SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_1

rule SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_1 {
   meta:
      author = "X__Junior"
      description = "Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      hash1 = "786951478a0fc5db24f6e1d8dcc5eaa8880dbd928da97828a61f1f1f0f21e21d"
      date = "2024-12-10"
      score = 75
      id = "81daf184-4c38-5d84-899b-9d0de2f39934"
   strings:
      $sa1 = "<Thread type=\"AutoRun\" action=" ascii
      $sa2 = "<Mark date=" ascii
      $sa3 = "<Event>" ascii
      $sa4 = "<Command text" ascii

      $sb1 = "[System.Net.WebRequest]::create" ascii
      $sb2 = "Invoke-RestMethod" ascii
      $sb3 = "Invoke-WebRequest" ascii
      $sb4 = "iwr " ascii
      $sb5 = "Net.WebClient" ascii
      $sb6 = "Resume-BitsTransfer" ascii
      $sb7 = "Start-BitsTransfer" ascii
      $sb8 = "wget " ascii
      $sb9 = "WinHttp.WinHttpRequest" ascii
      $sb10 = ".DownloadFile(" ascii
      $sb11 = ".DownloadString(" ascii
      $sb12 = "Bypass" nocase ascii
      $sb13 = "-EncodedCommand" ascii
      $sb14 = "-windowstyle hidden" ascii
      $sb15 = " -enc " ascii
   condition:
      filesize < 1MB
      and all of ($sa*)
      and 1 of ($sb*)
}