Windows Process Creation: GoAnywhere child command execution indicating possible MFT exploitation

Flags Windows process trees where GoAnywhere Tomcat spawns suspicious cmd/PowerShell command lines consistent with exploitation activity.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-10-07
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1133External Remote Services
- T1190Exploit Public-Facing Application
Execution
- T1059.001PowerShell
Persistence
- T1133External Remote Services
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags suspicious command execution spawned by child processes of the GoAnywhere Managed File Transfer (MFT) Tomcat process. It matters because exploitation or post-exploitation activity may run discovery and credential/command-and-control related commands via PowerShell and common Windows utilities. The detection relies on Windows process creation telemetry, including parent/child image paths, command-line arguments, and process relationships.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)

Malicious MS-SQL Server Spawning Command Shell via Mallox

Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)

Suspicious Shell Script Execution From Temp Directory on SonicWall SMA1000 Appliance (via process_creation)

Malicious BeyondTrust Bomgar Agent Spawning Command Shell via Remote Support Exploitation (via process_creation)

Malicious WSUS Service Spawning Command Shell via CVE-2025-59287 (via process_creation)

Malicious SharePoint w3wp Spawning Command Shell and PowerShell

Possible PAN-OS CVE-2026-0257 Exploitation via GlobalProtect PoC Artifacts (via network)

Suspicious Child Process Spawned by Triofox GladinetCloudMonitor

Windows Process Creation: GoAnywhere child command execution indicating possible MFT exploitation

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-goanywhere-mft-exploitation-suspicious-powershell-and-cmd-child-process--6c76b3d0

title: "Windows Process Creation: GoAnywhere child command execution indicating possible MFT exploitation"
id: da6f9601-94b8-49d7-8021-8a0bcca3ee3c
status: experimental
description: This rule flags suspicious command execution spawned by child processes of the GoAnywhere Managed File Transfer (MFT) Tomcat process. It matters because exploitation or post-exploitation activity may run discovery and credential/command-and-control related commands via PowerShell and common Windows utilities. The detection relies on Windows process creation telemetry, including parent/child image paths, command-line arguments, and process relationships.
references:
  - https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-10035/proc_creation_win_exploit_cve_2025_10035.yml
author: MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-07
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
  - attack.persistence
  - attack.t1133
  - detection.emerging-threats
  - cve.2025-10035
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: \GoAnywhere\tomcat\
  selection_powershell_img:
    Image|endswith:
      - \powershell.exe
      - \powershell_ise.exe
      - \pwsh.exe
  selection_powershell_cmd:
    - CommandLine|contains|all:
        - IEX
        - enc
        - Hidden
        - bypass
    - CommandLine|re:
        - net\s+user
        - net\s+group
        - query\s+session
    - CommandLine|contains:
        - whoami
        - systeminfo
        - dsquery
        - localgroup administrators
        - nltest
        - samaccountname=
        - adscredentials
        - o365accountconfiguration
        - .DownloadString(
        - .DownloadFile(
        - FromBase64String(
        - System.IO.Compression
        - System.IO.MemoryStream
        - curl
  selection_child_cmd:
    Image|endswith: \cmd.exe
    CommandLine|contains:
      - powershell
      - whoami
      - net.exe
      - net1.exe
      - rundll32
      - quser
      - nltest
      - curl
  selection_child_others:
    CommandLine|contains:
      - bitsadmin
      - certutil
      - mshta
      - cscript
      - wscript
  condition: selection_parent and (all of selection_powershell_* or 1 of selection_child_*)
falsepositives:
  - Legitimate administrative scripts or built-in GoAnywhere functions could potentially trigger this rule. Tuning may be required based on normal activity in your environment.
level: high
license: DRL-1.1
related:
  - id: 6c76b3d0-afe4-4870-9443-ffe6773c5fef
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL