SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_1

rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_1 : FILE
{
	meta:
		description = "Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)"
		author = "X__Junior"
		id = "b30ca09f-b84c-5de8-9bf7-9f3269f32c1f"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L112-L146"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "b103f708e85416fc6d7af9605da4b57b3abe42fb9c6c9ec0f539b4c877580bd2"
		logic_hash = "c9be15aec57fdde62815ee04daa5616940ab7949784d382a4825dce9f1e28568"
		score = 70
		quality = 83
		tags = "FILE"

	strings:
		$sa1 = "<Action actiontype=\"Commands\"" ascii
		$sa2 = "<?xml version=" ascii
		$sa3 = "<Runninglocalrequired>" ascii
		$sa4 = "<Autostartup>" ascii
		$sb1 = "[System.Net.WebRequest]::create" ascii
		$sb2 = "Invoke-RestMethod" ascii
		$sb3 = "Invoke-WebRequest" ascii
		$sb4 = "iwr " ascii
		$sb5 = "Net.WebClient" ascii
		$sb6 = "Resume-BitsTransfer" ascii
		$sb7 = "Start-BitsTransfer" ascii
		$sb8 = "wget " ascii
		$sb9 = "WinHttp.WinHttpRequest" ascii
		$sb10 = ".DownloadFile(" ascii
		$sb11 = ".DownloadString(" ascii
		$sb12 = "Bypass" nocase ascii
		$sb13 = "-EncodedCommand" ascii
		$sb14 = "-windowstyle hidden" ascii
		$sb15 = " -enc " ascii

	condition:
		filesize < 10KB and all of ( $sa* ) and 1 of ( $sb* )
}