Skip to content
skopnix
Section E · Detections · Rule
← Cortex XDR detectionsCortex XDR · CVE exploitation

CVE-2009-4202 exploitation attempt

XQLmediumconfidence 70/100generated 2026-10-18

Web request carrying the exploit observable of CVE-2009-4202 (public PoC), taken from the public nuclei template.

ATT&CK
T1190 mitre ↗
Correlation
set the rule's MITRE tactic to initial-access and technique to T1190
Linked CVE
CVE-2009-4202
Requires
PAN-OS URL filtering logs in Cortex (panw_ngfw_url_raw); HTTPS needs decryption
False positives
Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

XQL query

skopnix-cortex-cve-cve-2009-4202-7bf67f98.xqldownload .xql ↓
dataset = panw_ngfw_url_raw
| filter (uri contains "/index.php" and uri contains "../")
| fields _time, source_ip, dest_ip, url_domain, uri, url_category
| sort desc _time

How to deploy on Cortex XDR

  1. 1.Paste the XQL into Incident Response > Investigation > Query Builder > XQL Search.
  2. 2.To alert, save it as a Correlation Rule and set the MITRE tactic and technique printed with the rule.
  3. 3.Schedule it on the interval you hunt at; keep the fields stage for the alert's columns.

Check · CVE rules read PAN-OS URL logs (panw_ngfw_url_raw), which need the NGFW integration and, for HTTPS, decryption.

References