huntrule

Malicious Command Shell Spawned by Wing FTP Server Process

PremiumReviewedSigma · High · v1
Category
process_creation
Author
HuntRule
Published
2026-05-28
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Initial Access → Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the Wing FTP server process WFTPServer.exe spawning cmd.exe or powershell.exe, the remote code execution chain Huntress observed during in-the-wild exploitation of CVE-2025-47812. Attackers abuse a null-byte and Lua injection flaw to run arbitrary commands as the FTP service. A command shell parented by the FTP server is rarely legitimate and is a high-confidence exploitation indicator.

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange
Malicious WSUS Service Spawning Command Shell via CVE-2025-59287 (via process_creation)
Malicious SharePoint w3wp Spawning Command Shell and PowerShell
Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell
Exchange Worker Process Spawning Command Shell via OWASSRF
Malicious IIS Worker Spawning nslookup via WS_FTP Deserialization
Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server
Suspicious SolarWinds Web Help Desk Java Process Spawning Command Shell (via process_creation)
MSSQL Server Process Spawning Command Shell via xp_cmdshell
Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)
Malicious Command Shell Spawned by Wing FTP Server Process
Pivot detection · T1059.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.