mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Merge pull request #3462 from splunk/crushingit
Haag's Crushed Shell: A Tale of CrushFTP Exploitation
This commit is contained in:
Bhavin Patel
@@ -0,0 +1,59 @@
|
||||
name: Windows Shell Process from CrushFTP
|
||||
id: 459628e3-1b00-4e9b-9e5b-7da8961aea35
|
||||
version: 1
|
||||
date: '2025-04-03'
|
||||
author: Michael Haag, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies instances where CrushFTP's service process (crushftpservice.exe) spawns shell processes like cmd.exe or powershell.exe. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events. This activity is significant because CrushFTP should not normally spawn interactive shell processes during regular operations. If confirmed malicious, this behavior could indicate successful exploitation of vulnerabilities like CVE-2025-31161, potentially allowing attackers to execute arbitrary commands with the privileges of the CrushFTP service.
|
||||
data_source:
|
||||
- Sysmon EventID 1
|
||||
- Windows Event Log Security 4688
|
||||
- CrowdStrike ProcessRollup2
|
||||
search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=crushftpservice.exe AND `process_cmd` OR `process_powershell` by Processes.dest Processes.parent_process Processes.original_file_name Processes.user Processes.action Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_path Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_path Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_shell_process_from_crushftp_filter`'
|
||||
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
|
||||
known_false_positives: Unknown. Filter as needed.
|
||||
references:
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-31161
|
||||
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
|
||||
- https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
|
||||
drilldown_searches:
|
||||
- name: View the detection results for - "$dest$"
|
||||
search: '%original_detection_search% | search dest = "$dest$"'
|
||||
earliest_offset: $info_min_time$
|
||||
latest_offset: $info_max_time$
|
||||
- name: View risk events for the last 7 days for - "$dest$"
|
||||
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
|
||||
earliest_offset: $info_min_time$
|
||||
latest_offset: $info_max_time$
|
||||
rba:
|
||||
message: Possible CrushFTP exploitation detected on $dest$ related to CVE-2025-31161.
|
||||
risk_objects:
|
||||
- field: dest
|
||||
type: system
|
||||
score: 65
|
||||
threat_objects: []
|
||||
tags:
|
||||
analytic_story:
|
||||
- CrushFTP Vulnerabilities
|
||||
asset_type: Endpoint
|
||||
cve:
|
||||
- CVE-2025-31161
|
||||
mitre_attack_id:
|
||||
- T1059.001
|
||||
- T1059.003
|
||||
- T1190
|
||||
- T1505
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
security_domain: endpoint
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/crushftp/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: XmlWinEventLog
|
||||
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
name: CrushFTP Authentication Bypass Exploitation
|
||||
id: 82eb7f64-d219-4e21-acfe-956de84c1a35
|
||||
version: 1
|
||||
date: '2025-04-08'
|
||||
author: Michael Haag, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). This detection identifies suspicious command execution patterns associated with exploitation of this vulnerability, such as executing mesch.exe with specific arguments like b64exec or fullinstall. This activity is indicative of an attacker exploiting CVE-2025-31161 to gain unauthorized access to the CrushFTP server and perform post-exploitation activities.
|
||||
data_source:
|
||||
- CrushFTP
|
||||
search: '`crushftp` | rex field=_raw "\\[HTTP:[^:]+:(?<user>[^:]+):(?<src_ip>[^\\]]+)\\]" | rex field=_raw "cmd:(?<process>[^\\*\\r\\n]+)" | where isnotnull(process) AND (match(process, "mesch\.exe") OR match(process, "b64exec") OR match(process, "fullinstall") OR match(process, "run")) | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, user, process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_authentication_bypass_exploitation_filter`'
|
||||
how_to_implement: To implement this detection, you need to ingest CrushFTP logs into your Splunk environment. Configure CrushFTP to forward logs to Splunk via a syslog forwarder or direct file monitoring. This detection searches for CrushFTP logs containing suspicious command execution patterns commonly associated with exploitation of the CVE-2025-31161 vulnerability.
|
||||
known_false_positives: False positives may occur if there are legitimate administrative commands being executed on the CrushFTP server that match the suspicious patterns. Review the commands being executed to determine if the activity is legitimate administrative work or potential malicious activity.
|
||||
references:
|
||||
- https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-31161
|
||||
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
|
||||
drilldown_searches:
|
||||
- name: View the detection results for - "$src_ip$"
|
||||
search: '%original_detection_search% | search src_ip = "$src_ip$"'
|
||||
earliest_offset: $info_min_time$
|
||||
latest_offset: $info_max_time$
|
||||
- name: View risk events for the last 7 days for - "$src_ip$"
|
||||
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
|
||||
earliest_offset: $info_min_time$
|
||||
latest_offset: $info_max_time$
|
||||
rba:
|
||||
message: Potential CrushFTP authentication bypass exploitation from IP $src_ip$ as user $user$
|
||||
risk_objects:
|
||||
- field: src_ip
|
||||
type: system
|
||||
score: 80
|
||||
- field: user
|
||||
type: user
|
||||
score: 60
|
||||
threat_objects: []
|
||||
tags:
|
||||
analytic_story:
|
||||
- CrushFTP Vulnerabilities
|
||||
asset_type: Web Server
|
||||
mitre_attack_id:
|
||||
- T1190
|
||||
- T1059.003
|
||||
- T1059.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
security_domain: network
|
||||
cve:
|
||||
- CVE-2025-31161
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/crushftp/crushftp11_session.log
|
||||
sourcetype: crushftp:sessionlogs
|
||||
source: crushftp
|
||||
@@ -0,0 +1,53 @@
|
||||
name: CrushFTP Max Simultaneous Users From IP
|
||||
id: 75dfd9f4-ca64-45d0-9422-4bde6d26a59e
|
||||
version: 1
|
||||
date: '2025-04-08'
|
||||
author: Michael Haag, Splunk
|
||||
status: production
|
||||
type: Anomaly
|
||||
description: The following analytic identifies instances where CrushFTP has blocked access due to exceeding the maximum number of simultaneous connections from a single IP address. This activity may indicate brute force attempts, credential stuffing, or automated attacks against the CrushFTP server. This detection is particularly relevant following the discovery of CVE-2025-31161, an authentication bypass vulnerability in CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0.
|
||||
data_source:
|
||||
- CrushFTP
|
||||
search: '`crushftp` "*User access not allowed. Max simultaneous users from your IP*" | rex field=_raw "SESSION\\|\\d+\\/\\d+\\/\\d+ \\d+:\\d+:\\d+\\.\\d+\\|\\[HTTP:[^:]+:(?<user>[^:]+):(?<src_ip>[0-9\\.]+)\\]" | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by src_ip | where count >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_max_simultaneous_users_from_ip_filter`'
|
||||
how_to_implement: To implement this detection, you need to ingest CrushFTP logs into your Splunk environment. Configure CrushFTP to forward logs to Splunk via a syslog forwarder or direct file monitoring. Ensure the sourcetype is correctly set for the CrushFTP logs. The detection requires the SESSION field and the "[HTTP:*:user:IP]" format in the logs. Adjust the threshold in the "where count >= 3" clause based on your environment's normal behavior.
|
||||
known_false_positives: In environments where multiple users legitimately access CrushFTP from behind the same NAT or proxy, this may generate false positives. Tune the threshold based on your organization's usage patterns.
|
||||
references:
|
||||
- https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-31161
|
||||
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
|
||||
drilldown_searches:
|
||||
- name: View the detection results for - "$src_ip$"
|
||||
search: '%original_detection_search% | search src_ip = "$src_ip$"'
|
||||
earliest_offset: $info_min_time$
|
||||
latest_offset: $info_max_time$
|
||||
- name: View risk events for the last 7 days for - "$src_ip$"
|
||||
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
|
||||
earliest_offset: $info_min_time$
|
||||
latest_offset: $info_max_time$
|
||||
rba:
|
||||
message: Potential brute force or automated attack against CrushFTP detected from IP $src_ip$
|
||||
risk_objects:
|
||||
- field: src_ip
|
||||
type: system
|
||||
score: 45
|
||||
threat_objects: []
|
||||
tags:
|
||||
analytic_story:
|
||||
- CrushFTP Vulnerabilities
|
||||
asset_type: Web Server
|
||||
mitre_attack_id:
|
||||
- T1110.001
|
||||
- T1110.004
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
security_domain: network
|
||||
cve:
|
||||
- CVE-2025-31161
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/crushftp/crushftp11_session.log
|
||||
sourcetype: crushftp:sessionlogs
|
||||
source: crushftp
|
||||
@@ -9,6 +9,9 @@ narrative: CVE-2024-4040 exposes a severe server-side template injection vulnera
|
||||
references:
|
||||
- https://github.com/airbus-cert/CVE-2024-4040
|
||||
- https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-31161
|
||||
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
|
||||
- https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
|
||||
tags:
|
||||
category:
|
||||
- Adversary Tactics
|
||||
@@ -19,3 +22,4 @@ tags:
|
||||
usecase: Advanced Threat Detection
|
||||
cve:
|
||||
- CVE-2024-4040
|
||||
- CVE-2025-31161
|
||||
|
||||
Reference in New Issue
Block a user