detection.wiki

Detection rules › Sigma

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)

Status
experimental
Severity
high
Log source
category process_creation, product windows
Author
Nisarg Suthar
Source
github.com/SigmaHQ/sigma

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Known false positives

  • Legitimate administrative command execution

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Execution
Privilege Escalation

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 1: Process creation
Security-AuditingEvent ID 4688: A new process has been created.

Rule body

title: Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)
id: 0fdc7c7f-c690-4217-9ae3-31f5156eed72
status: experimental
description: Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.
references:
    - https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/
    - https://pwn.guide/free/web/crushftp
    - https://firecompass.com/crushftp-vulnerability-cve-2025-54309-securing-file-transfer-services/
author: Nisarg Suthar
date: 2025-08-01
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - attack.t1068
    - attack.t1190
    - cve.2025-54309
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\crushftp.exe'
    selection_child_powershell:
        Image|endswith:
            - '\powershell.exe'
            - '\powershell_ise.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'IEX'
            - 'enc'
            - 'Hidden'
            - 'bypass'
    selection_child_cmd:
        Image|endswith: '\cmd.exe'
        CommandLine|contains:
            - '/c powershell'
            - 'whoami'
            - 'net.exe'
            - 'net1.exe'
    selection_child_others:
        Image|endswith:
            - '\bitsadmin.exe'
            - '\certutil.exe'
            - '\mshta.exe'
            - '\cscript.exe'
            - '\wscript.exe'
    condition: selection_parent and 1 of selection_child_*
falsepositives:
    - Legitimate administrative command execution
level: high

Stages and Predicates

Stage 0: condition

selection_parent and 1 of selection_child_*

Stage 1: selection_parent

selection_parent:
    ParentImage|endswith: '\crushftp.exe'

Stage 2: selection_child_powershell

selection_child_powershell:
    Image|endswith:
        - '\powershell.exe'
        - '\powershell_ise.exe'
        - '\pwsh.exe'
    CommandLine|contains|all:
        - 'IEX'
        - 'enc'
        - 'Hidden'
        - 'bypass'

Stage 3: selection_child_cmd

selection_child_cmd:
    Image|endswith: '\cmd.exe'
    CommandLine|contains:
        - '/c powershell'
        - 'whoami'
        - 'net.exe'
        - 'net1.exe'

Stage 4: selection_child_others

selection_child_others:
    Image|endswith:
        - '\bitsadmin.exe'
        - '\certutil.exe'
        - '\mshta.exe'
        - '\cscript.exe'
        - '\wscript.exe'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • /c powershell corpus 3 (sigma 3)
  • Hidden corpus 4 (sigma 4)
  • IEX corpus 6 (sigma 5, splunk 1)
  • bypass corpus 6 (sigma 6)
  • enc corpus 3 (sigma 3)
  • net.exe corpus 3 (sigma 2, splunk 1)
  • net1.exe corpus 2 (sigma 2)
  • whoami corpus 16 (sigma 9, elastic 4, splunk 2, kusto 1)
field:"CommandLine" kind:match
Imageends_with
  • \bitsadmin.exe corpus 29 (sigma 29)
  • \certutil.exe corpus 44 (sigma 43, kusto 1)
  • \cmd.exe corpus 130 (sigma 130)
  • \cscript.exe corpus 72 (sigma 72)
  • \mshta.exe corpus 66 (sigma 66)
  • \powershell.exe corpus 179 (sigma 178, kusto 1)
  • \powershell_ise.exe corpus 41 (sigma 41)
  • \pwsh.exe corpus 165 (sigma 164, kusto 1)
  • \wscript.exe corpus 74 (sigma 74)
field:"Image" kind:ends_with
ParentImageends_with
  • \crushftp.exe
field:"ParentImage" kind:ends_with value:"\crushftp.exe"