APT_UTA028_ForensicArtefacts_PaloAlto_CVE_2024_3400_Apr24_1

rule APT_UTA028_ForensicArtefacts_PaloAlto_CVE_2024_3400_Apr24_1 : SCRIPT {
   meta:
      description = "Detects forensic artefacts of APT UTA028 as found in a campaign exploiting the Palo Alto CVE-2024-3400 vulnerability"
      author = "Florian Roth"
      reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
      date = "2024-04-15"
      modified = "2024-04-18"
      score = 70
      id = "32cf18ff-784d-5849-87f8-14ede7315188"
   strings:
      $x1 = "cmd = base64.b64decode(rst.group"
      $x2 = "f.write(\"/*\"+output+\"*/\")"

      $x3 = "* * * * * root wget -qO- http://"
      $x4 = "rm -f /var/appweb/sslvpndocs/global-protect/*.css"

      $x5a = "failed to unmarshal session(../" // https://security.paloaltonetworks.com/CVE-2024-3400
      $x5b = "failed to unmarshal session(./../" // customer data

      $x6 = "rm -rf /opt/panlogs/tmp/device_telemetry/minute/*" base64
      $x7 = "$(uname -a) > /var/" base64
   condition:
      1 of them
}