SIGNATURE_BASE_EXPL_Cleo_Exploitation_Log_Indicators_Dec24

rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_Log_Indicators_Dec24 : SCRIPT
{
	meta:
		description = "Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)"
		author = "Florian Roth"
		id = "385042a9-fc8c-5b50-975f-3436a16e6861"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L2-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "a7e6713a08d7cce00cffba8daa12b251ccc12dc8d5a5f38d568bd5054e3783a2"
		score = 75
		quality = 85
		tags = "SCRIPT"

	strings:
		$x1 = "Note: Processing autorun file 'autorun\\health" ascii wide
		$x2 = "60282967-dc91-40ef-a34c-38e992509c2c.xml" ascii wide
		$x3 = "<Detail level=\"1\">Executing 'cmd.exe /c \"powershell -NonInteractive -EncodedCommand " ascii wide

	condition:
		1 of them
}