Gladinet Triofox Improper Access Control Exploitation Detected

let TriofoxPorts = dynamic([80, 443, 8080, 8443]);
let SuspiciousEndpoints = dynamic(['/api/', '/fileupload', '/download', '/share', '/admin', '/user/login', '/token']);
union isfuzzy=true
(
  DeviceNetworkEvents
  | where RemotePort in (TriofoxPorts)
  | where InitiatingProcessFileName has_any ('triofox', 'CentreStack', 'GladinetServer')
  | extend EventSource = 'DeviceNetworkEvents'
),
(
  W3CIISLog
  | where csUriStem has_any (SuspiciousEndpoints)
  | where sc-status in (200, 201, 301, 302, 401, 403, 500)
  | where cs-method in ('GET', 'POST', 'PUT', 'DELETE', 'PATCH')
  | extend EventSource = 'W3CIISLog'
),
(
  SecurityEvent
  | where EventID in (4624, 4625, 4648, 4672)
  | where ProcessName has_any ('triofox', 'CentreStack')
  | extend EventSource = 'SecurityEvent'
)
| summarize
    RequestCount = count(),
    DistinctURIs = dcount(csUriStem),
    StatusCodes = make_set(sc-status),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
  by bin(TimeGenerated, 5m), ClientIP = coalesce(cIP, RemoteIP, IpAddress), EventSource
| where RequestCount > 20 or DistinctURIs > 5
| extend AlertSeverity = iff(RequestCount > 100, 'High', 'Medium')
| project TimeGenerated, ClientIP, RequestCount, DistinctURIs, StatusCodes, FirstSeen, LastSeen, AlertSeverity, EventSource

index=web OR index=iis OR index=windows sourcetype IN ("iis", "ms:iis:auto", "WinEventLog:Security", "XmlWinEventLog:Security")
| eval is_triofox_path=if(match(uri_path, "(?i)(/api/|/fileupload|/download|/share|/admin|/user/login|/token)"), 1, 0)
| eval is_triofox_proc=if(match(process, "(?i)(triofox|centrestack|gladinet)"), 1, 0)
| where is_triofox_path=1 OR is_triofox_proc=1
| eval auth_bypass=if(status IN ("200","201") AND match(uri_path, "(?i)(/admin|/user/login|/token)"), 1, 0)
| eval anomalous_method=if(method IN ("DELETE","PUT","PATCH") AND match(uri_path, "(?i)/admin"), 1, 0)
| bucket _time span=5m
| stats
    count AS request_count,
    dc(uri_path) AS distinct_uris,
    values(status) AS status_codes,
    sum(auth_bypass) AS auth_bypass_hits,
    sum(anomalous_method) AS anomalous_method_hits,
    earliest(_time) AS first_seen,
    latest(_time) AS last_seen
  BY _time, src_ip
| where request_count > 20 OR auth_bypass_hits > 3 OR anomalous_method_hits > 1
| eval severity=case(auth_bypass_hits > 5, "critical", request_count > 100, "high", true(), "medium")
| eval cve="CVE-2025-12480"
| table _time, src_ip, request_count, distinct_uris, status_codes, auth_bypass_hits, anomalous_method_hits, severity, cve, first_seen, last_seen
| sort -severity, -request_count

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and
   (url.path : ("/api/*", "/admin/*", "/user/login*", "/token*", "/share/*") or
    process.name : ("triofox*", "CentreStack*", "gladinet*")) and
   http.request.method in ("GET", "POST", "PUT", "DELETE", "PATCH")] with runs=10
  [network where network.protocol == "http" and
   http.response.status_code in (200, 201, 403) and
   url.path : ("/admin/*", "/user/login*", "/token*")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  eventcount,
  COUNT(*) AS request_count,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Windows Auth', 'Apache HTTP Server')
  AND (
    LOWER(URL) MATCHES '.*(/api/|/admin|/user/login|/token|/share|/fileupload|/download).*'
    OR LOWER("Application") MATCHES '.*(triofox|centrestack|gladinet).*'
  )
  AND starttime > NOW() - 3600000
GROUP BY
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm'), sourceip, destinationip, destinationport, URL, username
HAVING
  request_count > 20
  OR (
    LOWER(URL) MATCHES '.*/admin.*'
    AND HTTP_RESPONSE_CODE IN (200, 201)
  )
ORDER BY request_count DESC
LIMIT 1000

_sourceCategory=iis OR _sourceCategory=windows/security OR _sourceCategory=network/http
| where (%"cs-uri-stem" matches "/api/*" or %"cs-uri-stem" matches "/admin/*" or %"cs-uri-stem" matches "/user/login*" or %"cs-uri-stem" matches "/token*" or %"cs-uri-stem" matches "/share/*") or (process matches "*triofox*" or process matches "*centrestack*" or process matches "*gladinet*")
| timeslice 5m
| count as request_count, dcount(%"c-ip") as distinct_clients, values(%"sc-status") as status_codes, min(_messageTime) as first_seen, max(_messageTime) as last_seen by _timeslice, %"c-ip"
| where request_count > 20
| eval severity = if(request_count > 100, "high", "medium")
| eval cve = "CVE-2025-12480"
| fields _timeslice, %"c-ip", request_count, distinct_clients, status_codes, first_seen, last_seen, severity, cve
| sort by request_count desc

rule CVE_2025_12480_Triofox_Access_Control_Bypass {
  meta:
    author = "Detection Engineering"
    description = "Detects CVE-2025-12480 exploitation targeting Gladinet Triofox improper access control"
    severity = "CRITICAL"
    priority = "HIGH"
    cve = "CVE-2025-12480"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-12480"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.principal.ip = $src_ip
    (
      re.regex($http.target.url, `(?i)(/api/|/admin|/user/login|/token|/share|/fileupload|/download)`) or
      re.regex($http.target.application, `(?i)(triofox|centrestack|gladinet)`)
    )
    $http.network.http.response_code in (200, 201, 403)

  match:
    $src_ip over 5m

  condition:
    #http > 20 or
    (
      re.regex($http.target.url, `(?i)/admin`) and
      $http.network.http.response_code = 200
    )

  outcome:
    $risk_score = max(if(#http > 100, 95, if(#http > 50, 75, 55)))
    $event_count = count_distinct($http.metadata.id)
}

#event_simpleName IN (NetworkConnectIP4, NetworkConnectIP6, ProcessRollup2, SyntheticProcessRollup2)
| $src_ip = RemoteAddressIP4
| $process_name = lowercase(ImageFileName)
| $cmdline = lowercase(CommandLine)
| ($process_name = /triofox|centrestack|gladinet/ OR $cmdline = /triofox|centrestack|gladinet/)
  OR (
    event_simpleName IN (NetworkConnectIP4, NetworkConnectIP6)
    AND RemotePort IN (80, 443, 8080, 8443)
    AND ($process_name = /triofox|centrestack|gladinet/ OR ParentImageFileName = /triofox|centrestack|gladinet/)
  )
| groupby([aid, $src_ip, $process_name, RemotePort], function=[count(aid, as=event_count), min(timestamp, as=first_seen), max(timestamp, as=last_seen)])
| where event_count > 50
| $severity = if(event_count > 200, "critical", if(event_count > 100, "high", "medium"))
| $cve = "CVE-2025-12480"
| $vendor = "Gladinet"
| $product = "Triofox"
| sort(event_count, order=desc)
| limit 1000