CVE-2024-3400 IOC's

OtakarKlier — Fri, 19 Apr 2024 14:57:26 GMT

Hello All,

Its a twitter link but will try and summarize the process.

https://twitter.com/cyb3rops/status/1781294529586331650

Credit to:

Florian Roth

@cyb3rops

We decided to share our #YARA rules to scan for indicators of the exploitation of CVE-2024-3400 in #PaloAlto's PAN-OS with the community and included some of the generic rules (detect similar attacks) Three Steps

1. Generate a Tech Support file and extract it knowledgebase.paloaltonetworks.com/KCSArticleDeta

2. Download and extract THOR Lite nextron-systems.com/thor-lite/

3. Scan the extracted folder (tech support files) thor64-lite.exe -a FileScan -p ..\2024XXXX_XXXX_techsupport.tgz_unpacked --intense --cross-platform --max-file-size 500MB YARA Rules (already included in THOR Lite's signature package) github.com/Neo23x0/signat

Screen shots in the original post on Twitter.

Also PAN has updated their guidance and a search for compromise.

https://security.paloaltonetworks.com/CVE-2024-3400#:~:text=Q.Are%20there%20any%20checks%20I%20can%20run%20on%20my%20device%20to%20look%20for%20evidence%20of%20attempted%20exploit%20activity%3F

Good luck to all!

Re: CVE-2024-3400 IOC's

JayGolf — Tue, 23 Apr 2024 00:56:36 GMT

Thanks for sharing @OtakarKlier !

topic Re: CVE-2024-3400 IOC's in General Topics

CVE-2024-3400 IOC's

Re: CVE-2024-3400 IOC's