Log source category

appliance log source Sigma rules

1 Sigma detection rule in the library use the appliance log source, mostly on paloalto. The appliance category groups related telemetry so you can find detections that consume the same events. Open a rule to read its detection logic, MITRE ATT&CK mapping and original YAML.

1 rule

Products

paloalto1

Severity

high1

Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection
high
Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect. This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.
paloalto · globalprotect

Products

Severity

Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection