Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_2

Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
X__Junior
Date
2024-12-10
Modified
2024-12-12
Score / Quality
70 / 85

What this rule detects

Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)

It defines 20 patterns (20 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
susp-expl-cleo-exploitation-xml-indicators-dec24-2.yarDetection Rule License 1.1
rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_2 : FILE
{
	meta:
		description = "Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)"
		author = "X__Junior"
		id = "a71c71f3-d36f-5c27-b150-e678bccf2dba"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L148-L183"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "60e53c8d99fde8c48bff67408605aa69c3c1fe3040ba4f9d2080980df970aa93"
		score = 70
		quality = 85
		tags = "FILE"

	strings:
		$sa1 = "<Action actiontype=\"Commands\"" ascii
		$sa2 = "<?xml version=" ascii
		$sa3 = "<Runninglocalrequired>" ascii
		$sa4 = "<Autostartup>" ascii
		$sb1 = "wscript" ascii
		$sb2 = "cscript" ascii
		$sb3 = "mshta" ascii
		$sb4 = "certutil" ascii
		$sb5 = "pwsh" ascii
		$sb6 = "curl" ascii
		$sb7 = "msiexec" ascii
		$sb8 = "taskkill" ascii
		$sb9 = "regsvr32" ascii
		$sb10 = "rundll32" ascii
		$sb11 = "bitsadmin" ascii
		$sb12 = "whoami" ascii
		$sb13 = "bcdedit" ascii
		$sb14 = "systeminfo" ascii
		$sb15 = "reg " ascii
		$sb16 = "schtasks" ascii

	condition:
		filesize < 10KB and all of ( $sa* ) and 1 of ( $sb* )
}

Strings (20 patterns)

IdentifierTypeValueModifiers
$sa1text"<Action actiontype=\"Commands\""ascii
$sa2text"<?xml version="ascii
$sa3text"<Runninglocalrequired>"ascii
$sa4text"<Autostartup>"ascii
$sb1text"wscript"ascii
$sb2text"cscript"ascii
$sb3text"mshta"ascii
$sb4text"certutil"ascii
$sb5text"pwsh"ascii
$sb6text"curl"ascii
$sb7text"msiexec"ascii
$sb8text"taskkill"ascii
$sb9text"regsvr32"ascii
$sb10text"rundll32"ascii
$sb11text"bitsadmin"ascii
$sb12text"whoami"ascii
$sb13text"bcdedit"ascii
$sb14text"systeminfo"ascii
$sb15text"reg "ascii
$sb16text"schtasks"ascii

Condition

filesize < 10KB and all of ( $sa* ) and 1 of ( $sb* )

In plain words (Heuristic)

  • The file must be smaller than 10KB (a cheap guard that skips large files).
  • All patterns in ( $sa* ) must match.
  • At least 1 patterns in ( $sb* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: X__Junior

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: a71c71f3-d36f-5c27-b150-e678bccf2dba

Tags:FILE

Related rules