SIGNATURE_BASE_EXPL_Cleo_Exploitation_PS1_Indicators_Dec24

rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_PS1_Indicators_Dec24 : SCRIPT
{
	meta:
		description = "Detects encoded and decoded PowerShell loader used during Cleo software exploitation (as reported by Huntress in December 2024)"
		author = "Florian Roth"
		id = "491cda57-0ad0-5ddc-90cb-48411eef2f2e"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L185-L202"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "87dcd0aa3c16d8948514b1d8589d38c6cc73bf7e6262f4517659cead16fedd3d"
		score = 75
		quality = 85
		tags = "SCRIPT"

	strings:
		$xe1 = "Start-Process -WindowStyle Hidden -FilePath jre\\bin\\java.exe" base64 ascii wide
		$xe2 = "$f=\"cleo." base64 ascii wide
		$xe3 = "<Detail level=\"1\">Executing 'cmd.exe /c \"powershell -NonInteractive -EncodedCommand " base64 ascii wide
		$x1 = "$f=\"cleo." ascii wide
		$x2 = "<Detail level=\"1\">Executing 'cmd.exe /c \"powershell -NonInteractive -EncodedCommand " ascii wide

	condition:
		1 of them
}