SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_2

rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_2 : FILE
{
	meta:
		description = "Detects characteristics of JAVA files used during Cleo software exploitation (as reported by Huntress in December 2024) - file Proc"
		author = "Florian Roth"
		id = "bd575454-7fd0-566d-94e5-ec1368675108"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L247-L265"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "1ba95af21bac45db43ebf02f87ecedde802c7de4d472f33e74ee0a5b5015a726"
		logic_hash = "2bb5eace09b832bf3ce296484f473c9c56f97b881ea17838408be6000cc6fcb1"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "Timeout getting pipe-data" ascii fullword
		$s2 = "Ftprootpath" ascii fullword
		$s3 = "Rest cmd=" ascii fullword
		$s4 = "writeToProc" ascii fullword

	condition:
		uint16( 0 ) == 0xfeca and filesize < 30KB and 3 of them
}