EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_3

rule EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_3 {
   meta:
      description = "Detects characteristics of JAR files used during Cleo software exploitation"
      author = "X__Junior"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      date = "2024-12-10"
      score = 75
      id = "5c227bb9-0731-5955-a758-6fe86ecc2d86"
   strings:
      $a1 = "java/lang/String" ascii

      $s1 = "#lsz#" ascii
      $s2 = "#dbg#" ascii
      $s3 = "#ll#" ascii
      $s4 = "SvZipDataOverflow=%d OpNotConf=" ascii
   condition:
      uint16(0) == 0xfeca
      and filesize < 20KB
      and 3 of ($s*) and $a1
}