Phoenix
Sigma IntelligenceBeta
Emerging Threats
CVE2024

CVE-2024-50623

1Rules
1References
1Folders
2024-12-09Latest
Summary

CVE-2024-50623 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2024. Coverage centers on windows / process_creation.

Related Detections
Search this threat
Emerging Threathighexperimental

CVE-2024-50623 Exploitation Attempt - Cleo

Detects exploitation attempt of Cleo's CVE-2024-50623 by looking for a "cmd.exe" process spawning from the Celo software suite with suspicious Powershell commandline.

WindowsProcess Creation
TA0001 · Initial AccessTA0002 · ExecutionT1190 · Exploit Public-Facing Applicationcve.2024-50623+1
Tanner Filip+3Mon Dec 092024
References
1
Resolving title…
huntress.com