Palo Alto Networks Possible Command Injection in User Field
This rule detects potential command injection attempts within the username field of Palo Alto Networks system logs. It specifically looks for various command injection indicators such as backticks, semicolons, logical operators (&&, ||), command substitution ($()), directory traversal (../), and common command-line utilities (wget, curl, chmod, sh, bash, ./, nc) within the 'User ' string in the raw log. The rule then extracts the potentially injected username and the source IP address for further investigation.
Splunk (SPL)
