JA4H Fingerprinting Detects Sliver C2 Deployed via Chained PAN-OS CVE-2024-0012/CVE-2024-9474 Exploitation

Key facts for Operation Lunar Peek Sliver C2

Detection coverage for Operation Lunar Peek Sliver C2

As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2144 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PAN-OS X-PAN-AUTHCHECK Bypass via .js.map Path Suffix (CVE-2024-0012)

Detects the unauthenticated auth-bypass request pattern used to chain into CVE-2024-9474: a request path ending in .js.map or /aaaa.js.map combined with the X-PAN-AUTHCHECK: off header against the PAN-OS management web interface (e.g. GET /php/ztp_gate.php/.js.map, POST /php/utils/createRemoteAppwebSession.php/aaaa.js.map). This is the initial-access trigger for the watchTowr-documented exploit chain that leads to root RCE via AuditLog.php.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.004
• Data sources: pan_log (paloalto:mgmt:access), pan:system, CommonSecurityLog (Palo Alto CEF feed)
• Severity: critical
• Confidence: high

Splunk SPL

index=pan_log sourcetype="paloalto:mgmt:access" OR sourcetype="pan:system"
| eval uri=coalesce(uri_path, url, request_uri)
| eval authcheck_hdr=coalesce(http_header_x_pan_authcheck, header_x_pan_authcheck)
| where match(uri, "(?i)\.js\.map$") AND (like(uri, "%ztp_gate.php%") OR like(uri, "%createRemoteAppwebSession.php%") OR like(uri, "%/index.php%"))
| eval authcheck_off=if(match(lower(authcheck_hdr), "off"), 1, 0)
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as observed_paths values(src_ip) as src_ips by dest_ip, authcheck_off
| where authcheck_off=1 OR match(observed_paths, "(?i)aaaa\.js\.map")
| eval detection_id="TL-2026-2144-SPL-001"
| table detection_id, first_seen, last_seen, src_ips, dest_ip, observed_paths, count

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor == "Palo Alto Networks"
| extend RequestURI = tostring(RequestURL)
| extend AuthCheckHeader = tostring(AdditionalExtensions["X-PAN-AUTHCHECK"])
| where RequestURI matches regex @"(?i)\.js\.map$"
| where RequestURI has_any ("ztp_gate.php", "createRemoteAppwebSession.php", "index.php")
| where AuthCheckHeader =~ "off" or RequestURI has "aaaa.js.map"
| project TimeGenerated, SourceIP, DestinationIP, RequestURI, AuthCheckHeader, DeviceAction
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Paths=make_set(RequestURI), count() by SourceIP, DestinationIP

Sigma

title: PAN-OS Management Interface Auth Bypass via .js.map Suffix (CVE-2024-0012)
id: 7a2c1e4a-3f0e-4b7a-9d2c-9b1e0a5c7f21
status: experimental
description: Detects the X-PAN-AUTHCHECK header authcheck-bypass request pattern chained with a .js.map path suffix against PAN-OS management interface endpoints, the initial-access step of the CVE-2024-0012/CVE-2024-9474 exploit chain (Operation Lunar Peek).
references:
    - https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/
    - https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-26
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2024.0012
    - cve.2024.9474
    - detection.emerging-threats
logsource:
    category: proxy
    product: paloalto
detection:
    selection_path:
        cs-uri-stem|endswith: '.js.map'
        cs-uri-stem|contains:
            - 'ztp_gate.php'
            - 'createRemoteAppwebSession.php'
            - 'index.php'
    selection_header:
        cs-header-x-pan-authcheck: 'off'
    selection_aaaa:
        cs-uri-stem|contains: 'aaaa.js.map'
    condition: selection_path and (selection_header or selection_aaaa)
falsepositives:
    - Internal vulnerability scanning against the management interface using the published PoC (should be scoped/allow-listed)
level: critical

Known false positives:

• Authorized internal red-team/PoC validation replaying the watchTowr request pattern against a lab firewall
• Vulnerability scanners explicitly configured to test for CVE-2024-0012

Tuning notes: Scope dest_ip/DestinationIP to known PAN-OS management interface IPs to reduce noise from unrelated .js.map static-asset requests on other web stacks; exclude authorized scanner source IPs via a lookup table.

• 🔒 PAN-OS Legacy IE11 User-Agent Anomaly on Management Interface · unlock with TL Creds
• 🔒 PAN-OS Ingress Tool Transfer — curl/wget Payload Delivery to Firewall Dataplane · unlock with TL Creds
• 🔒 Sliver TLS Certificate CN=operators/multiplayer and Community-Corroborated C2 Infrastructure · unlock with TL Creds
• 🔒 Obfuscated PHP Web Shell Drop on PAN-OS (T1505.003) · unlock with TL Creds
• 🔒 Spectre RAT / [indicator] Dropper on Compromised PAN-OS Host (T1082/T1105) · unlock with TL Creds
• 🔒 Sliver C2 Cookie-Based HTTP Beaconing (SSID/refreshToken/csrf-state) · unlock with TL Creds
• 🔒 AuditLog.php Command Injection Root RCE Trigger (CVE-2024-9474) · unlock with TL Creds
• 🔒 Default-Configuration Sliver C2 — JA4H Fingerprint and TCP/31337 Beacon · unlock with TL Creds

Indicators of compromise for Operation Lunar Peek Sliver C2

As of 2026-10-19, Threadlinqs Intelligence tracks 37 indicators of compromise for TL-2026-2144.

Sample indicators (3 of 37)

• IP address: 172.232.195[.]234
• Domain: repositorylinux[.]org
• File hash: A3092BFA4199DEF7FC525465895EE3784C6FCF55F0A7E9C8436C027E0F41CB4B

Defanged, TLP:CLEAR. Full set of 37 indicators: unlock with TL Creds.

How Operation Lunar Peek Sliver C2 works

On November 18, 2024, Palo Alto Networks disclosed CVE-2024-0012, a missing-authentication vulnerability (CWE-306) in the PAN-OS management web interface that lets an unauthenticated network attacker obtain administrator privileges, and CVE-2024-9474, an OS command-injection flaw (CWE-78) that lets an authenticated administrator escalate to root. Palo Alto stated it had already identified a limited number of exploitation attempts against management interfaces at disclosure time. On November 19, 2024, watchTowr Labs published the technical mechanics of chaining the two bugs into unauthenticated remote code execution: appending a `/.js.map` or `/aaaa.js.map` suffix to a request path (e.g. `GET /php/ztp_gate.php/.js.map` with header `X-PAN-AUTHCHECK: off`) bypasses PAN-OS's authcheck enforcement because the underlying Nginx configuration only reset that header on specific routes; the attacker then POSTs a forged `user` parameter containing a backtick command substitution to `/php/utils/createRemoteAppwebSession.php`, which is later executed with root privileges when `AuditLog.php` shells out via `pan_elog` using the unsanitized username.

Within hours of the watchTowr writeup, Arctic Wolf Labs observed active in-the-wild exploitation, and Palo Alto Networks' Unit 42 tracked the resulting activity as "Operation Lunar Peek," attributing early scanning/exploitation traffic to IP space associated with anonymous VPN services but stopping short of actor attribution. Observed post-exploitation behavior included transferring obfuscated PHP web shells onto compromised firewalls, running interactive commands, exfiltrating configuration files, and — as the campaign matured over the following days — dropping an increasingly diverse set of payloads via `curl`/`wget`, including the open-source Sliver C2 framework (an alternative to Cobalt Strike, developed by Bishop Fox), cryptocurrency miners, and (per Darktrace's telemetry on the broader campaign) the Spectre RAT and additional PHP web shells, alongside attempted lateral movement over SMB/SSH.

On November 26-28, 2024, FoxIO's John Althouse and the Webscout research team analyzed a Sliver deployment left in its default configuration and used JA4H — a JA4+ suite fingerprint of the HTTP client derived from method/headers/cookies — to distinguish Sliver's stock HTTP C2 traffic from legitimate traffic. Because the operators never customized Sliver's default HTTP profile, the traffic exposed a stable, low-header-count fingerprint, default cookie names (`SSID`, `refreshToken`, `csrf-state`), a default listener on TCP/31337, and self-signed TLS certificates with Issuer CN="operators" / Subject CN="multiplayer" — all artifacts of an un-hardened Sliver install rather than of the PAN-OS vulnerabilities themselves. This entry documents the exploit chain used for initial access and the JA4H-based detection technique used to surface the resulting Sliver C2 activity; CVE-2024-0012 and CVE-2024-9474 were added to the CISA Known Exploited Vulnerabilities catalog on 2024-12-03 with a 2024-12-09 remediation deadline.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.008 OS Credential Dumping

Collection

T1005 Data from Local System; T1074.001 Data Staged; T1119 Automated Collection; T1560 Archive Collected Data

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1070.003 Indicator Removal; T1070.006 Indicator Removal

Execution

T1059.004 Unix Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port

Discovery

T1082 System Information Discovery

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1496 Resource Hijacking

Persistence

T1505.003 Web Shell

Remediation for Operation Lunar Peek Sliver C2

Patches

• PAN-OS 10.1.14-h6
• PAN-OS 10.2.12-h2
• PAN-OS 11.0.6-h1
• PAN-OS 11.1.5-h1
• PAN-OS 11.2.4-h1

Immediate actions

• Restrict the PAN-OS management web interface to trusted internal IP addresses; do not expose it to the internet
• Apply Palo Alto Threat Prevention IDs 95746, 95747, 95752, 95753, 95759, 95763 (requires Applications and Threats content v8915-9075 or later)
• Hunt HTTP/TLS traffic for JA4H fingerprint prefix po11cn050000_bb52516416a2_*, connections to TCP/31337, and TLS certificates with Issuer CN=operators / Subject CN=multiplayer
• Review firewall management-interface logs for requests containing a .js.map path suffix combined with the X-PAN-AUTHCHECK: off header

Workarounds

• Restrict management interface access to trusted internal IP addresses per Palo Alto best-practice deployment guidelines
• Disable internet-facing exposure of the management web interface

Longer-term hardening

• Patch PAN-OS to the fixed releases (10.1.14-h6+, 10.2.12-h2+, 11.0.6-h1+, 11.1.5-h1+, 11.2.4-h1+) or later maintenance releases
• Route management access exclusively through jump boxes or a dedicated dataplane management interface, never directly on the internet
• Deploy JA4H-capable, packet-level network detection — NetFlow metadata alone cannot distinguish default Sliver HTTP traffic from benign traffic

Affected and fixed versions

• Palo Alto Networks — PAN-OS
  Vulnerable versions: 10.1.0-10.1.14-h5; 10.2.0-10.2.12-h1; 11.0.0-11.0.6; 11.1.0-11.1.5; 11.2.0-11.2.4
  Fixed in: 10.1.14-h6; 10.2.12-h2; 11.0.6-h1; 11.1.5-h1; 11.2.4-h1
• Palo Alto Networks — PA-Series, VM-Series, CN-Series firewalls and Panorama (virtual and M-Series)
  Vulnerable versions: all PAN-OS versions above with internet-exposed management interface
  Fixed in: Cloud NGFW and Prisma Access are unaffected

Timeline of Operation Lunar Peek Sliver C2

Last updated 2026-10-19 · revalidated 1× · latest source

• 2024-11-18 Palo Alto Networks discloses CVE-2024-0012 (auth bypass, CVSS 9.8) and CVE-2024-9474 (privilege escalation, CVSS 7.2) and reports having already identified a limited number of exploitation attempts against management interfaces.
• 2024-11-19 watchTowr Labs publishes the technical exploit chain (X-PAN-AUTHCHECK header bypass via .js.map path suffix plus AuditLog.php command injection); Arctic Wolf begins observing active in-the-wild exploitation hours later.
• 2024-11-20 Arctic Wolf Labs publishes a bulletin documenting attackers using curl/wget on compromised firewalls to pull down payloads over HTTP.
• 2024-11-22 Arctic Wolf publishes its campaign report with IOCs, including the UPX-packed locked-ioc-34 implant (locked-ioc-36), locked-ioc-37 miners, an obfuscated PHP webshell, and post-exploitation collection of configs, /etc/passwd, /etc/shadow and SSH keys staged under locked-ioc-9, with bash history and timestamp tampering.
• 2024-11-22 Palo Alto Networks Unit 42 issues its last update to the "Operation Lunar Peek" threat brief, reporting obfuscated PHP web shell deployment, interactive command execution, and increasing payload diversity.
• 2024-11-26 FoxIO's John Althouse shares JA4H fingerprints for identifying the default-configuration locked-ioc-34 C2 HTTP traffic on the affected firewalls.
• 2024-11-28 Webscout publishes "Dissecting JA4H for improved locked-ioc-34 C2 detections," detailing locked-ioc-34's exposed default cookie names, TLS certificate CNs, TCP/31337 listener, and two C2 IP addresses.
• 2024-12-03 CISA adds CVE-2024-0012 and CVE-2024-9474 to the Known Exploited Vulnerabilities catalog with a remediation due date of 2024-12-09.
• 2024-12-09 CISA's KEV remediation deadline for federal agencies passes; Darktrace separately publishes its own analysis of the broader "Operation Lunar Peek" post-exploitation activity across its customer telemetry.

Update history

• 2026-10-19 — locked-ioc-34 C2 Infrastructure Detection via JA4H Fingerprints (Palo Alto CVE-2024-0012 / CVE-2024-9474 Exploitation): What changed No field escalation: severity, exploitability, status, CVSS and attribution are already at the same values in the existing record. New indicators (16) Indicator values are withheld at this access level. New MITRE (9) Adds T1068

Sources cited for Operation Lunar Peek Sliver C2

• CISA Adds Three Known Exploited Vulnerabilities to Catalog CISA · Government advisory · 2024-12-03
• Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474 labs.watchtowr.com · Research · 2024-11-19
• Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474 Unit 42 · Vendor report · 2024-11-22
• CVE-2024-0012 Security Advisory Palo Alto Networks · Vendor report · 2024-11-18
• CVE-2024-9474 Security Advisory Palo Alto Networks · Vendor report · 2024-11-18
• Dissecting JA4H for improved Sliver C2 detections blog.webscout.io · Blog · 2024-11-28
• Follow-Up: Arctic Wolf Observes Ongoing Exploitation of Critical Palo Alto Networks Vulnerability CVE-2024-0012 Chained with CVE-2024-9474 arcticwolf.com · Blog · 2024-11-20
• Darktrace's view on Operation Lunar Peek: Exploitation of Palo Alto firewall devices darktrace.com · Blog · 2024-12-09

Threats related to Operation Lunar Peek Sliver C2

• Hackers Target Zimbra Servers in Active Exploitation Campaign via CVE-2026-73570 SNMP Command Injection
• DPRK-Linked APT37 (Medium Confidence) Deploys Novel 'Ted' HAProxy Backdoor and 'CurlRAT'-Trojanized Linux Daemons Against South Korean Media and Automotive Sectors
• ACR Stealer (Amatera Stealer) Uses ClickFix Lures, WebDAV/pushd DLL Delivery, and EtherHiding to Harvest Browser and Microsoft 365 Data
• CVE-2026-54420 — LiteSpeed cPanel Plugin Symlink-Following (CWE-61) Privilege Escalation to Root on CloudLinux/CageFS Shared Hosting; Added to CISA KEV After In-the-Wild Exploitation
• ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials

Related coverage of this activity

• RufRoot Ruflo MCP bridge
• TONTOU Spectre v2 bypass
• Ollama VAPT LLMjacking pipeline
• Windu CMS unauthenticated SQLi
• UniFi Connect SAB-066 command injection