SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_1

rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_1 : FILE
{
	meta:
		description = "Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)"
		author = "X__Junior"
		id = "81daf184-4c38-5d84-899b-9d0de2f39934"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L18-L52"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "786951478a0fc5db24f6e1d8dcc5eaa8880dbd928da97828a61f1f1f0f21e21d"
		logic_hash = "481ddd570d0292036b421223ce0f839ece86cc1a97aa226a8b9fbd1d63905d1b"
		score = 75
		quality = 83
		tags = "FILE"

	strings:
		$sa1 = "<Thread type=\"AutoRun\" action=" ascii
		$sa2 = "<Mark date=" ascii
		$sa3 = "<Event>" ascii
		$sa4 = "<Command text" ascii
		$sb1 = "[System.Net.WebRequest]::create" ascii
		$sb2 = "Invoke-RestMethod" ascii
		$sb3 = "Invoke-WebRequest" ascii
		$sb4 = "iwr " ascii
		$sb5 = "Net.WebClient" ascii
		$sb6 = "Resume-BitsTransfer" ascii
		$sb7 = "Start-BitsTransfer" ascii
		$sb8 = "wget " ascii
		$sb9 = "WinHttp.WinHttpRequest" ascii
		$sb10 = ".DownloadFile(" ascii
		$sb11 = ".DownloadString(" ascii
		$sb12 = "Bypass" nocase ascii
		$sb13 = "-EncodedCommand" ascii
		$sb14 = "-windowstyle hidden" ascii
		$sb15 = " -enc " ascii

	condition:
		filesize < 1MB and all of ( $sa* ) and 1 of ( $sb* )
}