Darktrace analyzes network-based activity on PAN-OS devices exploited through CVE-2024-3400, revealing post-exploitation behaviors across multiple customer deployments. The findings highlight four major themes: exploit validation, shell/payload retrieval, data exfiltration, and ongoing C2 via encrypted or uncommon protocols. #PAN-OS #CVE-2024-3400 #GlobalProtect #Darktrace #SliverC2 #CobaltStrike #UPSTYLE
Keypoints
- The analysis centers on CVE-2024-3400, a remote command execution vulnerability affecting PAN-OS 10.2, 11.0, and 11.1 in GlobalProtect and observed by Darktrace starting April 2024.
- Threat actors use out-of-band application security testing (OAST) services (e.g., Interactsh) to validate exploits and enumerate targets, with connections to OAST domains noted in attack chains.
- Post-exploitation activity commonly involves HTTP GET requests for shell scripts and Linux executables (ELF) retrieved from external IPs, often via curl or wget.
- Shell scripts frequently perform host enumeration, create or modify files, adjust permissions, and execute external content while attempting to evade defense.
- Configuration data exfiltration via HTTP POST to rare endpoints often includes sensitive details like IPs, gateways, users, and password hashes.
- Ongoing C2 activity is observed over encrypted and non-standard channels, including TLS/SSL, SSH, and WebSocket communications to rare external endpoints, sometimes with long beaconing periods.
- Brute-force attempts using Kerberos and RADIUS were observed, indicating lateral movement and credential-based attempts during compromises.
MITRE Techniques
- [T1190] Exploiting Public-Facing Application – Attackers exploited CVE-2024-3400 remote command execution on PAN-OS GlobalProtect to run commands on targeted devices. “a form of remote command execution vulnerability that affects several versions of PAN-OS”
- [T1059.004] Command and Scripting Interpreter: Unix Shell – Compromised devices frequently retrieved shell scripts via HTTP GET and used bash to run enumeration commands; “The most common feature across analyzed incidents was HTTP GET requests for shell scripts and Linux executable files (ELF) … using the utilities, cURL and wget.”
- [T1105] Ingress Tool Transfer – Bash scripts retrieved external content with curl/wget, changed permissions, and executed, indicating tool/payload transfer during exploitation. “If the file did not exist, the system would then use cURL or wget to obtain content from external sites, change the permissions of the file, and then execute.”
- [T1571] Non-Standard Port – Some bash scripts were involved in retrieval over non-standard ports for HTTP, indicating evasion via uncommon network paths. “sometimes over non-standard ports for the HTTP protocol.”
- [T1041] Exfiltration Over C2 Protocol – Configuration data exfiltration via HTTP POST to rare endpoints containing sensitive details (IP, gateway, users, password hashes). “contained sensitive configuration details of the targeted Palo Alto firewall devices, including the IP address, default gateway, domain, users, superusers, and password hashes.”
- [T1573.002] Encrypted Channel: Asymmetric Cryptography – Ongoing C2 beacons and payloads over encrypted channels (TLS/SSL, SSH) and WebSocket usage. “encrypted channels typically involved protocols such as TLS/SSL and SSH”
- [T1110.001] Brute Force: Password Guessing – Brute-force activity observed across authentication protocols including Kerberos and RADIUS during compromises. “brute-forcing activity via several authentication protocols (namely, Keberos and RADIUS) during the time of compromise.”
Indicators of Compromise
- [IP] C2 Endpoints – 94.131.120.80, 134.213.29.14
- [URL] C2/Exfiltration Endpoints – 80.92.205.239/upload, 194.36.171.43/upload
- [Hostname] C2 Endpoint – update.gl-protect.com
- [SHA1] Payload – 91ebcea4e6d34fd6e22f99713eaf67571b51ab01, 393c41b3ceab4beecf365285e8bdf0546f41efad
- [URL] Payload – 109.120.178.253:10000/data.txt, 109.120.178.253:10000/bin.txt
- [URL] Additional – 165.232.121.217/app/request, 165.232.121.217/app/request63
Read more: https://darktrace.com/blog/post-exploitation-activities-on-pan-os-devices-a-network-based-analysis