Phoenix
Sigma IntelligenceBeta

Search rules

Search the full rule library from any page.

    Open navigation menuClose navigation menu
    Emerging Threats
    CVE2025

    CVE-2025-30406

    1Rules
    4References
    1Folders
    2025-04-17Latest
    Summary

    CVE-2025-30406 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2025. Coverage centers on windows / process_creation.

    Related Detections
    Search this threat
    1 rulesInspect a rule without leaving your results.
    highexperimentalEmerging Threat

    Suspicious Process Spawned by CentreStack Portal AppPool

    Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

    windowsprocess_creation
    2025-04-17
    References
    1
    Resolving title…
    nvd.nist.gov
    2
    Resolving title…
    web.archive.org
    3
    Resolving title…
    gladinetsupport.s3.us-east-1.amazonaws.com
    4
    Resolving title…
    bleepingcomputer.com