Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution

Detects CrushFTP launching PowerShell/CMD and related LOLBins with command patterns consistent with RCE exploitation behavior.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Nisarg Suthar (SigmaHQ), DRL 1.1
Published: 2025-08-01
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Priv Esc

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
- T1059.001PowerShell
- T1059.003Windows Command Shell
Persistence
Priv Esc
- T1068Exploitation for Privilege Escalation
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule looks for CrushFTP process executions that spawn PowerShell (including ISE/pwsh) with indicators such as IEX, enc, Hidden, and bypass, as well as cmd.exe commands containing /c powershell and reconnaissance or network enumeration strings. It also flags child processes commonly used to download or run scripts (bitsadmin, certutil, mshta, cscript, wscript) when spawned by crushftp.exe. This matters because such parent-child process relationships and command patterns can indicate attempted remote exploitation and follow-on execution. The detection relies on Windows process creation telemetry with parent image, child image, and command-line fields.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

MSSQL Server Process Spawning Command Shell via xp_cmdshell

Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)

Windows: Suspicious child processes spawned by CrushFTP service

Windows Process Creation: Java exploitation chain targeting Zoho ManageEngine Desktop Central (CVE-2020-10189)

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

Malicious IIS Worker Spawning nslookup via WS_FTP Deserialization

Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)

Suspicious Cleo Autorun Health Check File Drop (via file_event)

Obfuscated IIS Worker Spawning Encoded PowerShell after SharePoint ToolShell (via process_creation)

Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-crushftp-spawns-powershell-cmd-and-lolbins-indicative-o-0fdc7c7f

title: "Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution"
id: cbcc4858-562d-4600-8e78-491deb0a69e2
status: experimental
description: This rule looks for CrushFTP process executions that spawn PowerShell (including ISE/pwsh) with indicators such as IEX, enc, Hidden, and bypass, as well as cmd.exe commands containing /c powershell and reconnaissance or network enumeration strings. It also flags child processes commonly used to download or run scripts (bitsadmin, certutil, mshta, cscript, wscript) when spawned by crushftp.exe. This matters because such parent-child process relationships and command patterns can indicate attempted remote exploitation and follow-on execution. The detection relies on Windows process creation telemetry with parent image, child image, and command-line fields.
references:
  - https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/
  - https://pwn.guide/free/web/crushftp
  - https://firecompass.com/crushftp-vulnerability-cve-2025-54309-securing-file-transfer-services/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-54309/proc_creation_win_exploit_cve_2025_54309.yml
author: Nisarg Suthar, Huntrule Team
date: 2025-08-01
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1068
  - attack.t1190
  - cve.2025-54309
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \crushftp.exe
  selection_child_powershell:
    Image|endswith:
      - \powershell.exe
      - \powershell_ise.exe
      - \pwsh.exe
    CommandLine|contains|all:
      - IEX
      - enc
      - Hidden
      - bypass
  selection_child_cmd:
    Image|endswith: \cmd.exe
    CommandLine|contains:
      - /c powershell
      - whoami
      - net.exe
      - net1.exe
  selection_child_others:
    Image|endswith:
      - \bitsadmin.exe
      - \certutil.exe
      - \mshta.exe
      - \cscript.exe
      - \wscript.exe
  condition: selection_parent and 1 of selection_child_*
falsepositives:
  - Legitimate administrative command execution
level: high
license: DRL-1.1
related:
  - id: 0fdc7c7f-c690-4217-9ae3-31f5156eed72
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL