diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index 6e13c074ca..f4dba5c26b 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -1,7 +1,7 @@ name: Domain Group Discovery With Net id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 -version: 4 -date: '2024-11-26' +version: 5 +date: '2024-12-11' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -22,6 +22,7 @@ tags: - Prestige Ransomware - Graceful Wipe Out Attack - Rhysida Ransomware + - Cleo File Transfer Software asset_type: Endpoint confidence: 50 impact: 30 diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index f0af8c38bf..419a824738 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -1,7 +1,7 @@ name: Nishang PowershellTCPOneLine id: 1a382c6c-7c2e-11eb-ac69-acde48001122 -version: 4 -date: '2024-09-30' +version: 5 +date: '2024-12-11' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ drilldown_searches: tags: analytic_story: - HAFNIUM Group + - Cleo File Transfer Software asset_type: Endpoint confidence: 60 impact: 70 diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index fce99e05b2..4082dd1384 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -1,7 +1,7 @@ name: NLTest Domain Trust Discovery id: c3e05466-5f22-11eb-ae93-0242ac130002 -version: 4 -date: '2024-09-30' +version: 5 +date: '2024-12-11' author: Michael Haag, Splunk status: production type: TTP @@ -38,6 +38,7 @@ tags: - Active Directory Discovery - Qakbot - Rhysida Ransomware + - Cleo File Transfer Software asset_type: Endpoint confidence: 50 impact: 30 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 716d82a119..2d721ea6d0 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,7 +1,7 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 7 -date: '2024-10-17' +version: 8 +date: '2024-12-11' author: Michael Haag, Splunk status: production type: Hunting @@ -33,6 +33,7 @@ tags: - CISA AA24-241A - Braodo Stealer - Lumma Stealer + - Cleo File Transfer Software asset_type: Endpoint confidence: 100 impact: 80 diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index 6cf3344a8c..113eb03ccb 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -1,7 +1,7 @@ name: System Information Discovery Detection id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 -version: 5 -date: '2024-09-30' +version: 6 +date: '2024-12-11' author: Patrick Bareiss, Splunk status: production type: TTP @@ -29,6 +29,7 @@ tags: - Windows Discovery Techniques - Gozi Malware - BlackSuit Ransomware + - Cleo File Transfer Software asset_type: Windows confidence: 50 impact: 30 diff --git a/detections/endpoint/windows_java_spawning_shells.yml b/detections/endpoint/windows_java_spawning_shells.yml index 542814745e..bcee4e1dab 100644 --- a/detections/endpoint/windows_java_spawning_shells.yml +++ b/detections/endpoint/windows_java_spawning_shells.yml @@ -1,7 +1,7 @@ name: Windows Java Spawning Shells id: 28c81306-5c47-11ec-bfea-acde48001122 -version: 5 -date: '2024-10-17' +version: 6 +date: '2024-12-11' author: Michael Haag, Splunk status: experimental type: TTP @@ -24,6 +24,7 @@ tags: analytic_story: - Log4Shell CVE-2021-44228 - SysAid On-Prem Software CVE-2023-47246 Vulnerability + - Cleo File Transfer Software asset_type: Endpoint confidence: 50 cve: diff --git a/stories/cleo_file_transfer_software.yml b/stories/cleo_file_transfer_software.yml new file mode 100644 index 0000000000..1a107919a1 --- /dev/null +++ b/stories/cleo_file_transfer_software.yml @@ -0,0 +1,20 @@ +name: Cleo File Transfer Software +id: 058be65c-f007-4a3a-90f6-d2604f98a18b +version: 1 +date: '2024-12-11' +author: Michael Haag, Splunk +description: This analytic story addresses the exploitation of Cleo file transfer software products (LexiCom, VLTrader, and Harmony) through CVE-2024-50623. This vulnerability allows unauthenticated attackers to execute arbitrary system commands through the web interface, potentially leading to remote code execution and system compromise. +narrative: In December 2024, threat actors began actively exploiting a critical vulnerability (CVE-2024-50623) in Cleo's file transfer software suite. The vulnerability affects multiple Cleo products including LexiCom, VLTrader, and Harmony. Attackers can exploit this flaw to execute system commands without authentication through the web interface, typically leveraging PowerShell commands for payload delivery and execution. The exploitation often involves accessing the software's autorun functionality and web interface to deploy malicious commands, potentially leading to data theft, ransomware deployment, or establishment of persistent access. Common installation paths include C:\LexiCom, C:\VLTrader, and C:\Harmony, with critical activity logged in their respective XML log files. +references: +- https://www.rapid7.com/blog/post/2024/12/10/etr-widespread-exploitation-of-cleo-file-transfer-software-cve-2024-50623/ +- https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection + cve: + - CVE-2024-50623