CVE-2024-50623 Exploitation Attempt - Cleo Software

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•25

Detects exploitation attempts of CVE-2024-50623 in Cleo software by identifying `cmd.exe` processes spawned from `javaw.exe` (associated with Cleo applications like Harmony, Lexicom, VersaLex, or VLTrader) that execute PowerShell commands with suspicious arguments indicative of encoded commands or web downloads.