Windows Shell Process from CrushFTP Service

This analytic identifies instances where the CrushFTP service process (crushftpservice.exe) spawns shell processes such as cmd.exe or powershell.exe. This behavior is unusual for CrushFTP during normal operations and could indicate a successful exploitation of vulnerabilities, such as CVE-2025-31161, allowing an attacker to execute arbitrary commands with the privileges of the CrushFTP service.