Goanywhere Mft Cve 2025 10035 Post Exploitation
Detects suspicious command-line activity spawned by the GoAnywhere MFT Tomcat service. This behavior is indicative of post-exploitation techniques observed following the exploitation of CVE-2025-10035, as detailed by Microsoft Threat Intelligence. The detection looks for specific discovery and execution commands launched via cmd.exe or powershell.exe from the GoAnywhere parent process.
YARA-L
