Bronze Butler Lanscope Exploit CVE-2025-61932

Tim Peck@timpeck

•updated Oct 30, 2025•1•1•52

Detects potential exploitation of Motex LANSCOPE Endpoint Manager (CVE-2025-61932). This rule identifies when a process listening on TCP port 443 receives an inbound connection and subsequently spawns a suspicious child process (like cmd.exe or powershell.exe), a behavior consistent with exploiting a remote service vulnerability.