Windows: Suspicious child processes spawned by CrushFTP service

Alerts when CrushFTP service (crushftpservice.exe) launches shell/script executables like PowerShell, cmd, mshta, or bash.

FreeReviewedSigma · Medium · v5

Product: windows
Category: process_creation
Author: Craig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-04-10
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Execution

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
- T1059.001PowerShell
- T1059.003Windows Command Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where the parent process is CrushFTP’s service executable and the child process matches a set of commonly abused command/interpreter binaries. Such activity may indicate post-compromise command execution following exploitation or abuse of the CrushFTP service. The detection relies on process creation telemetry capturing the parent image path and the child image path.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

MSSQL Server Process Spawning Command Shell via xp_cmdshell

Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)

Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution

Windows Process Creation: Java exploitation chain targeting Zoho ManageEngine Desktop Central (CVE-2020-10189)

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

Malicious IIS Worker Spawning nslookup via WS_FTP Deserialization

Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)

Suspicious Cleo Autorun Health Check File Drop (via file_event)

Obfuscated IIS Worker Spawning Encoded PowerShell after SharePoint ToolShell (via process_creation)

Windows: Suspicious child processes spawned by CrushFTP service

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

crushftp-service-spawning-suspicious-script-and-shell-child-processes-on-windows-459628e3

title: "Windows: Suspicious child processes spawned by CrushFTP service"
id: 10049406-5ffe-4327-a4ff-791ca9815417
status: experimental
description: This rule flags Windows process creation events where the parent process is CrushFTP’s service executable and the child process matches a set of commonly abused command/interpreter binaries. Such activity may indicate post-compromise command execution following exploitation or abuse of the CrushFTP service. The detection relies on process creation telemetry capturing the parent image path and the child image path.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-2825
  - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
  - https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/
  - https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis
  - https://projectdiscovery.io/blog/crushftp-authentication-bypass
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml
author: Craig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-10
tags:
  - attack.initial-access
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1190
  - cve.2025-31161
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \crushftpservice.exe
  selection_child:
    Image|endswith:
      - \bash.exe
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \powershell_ise.exe
      - \pwsh.exe
      - \sh.exe
      - \wscript.exe
  condition: all of selection_*
falsepositives:
  - Legitimate CrushFTP administrative actions
  - Software updates
level: medium
license: DRL-1.1
related:
  - id: 459628e3-1b00-4e9b-9e5b-7da8961aea35
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL