Sigma rule: Suspicious CrushFTP Child Process

Rule

Title

Suspicious CrushFTP Child Process

Status

experimental

Level

medium

Author

Craig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-04-10

File

rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as
CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests.
The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.

Log source

product

windows

category

process_creation

Detection

selection_parent:
    ParentImage|endswith: '\crushftpservice.exe'
selection_child:
    Image|endswith:
        - '\bash.exe'
        - '\cmd.exe'
        - '\cscript.exe'
        - '\mshta.exe'
        - '\powershell.exe'
        - '\powershell_ise.exe'
        - '\pwsh.exe'
        - '\sh.exe'
        - '\wscript.exe'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate CrushFTP administrative actions
• Software updates

Tags

• attack.initial-access
• attack.execution
• attack.t1059.001
• attack.t1059.003
• attack.t1190
• cve.2025-31161
• detection.emerging-threats

CVEs this rule names

• CVE-2025-31161

MITRE ATT&CK ids this rule names

• T1059.001
• T1059.003
• T1190

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-2825
• https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
• https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/
• https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis
• https://projectdiscovery.io/blog/crushftp-authentication-bypass

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml