CVE-2024-3400 IOC's

[OtakarKlier]

Hello All,

Its a twitter link but will try and summarize the process. 

https://twitter.com/cyb3rops/status/1781294529586331650

Credit to:

Florian Roth

@cyb3rops

We decided to share our #YARA rules to scan for indicators of the exploitation of CVE-2024-3400 in #PaloAlto's PAN-OS with the community and included some of the generic rules (detect similar attacks) Three Steps

1. Generate a Tech Support file and extract it https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRlCAK…

2. Download and extract THOR Lite https://nextron-systems.com/thor-lite/

3. Scan the extracted folder (tech support files) thor64-lite.exe -a FileScan -p ..\2024XXXX_XXXX_techsupport.tgz_unpacked --intense --cross-platform --max-file-size 500MB YARA Rules (already included in THOR Lite's signature package) https://github.com/Neo23x0/signature-base/blob/master/yara/vuln_paloalto_cve_2024_3400_apr24.yar…

Screen shots in the original post on Twitter.

Also PAN has updated their guidance and a search for compromise.

https://security.paloaltonetworks.com/CVE-2024-3400#:~:text=Q.Are%20there%20any%20checks%20I%20can%2...

Good luck to all!

[JayGolf]

Thanks for sharing @OtakarKlier !