CVE2025

CVE-2025-31161

1Rules

5References

1Folders

2025-04-10Latest

Summary

CVE-2025-31161 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2025. Coverage centers on windows / process_creation.

Related Detections

Search this threat

Emerging Threatmediumexperimental

Suspicious CrushFTP Child Process

Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests. The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.

WindowsProcess Creation

TA0001 · Initial AccessTA0002 · ExecutionT1059.001 · PowerShellT1059.003 · Windows Command Shell+3

Craig Sweeney+6Thu Apr 102025

References