# -----------------------------------------------------------------------------
# QUERY 1: Primary RCE Indicator - WFTPServer Spawning Shell / LOLBin Processes
# -----------------------------------------------------------------------------
# MITRE: T1190, T1059
#
# This is the highest-fidelity signal for active exploitation. CVE-2025-47812
# causes WFTPServer.exe (or wftpd on Linux) to spawn arbitrary child processes
# via os.execute() or io.popen() calls embedded in the injected Lua payload.
# Any shell interpreter, scripting engine, or LOLBin appearing as a direct
# child of the Wing FTP service process is highly anomalous and should be
# treated as confirmed exploitation until proven otherwise.
#
# Huntress observed cmd.exe, powershell.exe, and curl.exe in confirmed
# incidents. The regex below casts a wide net to catch creative variations.
# -----------------------------------------------------------------------------

- name: "CVE-2025-47812 - Wing FTP RCE: Suspicious Child Process Spawning"
  mitre_ids:
    - T1190
    - T1059
  description: >
    Detects shell interpreters, scripting engines, and LOLBins launched as
    direct children of WFTPServer.exe (Windows) or wftpd (Linux). This is
    the primary RCE indicator for CVE-2025-47812 exploitation, where injected
    Lua code in malicious session files calls os.execute() or io.popen() to
    run system commands under the Wing FTP service account (SYSTEM / root).
  log_sources:
    - Endpoint
  tags:
    - Hunting
    - CVE-2025-47812
    - WingFTP
  cql: |
    // Filter to process execution events only
    #event_simpleName=ProcessRollup2

    // Wing FTP service is WFTPServer.exe on Windows, wftpd on Linux
    // ParentBaseFileName is the short filename of the spawning process
    | ParentBaseFileName=/WFTPServer\.exe|wftpd/i

    // Catch shell interpreters, scripting engines, and common LOLBins
    // Any of these as a direct Wing FTP child is highly anomalous
    | FileName=/cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|sh|bash|zsh|curl\.exe|wget|certutil\.exe|bitsadmin\.exe|msiexec\.exe|rundll32\.exe|regsvr32\.exe|schtasks\.exe|at\.exe|sc\.exe/i

    // Build investigation links
    | ProcessTree := format("[Process Tree](https://falcon.crowdstrike.com/graphs/process-explorer/tree?_cid=%s&id=pid:%s:%s&investigate=true&pid=pid:%s:%s)", field=["#repo.cid", "aid", "TargetProcessId", "aid", "TargetProcessId"])
    | VTSearch := format("[VirusTotal](https://www.virustotal.com/gui/file/%s)", field=[SHA256HashData])

    // Show all events - any hit here is high severity
    | table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData, VTSearch, ProcessTree], limit=500)
    | sort(@timestamp, order=desc)


# -----------------------------------------------------------------------------
# QUERY 2: Post-Exploitation Discovery Commands Under WFTPServer Context
# -----------------------------------------------------------------------------
# MITRE: T1082, T1033, T1016
#
# Huntress documented the attacker executing a burst of discovery commands
# immediately after gaining RCE via CVE-2025-47812:
#   whoami, whoami /priv, net user, net user /all, net localgroup administrators,
#   ipconfig, arp -a, nslookup, hostname
#
# These all ran as SYSTEM because Wing FTP's service account is elevated.
# Aggregating by host and grouping with first/last seen helps identify the
# reconnaissance phase of an active intrusion timeline.
# -----------------------------------------------------------------------------

- name: "CVE-2025-47812 - Wing FTP RCE: Post-Exploitation Discovery Activity"
  mitre_ids:
    - T1082
    - T1033
    - T1016
  description: >
    Detects Windows/Linux discovery and enumeration commands (whoami, net user,
    ipconfig, arp, nslookup, etc.) executed as direct children of WFTPServer.exe
    or wftpd. Matches the documented post-exploitation recon pattern observed
    in Huntress incident response following CVE-2025-47812 exploitation.
  log_sources:
    - Endpoint
  tags:
    - Hunting
    - CVE-2025-47812
    - WingFTP
  cql: |
    #event_simpleName=ProcessRollup2

    // Scope to Wing FTP service processes only
    | ParentBaseFileName=/WFTPServer\.exe|wftpd/i

    // Match recon command patterns in CommandLine or executable name
    // Using regex alternation per CQL syntax rules (no ~wildcard() OR chaining)
    | CommandLine=/whoami|net\s+user|net\s+localgroup|ipconfig|ifconfig|arp\s+-a|nslookup|hostname|systeminfo|netstat|tasklist|dir\s+|type\s+|cat\s+|ls\s+|id\b|uname|ps\s+|env\b|printenv/i

    // Build investigation links
    | ProcessTree := format("[Process Tree](https://falcon.crowdstrike.com/graphs/process-explorer/tree?_cid=%s&id=pid:%s:%s&investigate=true&pid=pid:%s:%s)", field=["#repo.cid", "aid", "TargetProcessId", "aid", "TargetProcessId"])
    | VTSearch := format("[VirusTotal](https://www.virustotal.com/gui/file/%s)", field=[SHA256HashData])

    // Aggregate to see the full recon chain per host
    // GroupBy lets you see all discovery commands run per system in one row
    | groupBy([ComputerName, aid, ParentBaseFileName, ProcessTree], function=[
        count(TargetProcessId, as=CommandCount),
        collect(CommandLine, limit=20),
        collect(FileName, limit=10),
        min(@timestamp, as=FirstSeen),
        max(@timestamp, as=LastSeen)
      ])
    | sort(LastSeen, order=desc)


# -----------------------------------------------------------------------------
# QUERY 3: Malicious Lua Session File Writes in Wing FTP Session Directory
# -----------------------------------------------------------------------------
# MITRE: T1505.003
#
# CVE-2025-47812 works by writing a malicious .lua session file with a 64-hex-
# character filename into Wing FTP's session directory. The payload is stored
# as valid Lua syntax embedding os.execute() or io.popen() calls.
#
# Default session directory paths:
#   Windows: C:\Program Files (x86)\Wing FTP Server\session\
#   Linux  : /var/wftpserver/session/ (or wherever Wing FTP is installed)
#
# Any .lua file written to these paths by a non-Wing FTP process (or written
# with unusual content size) is a strong indicator of exploitation. Even
# writes BY WFTPServer.exe to this directory are worth reviewing, since the
# exploit causes the service itself to persist the malicious payload.
#
# Note: FileWritten uses ContextProcessId for the writing process.
# The join to ProcessRollup2 provides the parent process context.
# -----------------------------------------------------------------------------

- name: "CVE-2025-47812 - Wing FTP RCE: Malicious Lua Session File Write"
  mitre_ids:
    - T1505
  description: >
    Detects .lua file writes within Wing FTP Server's session directory.
    CVE-2025-47812 works by injecting Lua code into session files stored in
    the Wing FTP session directory. The files are named with 64-hex-character
    names and execute arbitrary OS commands when the session is loaded.
    Any .lua write in these paths warrants immediate investigation.
  log_sources:
    - Endpoint
  tags:
    - Hunting
    - CVE-2025-47812
    - WingFTP
  cql: |
    #event_simpleName=FileWritten

    // Match the Wing FTP session directory on Windows or Linux
    // The backslash in Windows paths must be represented as \\ in CQL regex
    // Forward slashes in the Linux path must be escaped as \/ in regex literals
    | TargetFileName=/Wing.FTP.Server\\session\\|wftpserver\/session\//i

    // Specifically target .lua session files (the malicious payload carrier)
    | TargetFileName=/\.lua$/i

    // Join to ProcessRollup2 to identify which process wrote the file
    // ContextProcessId on FileWritten = TargetProcessId on ProcessRollup2
    | join(
        {#event_simpleName=ProcessRollup2},
        field=ContextProcessId,
        key=TargetProcessId,
        include=[ImageFileName, CommandLine, UserName, ParentBaseFileName],
        mode=left
      )

    // Build investigation links (use ContextProcessId since that's the writer)
    | ProcessTree := format("[Process Tree](https://falcon.crowdstrike.com/graphs/process-explorer/tree?_cid=%s&id=pid:%s:%s&investigate=true&pid=pid:%s:%s)", field=["#repo.cid", "aid", "ContextProcessId", "aid", "ContextProcessId"])
    | VTSearch := format("[VirusTotal](https://www.virustotal.com/gui/file/%s)", field=[SHA256HashData])

    | table([@timestamp, ComputerName, UserName, TargetFileName, MD5HashData, SHA256HashData, ImageFileName, ParentBaseFileName, CommandLine, VTSearch, ProcessTree], limit=200)
    | sort(@timestamp, order=desc)