SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_2

rule SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_2 {
   meta:
      author = "X__Junior"
      description = "Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)"
      reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
      date = "2024-12-10"
      score = 70
      id = "d215d4a0-1726-58d4-90df-8ec6102effe1"
   strings:
      $sa1 = "<Thread type=\"AutoRun\" action=" ascii
      $sa2 = "<Mark date=" ascii
      $sa3 = "<Event>" ascii
      $sa4 = "<Command text" ascii

      $sb1 = "wscript" ascii
      $sb2 = "cscript" ascii
      $sb3 = "mshta" ascii
      $sb4 = "certutil" ascii
      $sb5 = "pwsh" ascii
      $sb6 = "curl" ascii
      $sb7 = "msiexec" ascii
      $sb8 = "taskkill" ascii
      $sb9 = "regsvr32" ascii
      $sb10 = "rundll32" ascii
      $sb11 = "bitsadmin" ascii
      $sb12 = "whoami" ascii
      $sb13 = "bcdedit" ascii
      $sb14 = "systeminfo" ascii
      $sb15 = "reg " ascii
      $sb16 = "schtasks" ascii
      // $sb17 = "query" ascii
   condition:
      filesize < 1MB
      and all of ($sa*)
      and 1 of ($sb*)
}