add: PaloAlto exploitation CVE-2024-3400

yara/vuln_paloalto_cve_2024_3400_apr24.yar

@@ -0,0 +1,91 @@
+
+rule APT_UTA028_ForensicArtefacts_PaloAlto_CVE_2024_3400_Apr24_1 : SCRIPT {
+   meta:
+      description = "Detects forensic artefacts of APT UTA028 as found in a campaign exploiting the Palo Alto CVE-2024-3400 vulnerability"
+      author = "Florian Roth"
+      reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
+      date = "2024-04-15"
+      modified = "2024-04-18"
+      score = 70
+   strings:
+      $x1 = "cmd = base64.b64decode(rst.group"
+      $x2 = "f.write(\"/*\"+output+\"*/\")"
+
+      $x3 = "* * * * * root wget -qO- http://"
+      $x4 = "rm -f /var/appweb/sslvpndocs/global-protect/*.css"
+
+      $x5a = "failed to unmarshal session(../" // https://security.paloaltonetworks.com/CVE-2024-3400
+      $x5b = "failed to unmarshal session(./../" // customer data
+
+      $x6 = "rm -rf /opt/panlogs/tmp/device_telemetry/minute/*" base64
+      $x7 = "$(uname -a) > /var/" base64
+   condition:
+      1 of them
+}
+
+rule EXPL_PaloAlto_CVE_2024_3400_Apr24_1 {
+   meta:
+      description = "Detects characteristics of the exploit code used in attacks against Palo Alto GlobalProtect CVE-2024-3400"
+      author = "Florian Roth"
+      reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
+      date = "2024-04-15"
+      score = 70
+   strings:
+      $x1 = "SESSID=../../../../opt/panlogs/"
+      $x2 = "SESSID=./../../../../opt/panlogs/"
+      
+      $sa1 = "SESSID=../../../../"
+      $sa2 = "SESSID=./../../../../"
+      
+      $sb2 = "${IFS}"
+   condition:
+      1 of ($x*)
+      or (1 of ($sa*) and $sb2)
+}
+
+rule SUSP_LNX_Base64_Download_Exec_Apr24 : SCRIPT {
+   meta:
+      description = "Detects suspicious base64 encoded shell commands used for downloading and executing further stages"
+      author = "Paul Hager"
+      date = "2024-04-18"
+      reference = "Internal Research"
+      score = 75
+   strings:
+      $sa1 = "curl http" base64
+      $sa2 = "wget http" base64
+      
+      $sb1 = "chmod 777 " base64
+      $sb2 = "/tmp/" base64
+   condition:
+      1 of ($sa*)
+      and all of ($sb*)
+}
+
+rule SUSP_PY_Import_Statement_Apr24_1 {
+   meta:
+      description = "Detects suspicious Python import statement and socket usage often found in Python reverse shells"
+      author = "Florian Roth"
+      reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
+      date = "2024-04-15"
+      score = 65
+   strings:
+      $x1 = "import sys,socket,os,pty;s=socket.socket("
+   condition:
+      1 of them
+}
+
+rule SUSP_LNX_Base64_Exec_Apr24 : SCRIPT {
+   meta:
+      description = "Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)"
+      author = "Christian Burkard"
+      date = "2024-04-18"
+      reference = "Internal Research"
+      score = 75
+   strings:
+      $s1 = "curl http://" base64
+      $s2 = "wget http://" base64
+      $s3 = ";chmod 777 " base64
+      $s4 = "/tmp/" base64
+   condition:
+      all of them
+}