Sigma rule: Potential Exploitation of GoAnywhere MFT Vulnerability

Rule

Title

Potential Exploitation of GoAnywhere MFT Vulnerability

Status

experimental

Level

high

Author

MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-10-07

File

rules-emerging-threats/2025/Exploits/CVE-2025-10035/proc_creation_win_exploit_cve_2025_10035.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035.
This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

Log source

product

windows

category

process_creation

Detection

# Detects the GoAnywhere Tomcat parent process based on path and command line arguments
selection_parent:
    ParentImage|contains: '\GoAnywhere\tomcat\'
selection_powershell_img:
    Image|endswith:
        - '\powershell.exe'
        - '\powershell_ise.exe'
        - '\pwsh.exe'
selection_powershell_cmd:
    - CommandLine|contains|all:
          - 'IEX'
          - 'enc'
          - 'Hidden'
          - 'bypass'
    - CommandLine|re:
          - 'net\s+user'
          - 'net\s+group'
          - 'query\s+session'
    - CommandLine|contains:
          - 'whoami'
          - 'systeminfo'
          - 'dsquery'
          - 'localgroup administrators'
          - 'nltest'
          - 'samaccountname='
          - 'adscredentials'
          - 'o365accountconfiguration'
          - '.DownloadString('
          - '.DownloadFile('
          - 'FromBase64String('
          - 'System.IO.Compression'
          - 'System.IO.MemoryStream'
          - 'curl'
selection_child_cmd:
    Image|endswith: '\cmd.exe'
    CommandLine|contains:
        - 'powershell'
        - 'whoami'
        - 'net.exe'
        - 'net1.exe'
        - 'rundll32'
        - 'quser'
        - 'nltest'
        - 'curl'
selection_child_others:
    CommandLine|contains:
        - 'bitsadmin'
        - 'certutil'
        - 'mshta'
        - 'cscript'
        - 'wscript'
condition: selection_parent and (all of selection_powershell_* or 1 of selection_child_*)

False positives (as the rule lists them)

• Legitimate administrative scripts or built-in GoAnywhere functions could potentially trigger this rule. Tuning may be required based on normal activity in your environment.

Tags

• attack.initial-access
• attack.t1190
• attack.execution
• attack.t1059.001
• attack.persistence
• attack.t1133
• detection.emerging-threats
• cve.2025-10035

CVEs this rule names

• CVE-2025-10035

MITRE ATT&CK ids this rule names

• T1059.001
• T1133
• T1190

References

• https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE-2025-10035/proc_creation_win_exploit_cve_2025_10035.yml