Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: Potential CVE-2024-50623 Exploitation via Cleo Webroot Upload
id: 9d821d8c-8617-4f82-b8e7-5a1b9a6fad0d
status: experimental
description: |
Detects potential exploitation of CVE-2024-50623 in Cleo Harmony, VLTrader, and LexiCom.
Threat actors exploit this unrestricted file upload vulnerability to write malicious files
(like JSP war shells or DLLs) into the Cleo webroot directory. This rule looks for HTTP POST
requests targeting known vulnerable endpoints, followed by HTTP GET requests to execute the
uploaded payload. CVSS 9.8 | KEV Status: Listed.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2024-50623
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.huntress.com/blog/cleo-vulnerability-exploitation-continues
date: 2026-08-15
author: SARA Detection Engineering
tags:
- attack.t1190
- attack.initial_access
- attack.t1505.003
logsource:
category: webserver
product:
detection:
selection_post:
cs-method: POST
cs-uri-stem|contains:
- '/Harmony/'
- '/VLTrader/'
- '/LexiCom/'
cs-uri-query|contains:
- 'action=PUT'
- 'fileUpload'
- 'uploadFile'
selection_get_exec:
cs-method: GET
cs-uri-stem|contains:
- '/Harmony/'
- '/VLTrader/'
- '/LexiCom/'
cs-uri-stem|endswith:
- '.jsp'
- '.war'
- '.dll'
filter_legit_upload:
cs-user-agent|contains:
- 'Cleo'
- 'VLTrader'
- 'Harmony'
sc-status:
- 200
- 201
condition: selection_post or (selection_get_exec and not filter_legit_upload)
fields:
- c-ip
- cs-method
- cs-uri-stem
- cs-uri-query
- cs-user-agent
- sc-status
falsepositives:
- Legitimate administrative file uploads to the Cleo web interface.
- Scheduled synchronization tasks using the Cleo client with valid authentication.
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →