# JA4H Fingerprinting Detects Sliver C2 Deployed via Chained PAN-OS CVE-2024-0012/CVE-2024-9474 Exploitation

> Threat actors chained an unauthenticated PAN-OS management-interface authentication bypass (CVE-2024-0012, CVSS 9.8) with a command-injection privilege-escalation flaw (CVE-2024-9474, CVSS 7.2) to gain root on Palo Alto Networks firewalls and deploy the open-source Sliver C2 framework in its default configuration. Researchers used JA4H HTTP client fingerprinting to identify the unencrypted Sliver traffic, recovering distinct fingerprints, two C2 IP addresses, and Sliver's default cookie names and TLS certificate CNs.

- **Published:** 2026-08-25T00:00:00Z
- **Last reviewed:** 2026-10-19T17:23:21.545Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2144
- **ID:** TL-2026-2144
- **Severity:** HIGH (CVSS 9.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 37 (3 shown free below)
- **CVEs:** CVE-2024-0012, CVE-2024-9474

## Description

On November 18, 2024, Palo Alto Networks disclosed CVE-2024-0012, a missing-authentication vulnerability (CWE-306) in the PAN-OS management web interface that lets an unauthenticated network attacker obtain administrator privileges, and CVE-2024-9474, an OS command-injection flaw (CWE-78) that lets an authenticated administrator escalate to root. Palo Alto stated it had already identified a limited number of exploitation attempts against management interfaces at disclosure time. On November 19, 2024, watchTowr Labs published the technical mechanics of chaining the two bugs into unauthenticated remote code execution: appending a `/.js.map` or `/aaaa.js.map` suffix to a request path (e.g. `GET /php/ztp_gate.php/.js.map` with header `X-PAN-AUTHCHECK: off`) bypasses PAN-OS's authcheck enforcement because the underlying Nginx configuration only reset that header on specific routes; the attacker then POSTs a forged `user` parameter containing a backtick command substitution to `/php/utils/createRemoteAppwebSession.php`, which is later executed with root privileges when `AuditLog.php` shells out via `pan_elog` using the unsanitized username.

Within hours of the watchTowr writeup, Arctic Wolf Labs observed active in-the-wild exploitation, and Palo Alto Networks' Unit 42 tracked the resulting activity as "Operation Lunar Peek," attributing early scanning/exploitation traffic to IP space associated with anonymous VPN services but stopping short of actor attribution. Observed post-exploitation behavior included transferring obfuscated PHP web shells onto compromised firewalls, running interactive commands, exfiltrating configuration files, and — as the campaign matured over the following days — dropping an increasingly diverse set of payloads via `curl`/`wget`, including the open-source Sliver C2 framework (an alternative to Cobalt Strike, developed by Bishop Fox), cryptocurrency miners, and (per Darktrace's telemetry on the broader campaign) the Spectre RAT and additional PHP web shells, alongside attempted lateral movement over SMB/SSH.

On November 26-28, 2024, FoxIO's John Althouse and the Webscout research team analyzed a Sliver deployment left in its default configuration and used JA4H — a JA4+ suite fingerprint of the HTTP client derived from method/headers/cookies — to distinguish Sliver's stock HTTP C2 traffic from legitimate traffic. Because the operators never customized Sliver's default HTTP profile, the traffic exposed a stable, low-header-count fingerprint, default cookie names (`SSID`, `refreshToken`, `csrf-state`), a default listener on TCP/31337, and self-signed TLS certificates with Issuer CN="operators" / Subject CN="multiplayer" — all artifacts of an un-hardened Sliver install rather than of the PAN-OS vulnerabilities themselves. This entry documents the exploit chain used for initial access and the JA4H-based detection technique used to surface the resulting Sliver C2 activity; CVE-2024-0012 and CVE-2024-9474 were added to the CISA Known Exploited Vulnerabilities catalog on 2024-12-03 with a 2024-12-09 remediation deadline.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1082 System Information Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1496 Resource Hijacking
- T1068 Exploitation for Privilege Escalation
- T1105 Ingress Tool Transfer
- T1027 Obfuscated Files or Information
- T1070.003 Indicator Removal
- T1070.006 Indicator Removal
- T1003.008 OS Credential Dumping
- T1560 Archive Collected Data
- T1119 Automated Collection
- T1074.001 Data Staged

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PAN-OS X-PAN-AUTHCHECK Bypass via .js.map Path Suffix (CVE-2024-0012)** (`TL-2026-2144-SPL-001`)

Detects the unauthenticated auth-bypass request pattern used to chain into CVE-2024-9474: a request path ending in .js.map or /aaaa.js.map combined with the X-PAN-AUTHCHECK: off header against the PAN-OS management web interface (e.g. GET /php/ztp_gate.php/.js.map, POST /php/utils/createRemoteAppwebSession.php/aaaa.js.map). This is the initial-access trigger for the watchTowr-documented exploit chain that leads to root RCE via AuditLog.php.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.004
- **Data sources:** pan_log (paloalto:mgmt:access), pan:system, CommonSecurityLog (Palo Alto CEF feed)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=pan_log sourcetype="paloalto:mgmt:access" OR sourcetype="pan:system"
| eval uri=coalesce(uri_path, url, request_uri)
| eval authcheck_hdr=coalesce(http_header_x_pan_authcheck, header_x_pan_authcheck)
| where match(uri, "(?i)\.js\.map$") AND (like(uri, "%ztp_gate.php%") OR like(uri, "%createRemoteAppwebSession.php%") OR like(uri, "%/index.php%"))
| eval authcheck_off=if(match(lower(authcheck_hdr), "off"), 1, 0)
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as observed_paths values(src_ip) as src_ips by dest_ip, authcheck_off
| where authcheck_off=1 OR match(observed_paths, "(?i)aaaa\.js\.map")
| eval detection_id="TL-2026-2144-SPL-001"
| table detection_id, first_seen, last_seen, src_ips, dest_ip, observed_paths, count
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor == "Palo Alto Networks"
| extend RequestURI = tostring(RequestURL)
| extend AuthCheckHeader = tostring(AdditionalExtensions["X-PAN-AUTHCHECK"])
| where RequestURI matches regex @"(?i)\.js\.map$"
| where RequestURI has_any ("ztp_gate.php", "createRemoteAppwebSession.php", "index.php")
| where AuthCheckHeader =~ "off" or RequestURI has "aaaa.js.map"
| project TimeGenerated, SourceIP, DestinationIP, RequestURI, AuthCheckHeader, DeviceAction
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Paths=make_set(RequestURI), count() by SourceIP, DestinationIP
```

### Sigma

```yaml
title: PAN-OS Management Interface Auth Bypass via .js.map Suffix (CVE-2024-0012)
id: 7a2c1e4a-3f0e-4b7a-9d2c-9b1e0a5c7f21
status: experimental
description: Detects the X-PAN-AUTHCHECK header authcheck-bypass request pattern chained with a .js.map path suffix against PAN-OS management interface endpoints, the initial-access step of the CVE-2024-0012/CVE-2024-9474 exploit chain (Operation Lunar Peek).
references:
    - https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/
    - https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-26
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2024.0012
    - cve.2024.9474
    - detection.emerging-threats
logsource:
    category: proxy
    product: paloalto
detection:
    selection_path:
        cs-uri-stem|endswith: '.js.map'
        cs-uri-stem|contains:
            - 'ztp_gate.php'
            - 'createRemoteAppwebSession.php'
            - 'index.php'
    selection_header:
        cs-header-x-pan-authcheck: 'off'
    selection_aaaa:
        cs-uri-stem|contains: 'aaaa.js.map'
    condition: selection_path and (selection_header or selection_aaaa)
falsepositives:
    - Internal vulnerability scanning against the management interface using the published PoC (should be scoped/allow-listed)
level: critical
```

**Known false positives:**

- Authorized internal red-team/PoC validation replaying the watchTowr request pattern against a lab firewall
- Vulnerability scanners explicitly configured to test for CVE-2024-0012

**Tuning notes:** Scope dest_ip/DestinationIP to known PAN-OS management interface IPs to reduce noise from unrelated .js.map static-asset requests on other web stacks; exclude authorized scanner source IPs via a lookup table.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PAN-OS Legacy IE11 User-Agent Anomaly on Management Interface (locked: unlock with TL Creds)
- PAN-OS Ingress Tool Transfer — curl/wget Payload Delivery to Firewall Dataplane (locked: unlock with TL Creds)
- Sliver TLS Certificate CN=operators/multiplayer and Community-Corroborated C2 Infrastructure (locked: unlock with TL Creds)
- Obfuscated PHP Web Shell Drop on PAN-OS (T1505.003) (locked: unlock with TL Creds)
- Spectre RAT / [indicator] Dropper on Compromised PAN-OS Host (T1082/T1105) (locked: unlock with TL Creds)
- Sliver C2 Cookie-Based HTTP Beaconing (SSID/refreshToken/csrf-state) (locked: unlock with TL Creds)
- AuditLog.php Command Injection Root RCE Trigger (CVE-2024-9474) (locked: unlock with TL Creds)
- Default-Configuration Sliver C2 — JA4H Fingerprint and TCP/31337 Beacon (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 37)

Defanged, TLP:CLEAR.

- IP address: `172.232.195[.]234`
- Domain: `repositorylinux[.]org`
- File hash: `A3092BFA4199DEF7FC525465895EE3784C6FCF55F0A7E9C8436C027E0F41CB4B`

Full set of 37 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Dissecting JA4H for improved Sliver C2 detections](https://blog.webscout.io/dissecting-ja4h-for-improved-sliver-c2-detections/)
- [Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474](https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/)
- [Follow-Up: Arctic Wolf Observes Ongoing Exploitation of Critical Palo Alto Networks Vulnerability CVE-2024-0012 Chained with CVE-2024-9474](https://arcticwolf.com/resources/blog/follow-up-cve-2024-0012-cve-2024-9474/)
- [Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474](https://unit42.paloaltonetworks.com/cve-2024-0012-cve-2024-9474/)
- [Darktrace's view on Operation Lunar Peek: Exploitation of Palo Alto firewall devices](https://www.darktrace.com/blog/darktraces-view-on-operation-lunar-peek-exploitation-of-palo-alto-firewall-devices-cve-2024-2012-and-2024-9474)
- [CVE-2024-0012 Security Advisory](https://security.paloaltonetworks.com/CVE-2024-0012)
- [CVE-2024-9474 Security Advisory](https://security.paloaltonetworks.com/CVE-2024-9474)
- [CISA Adds Three Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2024/12/03/cisa-adds-three-known-exploited-vulnerabilities-catalog)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2144