Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection

SigmaHQ Detections@sigmaHQ

•updated Mar 4, 2025•0•38

Detects potential exploitation attempts of CVE-2024-3400, an OS command injection vulnerability in Palo Alto GlobalProtect. The rule looks for suspicious strings indicating directory traversal or command injection within Palo Alto GlobalProtect logs.