feat: Suspicious CrushFTP Child Process

[swachchhanda000]

Summary of the Pull Request

I have updated the sigma rule shared by Huntress blog post
https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation

Original Sigma rule:
https://gist.github.com/JohnHammond/a22bf3103eeb0f985cf1cef4d3fc849f#file-win_proc_creation_shell_child_process_crushftp-yml

Changelog

new: Suspicious CrushFTP Child Process

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[frack113]

LGTM

[nasbench]

Why is this high whereas the original rule is medium? Also why add 70 other processes? Just add shell processes and some of the common scripting ones. No need for a huge list.

Also probably the cmd / powershell stuff can be legit (hence why it was put to medium).

Please fix that.

[swachchhanda000]

Well, in the original rule, the severity was set to medium, but the false positive rate was unknown. If there had been any known false positives, I believe they would have mentioned them. That's why I decided to bump the level up to high.

As for the other processes I included, I added them because they allow proxy execution, and nowadays threat actors are heavily leveraging that technique to bypass the normal detection logic