How can I see if my FW has already been exploited by the CVE-2024-3400?

[Alpalo]

Hello team

How can we determine if your device logs match the known indicators of compromise (IoC) for this vulnerability?

I have already fixed the vulnerability and I have the TSF of my device and I want to see if I have been exploited before applying the WK,

Can anyone help me?

Greetings.

[Adrian_Jensen]

I have not seen anything yet for IoC in the logs as the exploit package apparently deletes related log entries. If you are syslogging then you may be able to search for something in your external log repository. I suspect there is probably a CLI debug command to show the Python packages loaded, but you would probably have to ask PA support for that. I have been running a script from an external server all weekend, constantly querying and validating the GlobalProtect CSS file, to look for any sign of an installed package.

[TonyDeHart]

If you haven't seen it the command from the CLI that can give indicators is in the advisory here: https://security.paloaltonetworks.com/CVE-2024-3400

From the advisory though it states this isn't definitive just could indicate a thwarted attempt and not necessarily a breach. We've uploaded tech support logs to Palo and are waiting for their analysis.

[TonyDeHart]

Also when you say FIXED be aware that disabling telemetry is NOT enough now and Palo's Guidance has changed on this as of late yesterday (4/16).

[OtakarKlier]

Hello All,

Here is the best writeup I have seen so far.

https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execut...

Regards,

[OtakarKlier]

IOC's posted i made a new thread for it.

https://live.paloaltonetworks.com/t5/general-topics/cve-2024-3400-ioc-s/td-p/584343

[OtakarKlier]

Also PAN updated their Faq's with a search query.

https://security.paloaltonetworks.com/CVE-2024-3400#:~:text=Q.Are%20there%20any%20checks%20I%20can%2...