SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_3

rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_3 : FILE
{
	meta:
		description = "Detects characteristics of JAR files used during Cleo software exploitation"
		author = "X__Junior"
		id = "5c227bb9-0731-5955-a758-6fe86ecc2d86"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L267-L286"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "64a6194110d4eb359cc3f15137cf752d598f2f0a52ac181fcaa358bf40072f54"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$a1 = "java/lang/String" ascii
		$s1 = "#lsz#" ascii
		$s2 = "#dbg#" ascii
		$s3 = "#ll#" ascii
		$s4 = "SvZipDataOverflow=%d OpNotConf=" ascii

	condition:
		uint16( 0 ) == 0xfeca and filesize < 20KB and 3 of ( $s* ) and $a1
}