MDR insights: how our SOC identified & responded to CVE-2024-3400

**Executive summary:** The report documents active exploitation of CVE-2024-3400 in Palo Alto PAN-OS—an unauthenticated arbitrary file-creation and command-injection vulnerability—discovered and remediated by Expel; investigators unpacked a Sliver-based backdoor (dl.txt), observed outbound C2 connections and hourly cron persistence, and found log evidence across gpsvc.log, device_telemetry_send.log, mp-monitor.log, and syslog-system.log showing injected commands and established C2, with PAN advising immediate PAN-OS updates.