeviceVendor == "Palo Alto Networks"
| where DeviceProduct == "PAN-OS"
| where Activity has_any ("globalprotect", "sslvpn")
| where Message has_any ("cmd", "shell", "python", "wget", "curl", "chmod", "/bin/sh", "base64")
| where RequestURL has_any (suspiciousPaths)
| project TimeGenerated, DeviceAction, SourceIP, DestinationIP, RequestURL, Message, DeviceVersion, Activity
),
(
Syslog
| where Facility == "daemon"
| where SyslogMessage has "GlobalProtect"
| where SyslogMessage has_any ("cmd", "/tmp/", "python3", "wget", "curl", ".sh", "base64", "chmod +x")
| project TimeGenerated, HostName, SyslogMessage
),
(
DeviceNetworkEvents
| where RemoteUrl has_any (suspiciousPaths)
| where InitiatingProcessFileName in~ ("python3", "python", "sh", "bash", "wget", "curl")
| where DeviceName has_any ("panos", "gp-gateway", "panorama")
| project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine
)
| extend SuspiciousIndicator = "CVE-2024-3400 GlobalProtect RCE"
| order by TimeGenerated descDetects exploitation attempts of CVE-2024-3400 by correlating PAN-OS/GlobalProtect logs for command injection indicators, suspicious process execution from the gateway daemon, and anomalous outbound connections from known GlobalProtect paths.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Palo Alto administrators running diagnostic scripts via CLI may produce similar syslog entries
- Automated vulnerability scanners probing GlobalProtect endpoints may trigger URL-pattern matches
- PAN-OS software updates or HA synchronization tasks may invoke Python or shell processes
Other platforms for CVE-2024-3400
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2024-3400 SESSID Command Injection Probe
Expected signal: PAN-OS traffic log entry with URI /ssl-vpn/hipreport.esp, HTTP 200 or 500 response; system log entry referencing unexpected file path in SESSID parameter
- Test 2UPSTYLE Backdoor Artifact Simulation
Expected signal: File creation event at /opt/panlogs/tmp/device_telemetry/threading/bootstrap.min.css; Python3 process launch from lab shell
- Test 3GlobalProtect Path Enumeration with Command Keywords
Expected signal: Network flow logs showing HTTPS GET requests to /global-protect/* and /ssl-vpn/* paths from the test host; URL parameters containing base64-encoded strings
- Test 4Post-Exploitation Outbound Beacon Simulation
Expected signal: Process telemetry shows python3 making outbound HTTP connections; network telemetry shows repeated periodic connections to the same destination IP from the firewall management process context
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2024-3400 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month