From ae5d4661f585f2f4fb0860899c429d6ca6f1607c Mon Sep 17 00:00:00 2001 From: swachchhanda000 Date: Thu, 10 Apr 2025 15:04:29 +0545 Subject: [PATCH 1/4] feat: Suspicious CrushFTP Child Process --- ...tion_win_crushftp_susp_child_processes.yml | 64 +++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml diff --git a/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml b/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml new file mode 100644 index 00000000000..03e6287f622 --- /dev/null +++ b/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml @@ -0,0 +1,64 @@ +title: Suspicious CrushFTP Child Process +id: 459628e3-1b00-4e9b-9e5b-7da8961aea35 +status: experimental +description: | + Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as + CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests. + The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands. +references: + - https://nvd.nist.gov/vuln/detail/CVE-2025-2825 + - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update + - https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/ + - https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis + - https://projectdiscovery.io/blog/crushftp-authentication-bypass +author: Craig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems) +date: 2025-04-10 +tags: + - attack.initial_access + - attack.execution + - attack.t1059.001 + - attack.t1059.003 + - attack.t1190 + - cve.2025-31161 +logsource: + category: process_creation + product: windows +detection: + selection_parent: + ParentImage|endswith: '\crushftpservice.exe' + selection_child: + Image|endswith: + - '\adplus.exe' + - '\AppVLP.exe' + - '\atbroker.exe' + - '\bash.exe' + - '\bitsadmin.exe' + - '\certutil.exe' + - '\cmd.exe' + - '\cscript.exe' + - '\forfiles.exe' + - '\hh.exe' + - '\Ieexec.exe' + - '\Installutil.exe' + - '\mftrace.exe' + - '\mshta.exe' + - '\Msbuild.exe' + - '\msiexec.exe' + - '\pcalua.exe' + - '\pcwrun.exe' + - '\powershell.exe' + - '\powershell_ise.exe' + - '\pwsh.exe' + - '\regsvr32.exe' + - '\rundll32.exe' + - '\schtasks.exe' + - '\scriptrunner.exe' + - '\sh.exe' + - '\ssh.exe' + - '\wmic.exe' + - '\wscript.exe' + condition: all of selection_* +falsepositives: + - Legitimate CrushFTP administrative actions + - Software updates +level: high From 5f626022c94fad20fadc944b80211bd19962e8bd Mon Sep 17 00:00:00 2001 From: swachchhanda000 Date: Thu, 10 Apr 2025 15:21:40 +0545 Subject: [PATCH 2/4] fix: InvalidATTACKTagIssue --- .../proc_creation_win_crushftp_susp_child_processes.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml b/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml index 03e6287f622..b0032cb6886 100644 --- a/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml +++ b/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml @@ -14,7 +14,7 @@ references: author: Craig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-10 tags: - - attack.initial_access + - attack.initial-access - attack.execution - attack.t1059.001 - attack.t1059.003 From 4ec52cfe5cd827ee7c0468e6961988d9b6832560 Mon Sep 17 00:00:00 2001 From: swachchhanda000 Date: Thu, 17 Apr 2025 09:50:34 +0545 Subject: [PATCH 3/4] fix: remove unnecesary images and level changed to medium --- ...tion_win_crushftp_susp_child_processes.yml | 22 +------------------ 1 file changed, 1 insertion(+), 21 deletions(-) diff --git a/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml b/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml index b0032cb6886..0a94b5ae190 100644 --- a/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml +++ b/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml @@ -28,37 +28,17 @@ detection: ParentImage|endswith: '\crushftpservice.exe' selection_child: Image|endswith: - - '\adplus.exe' - - '\AppVLP.exe' - - '\atbroker.exe' - '\bash.exe' - - '\bitsadmin.exe' - - '\certutil.exe' - '\cmd.exe' - '\cscript.exe' - - '\forfiles.exe' - - '\hh.exe' - - '\Ieexec.exe' - - '\Installutil.exe' - - '\mftrace.exe' - '\mshta.exe' - - '\Msbuild.exe' - - '\msiexec.exe' - - '\pcalua.exe' - - '\pcwrun.exe' - '\powershell.exe' - '\powershell_ise.exe' - '\pwsh.exe' - - '\regsvr32.exe' - - '\rundll32.exe' - - '\schtasks.exe' - - '\scriptrunner.exe' - '\sh.exe' - - '\ssh.exe' - - '\wmic.exe' - '\wscript.exe' condition: all of selection_* falsepositives: - Legitimate CrushFTP administrative actions - Software updates -level: high +level: medium From 719ab52b8c8f352dc79ca39293941dc021d07442 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 17 Apr 2025 11:16:51 +0200 Subject: [PATCH 4/4] Update rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml --- .../proc_creation_win_crushftp_susp_child_processes.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml b/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml index 0a94b5ae190..c14f19f0e24 100644 --- a/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml +++ b/rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml @@ -20,6 +20,7 @@ tags: - attack.t1059.003 - attack.t1190 - cve.2025-31161 + - detection.emerging-threats logsource: category: process_creation product: windows