CVE2025

CVE-2025-30406

1Rules

4References

1Folders

2025-04-17Latest

Summary

CVE-2025-30406 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2025. Coverage centers on windows / process_creation.

Related Detections

Search this threat

Emerging Threathighexperimental

Suspicious Process Spawned by CentreStack Portal AppPool

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

WindowsProcess Creation

TA0003 · PersistenceTA0002 · ExecutionT1059.003 · Windows Command ShellT1505.003 · Web Shell+2

Jason Rathbun (Blackpoint Cyber)Thu Apr 172025

References

gladinetsupport.s3.us-east-1.amazonaws.com

Resolving title…

bleepingcomputer.com