# CVE-2024-3400 Indicators of Compromise
# Palo Alto GlobalProtect Command Injection
# Sources: Volexity, Palo Alto Networks, CISA

## HTTP Request Patterns
POST /ssl-vpn/hipreport.esp
Cookie: SESSID=*;*
Cookie: SESSID=*|*
Cookie: SESSID=*`*
Cookie: SESSID=*$(*
User-Agent: GlobalProtect/*

## File Paths (UPSTYLE Backdoor)
/var/appweb/sslvpndocs/global-protect/portal/images/*.css
/tmp/.python*
/tmp/updater
/var/log/pan/sslvpn_ngx_error.log

## Suspicious CSS File Characteristics
- Size > 100KB
- Contains Python code (shebang, imports)
- Base64-encoded payloads
- Socket/subprocess imports

## Process Execution Patterns
sh -c *
wget http://*/[0-9a-f]{32}
curl http://*/[0-9a-f]{32}
python /var/appweb/*
chmod +x /tmp/*

## Network IOCs (Known C2 from UTA0218 Campaign)
# Note: these are historical from April 2024 campaign
172.233.228.93
195.181.170.238
# Additional C2 domains redacted pending active campaign conclusion

## Log Patterns to Hunt
- Unusual outbound connections from firewall management interface
- Large CSS files created in /var/appweb/
- Python processes spawned by root from web directories
- Failed authentication attempts followed by successful command execution
- Sudden spike in CPU usage from web/SSL VPN processes

## Behavioral Indicators
- PAN-OS firewall making outbound HTTP/HTTPS to non-update domains
- Unexpected SSH connections from firewall to internal network
- Configuration changes without corresponding admin actions
- Export of firewall config/credentials to external systems

## Sigma Rule Triggers
- Selection: c-uri contains '/ssl-vpn/hipreport.esp'
- Selection: cs-cookie contains shell metacharacters (;|`$)
- Selection: file creation in /var/appweb/ with .css extension > 100KB
- Selection: process execution 'python' from web directory

## Detection Queries

### Splunk
index=pan_logs uri="*/ssl-vpn/hipreport.esp" cs_cookie="*SESSID=*;*" OR cs_cookie="*SESSID=*|*"

### ELK
(url.path:"/ssl-vpn/hipreport.esp") AND (http.request.cookie:("SESSID=*;*" OR "SESSID=*|*"))

### Palo Alto Firewall Logs
(addr.dst in <internal-firewall-mgmt-ips>) AND (url.path contains "hipreport.esp") AND (cookie contains ";")

## Recommended Actions
1. Grep firewall logs for /ssl-vpn/hipreport.esp with suspicious cookies
2. Check /var/appweb/sslvpndocs/global-protect/portal/images/ for oversized CSS
3. Review outbound connections from firewall management interface
4. Audit firewall configuration changes since March 2024
5. Deploy Sigma rules to SIEM immediately
6. Patch to PAN-OS 10.2.9-h1, 11.0.4-h1, or 11.1.2-h3 ASAP
