EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_1_1

rule EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_1_1 {
   meta:
      description = "Detects characteristics of JAVA files used during Cleo software exploitation (as reported by Huntress in December 2024) - files Cli, ScSlot, Slot, SrvSlot"
      author = "Florian Roth"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      date = "2024-12-10"
      score = 75
      hash1 = "0c57b317b572d071afd8ccdb844dd6f117e20f818c6031d7ba8adcbd32be0617"
      id = "2940ddad-3dba-594a-9111-e4741d6ff39b"
   strings:
      $a1 = "java/lang/StringBuffer"

      $x1 = "Start-Sleep 3;del " ascii
      $x2 = "sleep 3;rm -f '" ascii
      $x3 = "powershell -Noninteractive -EncodedCommand " ascii
      $x4 = "runDelFileCmd" ascii fullword
   condition:
      uint16(0) == 0xfeca
      and filesize < 50KB
      and $a1
      and 1 of ($x*)
}