Sigma Rules

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.