Cleo Exploitation – Web App Spawning PowerShell / Java Dropper (CVE-2024-55956)

Ankit Mehta@Secvyn

•updated Aug 5, 2026•5•1•7

Detects the execution of PowerShell or Command Prompt initiated by specific integration or MFT (Managed File Transfer) software processes (e.g., Cleo, Harmony, VLTrader). The rule monitors for command-line arguments indicative of encoded commands, script execution, or base64 decoding, which may suggest malicious activity or lateral movement originating from an exposed or compromised integration server.