How can I see if my FW has already been exploited by the CVE-2024-3400?

[Alpalo]

Hello team

How can we determine if your device logs match the known indicators of compromise (IoC) for this vulnerability?

I have already fixed the vulnerability and I have the TSF of my device and I want to see if I have been exploited before applying the WK,

Can anyone help me?

Greetings.

[kristiansein]

CVE has been updated with the instructions to do that: https://security.paloaltonetworks.com/CVE-2024-3400

[YMueller]

Hi All

Do these investigations have to be done running on the vulnerable software version, or is it still possible to check this after the software upgrade to a fixed release? 

[TonyDeHart]

I worked with our team but not discussed this with Palo but my understanding is the logs should still show the information even after an upgrade. We just pushed the 10.2.9-h1 release out this morning after Palo changed their guidance regarding telemetry not being enough to stop this. We have the signatures but who knows what else they'll discover later that isn't mitigated without an upgrade.

[TonyDeHart]

 I should mention that we are collecting logs via Panorama and externally. I just read in another post and hadn't noticed this in the write up that the vulnerability supposedly erases log entries...not sure how Palo is then analyzing logs in tech support files if the logs don't show the activity after the fact.