Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

Detects suspicious child processes created by CrushFTP, which could indicate the exploitation of a Remote Code Execution (RCE) vulnerability like CVE-2025-54309. The rule specifically looks for PowerShell, cmd, bitsadmin, certutil, mshta, cscript, or wscript processes spawned by CrushFTP, often with command-line arguments indicative of malicious activity (e.g., IEX, encoded commands for PowerShell, or common system commands for cmd).