Sigma rule: Suspicious Process Spawned by CentreStack Portal AppPool

Rule

Title

Suspicious Process Spawned by CentreStack Portal AppPool

Status

experimental

Level

high

Author

Jason Rathbun (Blackpoint Cyber)

Date

2025-04-17

File

rules-emerging-threats/2025/Exploits/CVE-2025-30406/proc_creation_win_exploit_cve_2025_30406_centrestack_portal_child_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

Log source

product

windows

category

process_creation

Detection

selection:
    ParentImage|endswith: '\w3wp.exe'
    ParentCommandLine|contains: '\portal\portal.config'
    Image|endswith: '\cmd.exe'
condition: selection

False positives (as the rule lists them)

• Potentially if other portal services run on w3wp with a apppool\portal\portal.config, if you want to increase scope you could add user IIS APPPOOL\portal.

Tags

• attack.persistence
• attack.execution
• attack.t1059.003
• attack.t1505.003
• cve.2025-30406
• detection.emerging-threats

CVEs this rule names

• CVE-2025-30406

MITRE ATT&CK ids this rule names

• T1059.003
• T1505.003

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-30406
• https://blackpointcyber.com/blog/racing-to-exploit-centrestacks-cve-2025-30406/
• https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf
• https://www.bleepingcomputer.com/news/security/centrestack-rce-exploited-as-zero-day-to-breach-file-sharing-servers/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE-2025-30406/proc_creation_win_exploit_cve_2025_30406_centrestack_portal_child_process.yml