SIGNATURE_BASE_SUSP_EXPL_JAR_Indicators_Dec24

rule SIGNATURE_BASE_SUSP_EXPL_JAR_Indicators_Dec24 : FILE
{
	meta:
		description = "Detects characteristics of JAR files used during Cleo software exploitation (as reported by Huntress in December 2024)"
		author = "Florian Roth"
		id = "4e8f6aa8-9efd-5fcf-b795-5042d4ba1708"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L204-L222"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "8b87e7000ab5d9759f55660a085bf0f3dddb46ad1ea411cbbabce1000105ee9e"
		score = 70
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "TLS v3 " ascii
		$s2 = "java/util/Base64$Decoder" ascii
		$s3 = "AES/CBC/NoPadding" ascii
		$s4 = "getenv" ascii
		$s5 = "ava/util/zip/ZipInputStream" ascii

	condition:
		uint16( 0 ) == 0xfeca and filesize < 20KB and all of them
}