EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_2

rule EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_2 {
   meta:
      description = "Detects characteristics of JAVA files used during Cleo software exploitation (as reported by Huntress in December 2024) - file Proc"
      author = "Florian Roth"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      date = "2024-12-10"
      score = 75
      hash1 = "1ba95af21bac45db43ebf02f87ecedde802c7de4d472f33e74ee0a5b5015a726"
      id = "bd575454-7fd0-566d-94e5-ec1368675108"
   strings:
      $s1 = "Timeout getting pipe-data" ascii fullword
      $s2 = "Ftprootpath" ascii fullword
      $s3 = "Rest cmd=" ascii fullword
      $s4 = "writeToProc" ascii fullword
   condition:
      uint16(0) == 0xfeca
      and filesize < 30KB
      and 3 of them
}