From 486e2485a6ef13c514837a09b09f7f0232c3234e Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 11 Dec 2024 12:42:58 -0700 Subject: [PATCH 1/3] The Haag Papyrus: Secrets of Cleo Tagged content for Cleo Software CVE-2024-50623 --- ...ious_powershell_command_line_arguments.yml | 1 + .../domain_group_discovery_with_net.yml | 1 + .../endpoint/nishang_powershelltcponeline.yml | 1 + .../nltest_domain_trust_discovery.yml | 1 + .../endpoint/powershell_4104_hunting.yml | 1 + ...system_information_discovery_detection.yml | 1 + .../endpoint/windows_java_spawning_shells.yml | 1 + stories/cleo_file_transfer_software.yml | 20 +++++++++++++++++++ 8 files changed, 27 insertions(+) create mode 100644 stories/cleo_file_transfer_software.yml diff --git a/detections/deprecated/suspicious_powershell_command_line_arguments.yml b/detections/deprecated/suspicious_powershell_command_line_arguments.yml index 29dc289399..ae0df8155c 100644 --- a/detections/deprecated/suspicious_powershell_command_line_arguments.yml +++ b/detections/deprecated/suspicious_powershell_command_line_arguments.yml @@ -37,6 +37,7 @@ tags: - Malicious PowerShell - Hermetic Wiper - CISA AA22-320A + - Cleo File Transfer Software asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index 6e13c074ca..2ba085d0fd 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -22,6 +22,7 @@ tags: - Prestige Ransomware - Graceful Wipe Out Attack - Rhysida Ransomware + - Cleo File Transfer Software asset_type: Endpoint confidence: 50 impact: 30 diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index f0af8c38bf..f2fe5dbe1f 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -30,6 +30,7 @@ drilldown_searches: tags: analytic_story: - HAFNIUM Group + - Cleo File Transfer Software asset_type: Endpoint confidence: 60 impact: 70 diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index fce99e05b2..1b23943079 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -38,6 +38,7 @@ tags: - Active Directory Discovery - Qakbot - Rhysida Ransomware + - Cleo File Transfer Software asset_type: Endpoint confidence: 50 impact: 30 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 716d82a119..8ad08e7357 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -33,6 +33,7 @@ tags: - CISA AA24-241A - Braodo Stealer - Lumma Stealer + - Cleo File Transfer Software asset_type: Endpoint confidence: 100 impact: 80 diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index 6cf3344a8c..337d5c21b5 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -29,6 +29,7 @@ tags: - Windows Discovery Techniques - Gozi Malware - BlackSuit Ransomware + - Cleo File Transfer Software asset_type: Windows confidence: 50 impact: 30 diff --git a/detections/endpoint/windows_java_spawning_shells.yml b/detections/endpoint/windows_java_spawning_shells.yml index 542814745e..28f19a6672 100644 --- a/detections/endpoint/windows_java_spawning_shells.yml +++ b/detections/endpoint/windows_java_spawning_shells.yml @@ -24,6 +24,7 @@ tags: analytic_story: - Log4Shell CVE-2021-44228 - SysAid On-Prem Software CVE-2023-47246 Vulnerability + - Cleo File Transfer Software asset_type: Endpoint confidence: 50 cve: diff --git a/stories/cleo_file_transfer_software.yml b/stories/cleo_file_transfer_software.yml new file mode 100644 index 0000000000..1a107919a1 --- /dev/null +++ b/stories/cleo_file_transfer_software.yml @@ -0,0 +1,20 @@ +name: Cleo File Transfer Software +id: 058be65c-f007-4a3a-90f6-d2604f98a18b +version: 1 +date: '2024-12-11' +author: Michael Haag, Splunk +description: This analytic story addresses the exploitation of Cleo file transfer software products (LexiCom, VLTrader, and Harmony) through CVE-2024-50623. This vulnerability allows unauthenticated attackers to execute arbitrary system commands through the web interface, potentially leading to remote code execution and system compromise. +narrative: In December 2024, threat actors began actively exploiting a critical vulnerability (CVE-2024-50623) in Cleo's file transfer software suite. The vulnerability affects multiple Cleo products including LexiCom, VLTrader, and Harmony. Attackers can exploit this flaw to execute system commands without authentication through the web interface, typically leveraging PowerShell commands for payload delivery and execution. The exploitation often involves accessing the software's autorun functionality and web interface to deploy malicious commands, potentially leading to data theft, ransomware deployment, or establishment of persistent access. Common installation paths include C:\LexiCom, C:\VLTrader, and C:\Harmony, with critical activity logged in their respective XML log files. +references: +- https://www.rapid7.com/blog/post/2024/12/10/etr-widespread-exploitation-of-cleo-file-transfer-software-cve-2024-50623/ +- https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection + cve: + - CVE-2024-50623 From 14b59a6610f421d3f0c3e30736fd1001c050eded Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 11 Dec 2024 12:49:52 -0700 Subject: [PATCH 2/3] versions --- .../deprecated/suspicious_powershell_command_line_arguments.yml | 2 +- detections/endpoint/domain_group_discovery_with_net.yml | 2 +- detections/endpoint/nishang_powershelltcponeline.yml | 2 +- detections/endpoint/nltest_domain_trust_discovery.yml | 2 +- detections/endpoint/powershell_4104_hunting.yml | 2 +- detections/endpoint/system_information_discovery_detection.yml | 2 +- detections/endpoint/windows_java_spawning_shells.yml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/detections/deprecated/suspicious_powershell_command_line_arguments.yml b/detections/deprecated/suspicious_powershell_command_line_arguments.yml index ae0df8155c..5ab3213a5f 100644 --- a/detections/deprecated/suspicious_powershell_command_line_arguments.yml +++ b/detections/deprecated/suspicious_powershell_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Suspicious Powershell Command-Line Arguments id: 2cdb91d2-542c-497f-b252-be495e71f38c -version: 8 +version: 9 date: '2024-10-17' author: David Dorsey, Splunk status: deprecated diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index 2ba085d0fd..32f040cf03 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -1,6 +1,6 @@ name: Domain Group Discovery With Net id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 -version: 4 +version: 5 date: '2024-11-26' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index f2fe5dbe1f..c215080e2b 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -1,6 +1,6 @@ name: Nishang PowershellTCPOneLine id: 1a382c6c-7c2e-11eb-ac69-acde48001122 -version: 4 +version: 5 date: '2024-09-30' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 1b23943079..0248199d7f 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -1,6 +1,6 @@ name: NLTest Domain Trust Discovery id: c3e05466-5f22-11eb-ae93-0242ac130002 -version: 4 +version: 5 date: '2024-09-30' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 8ad08e7357..5eea973b28 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,6 +1,6 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 7 +version: 8 date: '2024-10-17' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index 337d5c21b5..ab7d28539f 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -1,6 +1,6 @@ name: System Information Discovery Detection id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 -version: 5 +version: 6 date: '2024-09-30' author: Patrick Bareiss, Splunk status: production diff --git a/detections/endpoint/windows_java_spawning_shells.yml b/detections/endpoint/windows_java_spawning_shells.yml index 28f19a6672..752d7556b9 100644 --- a/detections/endpoint/windows_java_spawning_shells.yml +++ b/detections/endpoint/windows_java_spawning_shells.yml @@ -1,6 +1,6 @@ name: Windows Java Spawning Shells id: 28c81306-5c47-11ec-bfea-acde48001122 -version: 5 +version: 6 date: '2024-10-17' author: Michael Haag, Splunk status: experimental From f9ff3fb22f3e262fc400fc8ae42465e779421ad8 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 11 Dec 2024 12:56:41 -0700 Subject: [PATCH 3/3] dates and removal --- .../suspicious_powershell_command_line_arguments.yml | 3 +-- detections/endpoint/domain_group_discovery_with_net.yml | 2 +- detections/endpoint/nishang_powershelltcponeline.yml | 2 +- detections/endpoint/nltest_domain_trust_discovery.yml | 2 +- detections/endpoint/powershell_4104_hunting.yml | 2 +- detections/endpoint/system_information_discovery_detection.yml | 2 +- detections/endpoint/windows_java_spawning_shells.yml | 2 +- 7 files changed, 7 insertions(+), 8 deletions(-) diff --git a/detections/deprecated/suspicious_powershell_command_line_arguments.yml b/detections/deprecated/suspicious_powershell_command_line_arguments.yml index 5ab3213a5f..29dc289399 100644 --- a/detections/deprecated/suspicious_powershell_command_line_arguments.yml +++ b/detections/deprecated/suspicious_powershell_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Suspicious Powershell Command-Line Arguments id: 2cdb91d2-542c-497f-b252-be495e71f38c -version: 9 +version: 8 date: '2024-10-17' author: David Dorsey, Splunk status: deprecated @@ -37,7 +37,6 @@ tags: - Malicious PowerShell - Hermetic Wiper - CISA AA22-320A - - Cleo File Transfer Software asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index 32f040cf03..f4dba5c26b 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -1,7 +1,7 @@ name: Domain Group Discovery With Net id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 version: 5 -date: '2024-11-26' +date: '2024-12-11' author: Mauricio Velazco, Splunk status: production type: Hunting diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index c215080e2b..419a824738 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -1,7 +1,7 @@ name: Nishang PowershellTCPOneLine id: 1a382c6c-7c2e-11eb-ac69-acde48001122 version: 5 -date: '2024-09-30' +date: '2024-12-11' author: Michael Haag, Splunk status: production type: TTP diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 0248199d7f..4082dd1384 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -1,7 +1,7 @@ name: NLTest Domain Trust Discovery id: c3e05466-5f22-11eb-ae93-0242ac130002 version: 5 -date: '2024-09-30' +date: '2024-12-11' author: Michael Haag, Splunk status: production type: TTP diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 5eea973b28..2d721ea6d0 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,7 +1,7 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 version: 8 -date: '2024-10-17' +date: '2024-12-11' author: Michael Haag, Splunk status: production type: Hunting diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index ab7d28539f..113eb03ccb 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -1,7 +1,7 @@ name: System Information Discovery Detection id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 version: 6 -date: '2024-09-30' +date: '2024-12-11' author: Patrick Bareiss, Splunk status: production type: TTP diff --git a/detections/endpoint/windows_java_spawning_shells.yml b/detections/endpoint/windows_java_spawning_shells.yml index 752d7556b9..bcee4e1dab 100644 --- a/detections/endpoint/windows_java_spawning_shells.yml +++ b/detections/endpoint/windows_java_spawning_shells.yml @@ -1,7 +1,7 @@ name: Windows Java Spawning Shells id: 28c81306-5c47-11ec-bfea-acde48001122 version: 6 -date: '2024-10-17' +date: '2024-12-11' author: Michael Haag, Splunk status: experimental type: TTP