Merge PR #5576 from @nisargsuthar - CrushFTP RCE vulnerability CVE-2025-54309

new: CrushFTP RCE vulnerability CVE-2025-54309 --------- Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com> Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
2025-09-22 06:37:59 -04:00
parent ac177f15b1
commit 042b8dfd0c
1 changed files with 53 additions and 0 deletions
@@ -0,0 +1,53 @@
+title: Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)
+id: 0fdc7c7f-c690-4217-9ae3-31f5156eed72
+status: experimental
+description: Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.
+references:
+    - https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/
+    - https://pwn.guide/free/web/crushftp
+    - https://firecompass.com/crushftp-vulnerability-cve-2025-54309-securing-file-transfer-services/
+author: Nisarg Suthar
+date: 2025-08-01
+tags:
+    - attack.initial-access
+    - attack.execution
+    - attack.t1059.001
+    - attack.t1059.003
+    - attack.t1068
+    - attack.t1190
+    - cve.2025-54309
+    - detection.emerging-threats
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_parent:
+        ParentImage|endswith: '\crushftp.exe'
+    selection_child_powershell:
+        Image|endswith:
+            - '\powershell.exe'
+            - '\powershell_ise.exe'
+            - '\pwsh.exe'
+        CommandLine|contains|all:
+            - 'IEX'
+            - 'enc'
+            - 'Hidden'
+            - 'bypass'
+    selection_child_cmd:
+        Image|endswith: '\cmd.exe'
+        CommandLine|contains:
+            - '/c powershell'
+            - 'whoami'
+            - 'net.exe'
+            - 'net1.exe'
+    selection_child_others:
+        Image|endswith:
+            - '\bitsadmin.exe'
+            - '\certutil.exe'
+            - '\mshta.exe'
+            - '\cscript.exe'
+            - '\wscript.exe'
+    condition: selection_parent and 1 of selection_child_*
+falsepositives:
+    - Legitimate administrative command execution
+level: high