SIGNATURE_BASE_SUSP_LNX_Base64_Exec_Apr24

rule SIGNATURE_BASE_SUSP_LNX_Base64_Exec_Apr24 : SCRIPT CVE_2024_3400 FILE
{
	meta:
		description = "Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)"
		author = "Christian Burkard"
		id = "2da3d050-86b0-5903-97eb-c5f39ce4f3a3"
		date = "2024-04-18"
		modified = "2025-03-21"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L81-L105"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "e96fb7c8faac12c1f0210689f2b3a7903b42a543b97ddff11298e5ae13cae80b"
		score = 75
		quality = 85
		tags = "SCRIPT, CVE-2024-3400, FILE"

	strings:
		$s1 = "curl http://" base64
		$s2 = "wget http://" base64
		$s3 = ";chmod 777 " base64
		$mirai = "country="
		$fp1 = "<html"
		$fp2 = "<?xml"

	condition:
		filesize < 800KB and 1 of ( $s* ) and not $mirai and not 1 of ( $fp* )
}