Potential Exploitation of GoAnywhere MFT Vulnerability

MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

2025-10-07 00:00:00

None

6c76b3d0-afe4-4870-9443-ffe6773c5fef

attack.initial-access attack.t1190 attack.execution attack.t1059.001 attack.persistence attack.t1133 detection.emerging-threats cve.2025-10035

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5680 from @swachchhanda000 - feat: add detection for CVE-2025-10035 exploit in GoAnywhere MFT

2025-10-20