Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)

title: Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)
id: 0fdc7c7f-c690-4217-9ae3-31f5156eed72
status: experimental
description: Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.
references:
    - https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/
    - https://pwn.guide/free/web/crushftp
    - https://firecompass.com/crushftp-vulnerability-cve-2025-54309-securing-file-transfer-services/
author: Nisarg Suthar
date: 2025-08-01
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - attack.t1068
    - attack.t1190
    - cve.2025-54309
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\crushftp.exe'
    selection_child_powershell:
        Image|endswith:
            - '\powershell.exe'
            - '\powershell_ise.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'IEX'
            - 'enc'
            - 'Hidden'
            - 'bypass'
    selection_child_cmd:
        Image|endswith: '\cmd.exe'
        CommandLine|contains:
            - '/c powershell'
            - 'whoami'
            - 'net.exe'
            - 'net1.exe'
    selection_child_others:
        Image|endswith:
            - '\bitsadmin.exe'
            - '\certutil.exe'
            - '\mshta.exe'
            - '\cscript.exe'
            - '\wscript.exe'
    condition: selection_parent and 1 of selection_child_*
falsepositives:
    - Legitimate administrative command execution
level: high