SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_1_1

rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_1_1 : FILE
{
	meta:
		description = "Detects characteristics of JAVA files used during Cleo software exploitation (as reported by Huntress in December 2024) - files Cli, ScSlot, Slot, SrvSlot"
		author = "Florian Roth"
		id = "2940ddad-3dba-594a-9111-e4741d6ff39b"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L224-L245"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "0c57b317b572d071afd8ccdb844dd6f117e20f818c6031d7ba8adcbd32be0617"
		logic_hash = "85600e9310e502b3b2135f2f3cf698ae54fe362047cdf9d378dcc107e0c2fa18"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$a1 = "java/lang/StringBuffer"
		$x1 = "Start-Sleep 3;del " ascii
		$x2 = "sleep 3;rm -f '" ascii
		$x3 = "powershell -Noninteractive -EncodedCommand " ascii
		$x4 = "runDelFileCmd" ascii fullword

	condition:
		uint16( 0 ) == 0xfeca and filesize < 50KB and $a1 and 1 of ( $x* )
}