Windows Process Creation: GoAnywhere child command execution indicating possible MFT exploitation

Flags Windows process trees where GoAnywhere Tomcat spawns suspicious cmd/PowerShell command lines consistent with exploitation activity.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-10-07
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1133External Remote Services
- T1190Exploit Public-Facing Application
Execution
- T1059.001PowerShell
Persistence
- T1133External Remote Services
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags suspicious command execution spawned by child processes of the GoAnywhere Managed File Transfer (MFT) Tomcat process. It matters because exploitation or post-exploitation activity may run discovery and credential/command-and-control related commands via PowerShell and common Windows utilities. The detection relies on Windows process creation telemetry, including parent/child image paths, command-line arguments, and process relationships.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)

Suspicious Cleo Autorun Health Check File Drop (via file_event)

Obfuscated IIS Worker Spawning Encoded PowerShell after SharePoint ToolShell (via process_creation)

Malicious WSUS Service Spawning Command Shell via Remote Code Execution

Malicious PowerShell Spawned by IIS Worker Process via OWASSRF Exchange Exploitation (via process_creation)

Suspicious Child Process Spawned From Java Following Web Exploitation

Suspicious IIS Worker Process Spawning Encoded PowerShell via Gladinet Exploitation

MSSQL Server Process Spawning Command Shell via xp_cmdshell

Windows Process Creation: GoAnywhere child command execution indicating possible MFT exploitation

Pivot detection · T1059.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-goanywhere-mft-exploitation-suspicious-powershell-and-cmd-child-process--6c76b3d0

title: "Windows Process Creation: GoAnywhere child command execution indicating possible MFT exploitation"
id: da6f9601-94b8-49d7-8021-8a0bcca3ee3c
status: experimental
description: This rule flags suspicious command execution spawned by child processes of the GoAnywhere Managed File Transfer (MFT) Tomcat process. It matters because exploitation or post-exploitation activity may run discovery and credential/command-and-control related commands via PowerShell and common Windows utilities. The detection relies on Windows process creation telemetry, including parent/child image paths, command-line arguments, and process relationships.
references:
  - https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-10035/proc_creation_win_exploit_cve_2025_10035.yml
author: MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-07
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
  - attack.persistence
  - attack.t1133
  - detection.emerging-threats
  - cve.2025-10035
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: \GoAnywhere\tomcat\
  selection_powershell_img:
    Image|endswith:
      - \powershell.exe
      - \powershell_ise.exe
      - \pwsh.exe
  selection_powershell_cmd:
    - CommandLine|contains|all:
        - IEX
        - enc
        - Hidden
        - bypass
    - CommandLine|re:
        - net\s+user
        - net\s+group
        - query\s+session
    - CommandLine|contains:
        - whoami
        - systeminfo
        - dsquery
        - localgroup administrators
        - nltest
        - samaccountname=
        - adscredentials
        - o365accountconfiguration
        - .DownloadString(
        - .DownloadFile(
        - FromBase64String(
        - System.IO.Compression
        - System.IO.MemoryStream
        - curl
  selection_child_cmd:
    Image|endswith: \cmd.exe
    CommandLine|contains:
      - powershell
      - whoami
      - net.exe
      - net1.exe
      - rundll32
      - quser
      - nltest
      - curl
  selection_child_others:
    CommandLine|contains:
      - bitsadmin
      - certutil
      - mshta
      - cscript
      - wscript
  condition: selection_parent and (all of selection_powershell_* or 1 of selection_child_*)
falsepositives:
  - Legitimate administrative scripts or built-in GoAnywhere functions could potentially trigger this rule. Tuning may be required based on normal activity in your environment.
level: high
license: DRL-1.1
related:
  - id: 6c76b3d0-afe4-4870-9443-ffe6773c5fef
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL