CrushFTP service spawning suspicious script and shell child processes on Windows

Alerts when CrushFTP service (crushftpservice.exe) launches shell/script executables like PowerShell, cmd, mshta, or bash.

FreeUnreviewedSigmamediumv1

crushftp-service-spawning-suspicious-script-and-shell-child-processes-on-windows-459628e3

title: CrushFTP service spawning suspicious script and shell child processes on Windows
id: 10049406-5ffe-4327-a4ff-791ca9815417
status: experimental
description: This rule flags Windows process creation where a CrushFTP service process spawns a commonly abused command interpreter or script host (e.g., PowerShell, cmd.exe, mshta.exe, cscript/wscript, bash). Such child processes can indicate post-compromise command execution following exploitation of CrushFTP. It relies on process creation telemetry, specifically matching parent and child executable paths by filename suffixes.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-2825
  - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
  - https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/
  - https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis
  - https://projectdiscovery.io/blog/crushftp-authentication-bypass
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml
author: Craig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-10
tags:
  - attack.initial-access
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1190
  - cve.2025-31161
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \crushftpservice.exe
  selection_child:
    Image|endswith:
      - \bash.exe
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \powershell_ise.exe
      - \pwsh.exe
      - \sh.exe
      - \wscript.exe
  condition: all of selection_*
falsepositives:
  - Legitimate CrushFTP administrative actions
  - Software updates
level: medium
license: DRL-1.1
related:
  - id: 459628e3-1b00-4e9b-9e5b-7da8961aea35
    type: derived

What it detects

This rule flags Windows process creation where a CrushFTP service process spawns a commonly abused command interpreter or script host (e.g., PowerShell, cmd.exe, mshta.exe, cscript/wscript, bash). Such child processes can indicate post-compromise command execution following exploitation of CrushFTP. It relies on process creation telemetry, specifically matching parent and child executable paths by filename suffixes.

Known false positives

Legitimate CrushFTP administrative actions
Software updates

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.