Windows Process Creation: Suspicious cmd.exe and PowerShell EncodedCommand from Cleo Java Components

Alerts on cmd.exe launching PowerShell encoded commands from Cleo javaw.exe components with .Download.

FreeUnreviewedSigmahighv1

windows-process-creation-suspicious-cmd-exe-and-powershell-encodedcommand-from-c-f007b877

title: "Windows Process Creation: Suspicious cmd.exe and PowerShell EncodedCommand from Cleo Java Components"
id: e15f0b57-6e37-45a6-a681-9c8af9f2c05c
status: experimental
description: This rule flags exploitation attempts where a cmd.exe process is spawned from javaw.exe associated with Cleo product components (Harmony, lexicom, VersaLex, or VLTrader). It focuses on cmd.exe command lines that include PowerShell and encoded execution indicators ( -enc / -EncodedCommand ) alongside a .Download string, which is consistent with staged payload retrieval. Detection relies on Windows process creation telemetry capturing parent image/command line and child process image/command line.
references:
  - https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-50623/proc_creation_win_exploit_cve_2024_50623_cleo.yml
author: Tanner Filip, Austin Worline, Chad Hudson, Matt Anderson, Huntrule Team
date: 2024-12-09
tags:
  - attack.initial-access
  - attack.execution
  - attack.t1190
  - cve.2024-50623
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \javaw.exe
    ParentCommandLine|contains:
      - Harmony
      - lexicom
      - VersaLex
      - VLTrader
    Image|endswith: \cmd.exe
    CommandLine|contains:
      - powershell
      - " -enc "
      - " -EncodedCommand"
      - .Download
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: f007b877-02e3-45b7-8501-1b78c2864029
    type: derived

What it detects

This rule flags exploitation attempts where a cmd.exe process is spawned from javaw.exe associated with Cleo product components (Harmony, lexicom, VersaLex, or VLTrader). It focuses on cmd.exe command lines that include PowerShell and encoded execution indicators ( -enc / -EncodedCommand ) alongside a .Download string, which is consistent with staged payload retrieval. Detection relies on Windows process creation telemetry capturing parent image/command line and child process image/command line.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.