Gladinet CentreStack and Triofox Hard-Coded Cryptographic Key Exploitation

let GladinetPaths = dynamic(['/portal/', '/api/', '/fileserver/', '/triofox/', '/centrestack/']);
let SuspiciousPostPatterns = dynamic(['__VIEWSTATE', 'ScriptManager', 'ToolkitScriptManager']);
let timeWindow = 1h;
union DeviceNetworkEvents, W3CIISLog
| where TimeGenerated > ago(timeWindow)
| where RequestMethod =~ 'POST'
| where csUriStem has_any (GladinetPaths)
| extend RequestBodyIndicator = extract(@'(__VIEWSTATE|ScriptManager)=[A-Za-z0-9+/]{200,}={0,2}', 0, csUriQuery)
| where isnotempty(RequestBodyIndicator) or sc_status in (500, 200)
| project TimeGenerated, ComputerName, cIP, csUriStem, csMethod = RequestMethod, sc_status, cs_User_Agent = UserAgent, RequestBodyIndicator
| join kind=leftouter (
    SecurityEvent
    | where TimeGenerated > ago(timeWindow)
    | where EventID in (4688, 4624)
    | where ProcessName has_any ('w3wp', 'IIS', 'cmd', 'powershell', 'wscript')
    | project TimeGenerated, Computer, Account, ProcessName, CommandLine
) on $left.ComputerName == $right.Computer
| where isnotempty(ProcessName) or sc_status == 500
| summarize count(), make_set(cIP), make_set(csUriStem), make_set(ProcessName) by bin(TimeGenerated, 5m), ComputerName
| where count_ > 2

index=iis OR index=wineventlog sourcetype IN (iis, WinEventLog:Security)
| eval is_iis = if(sourcetype="iis", 1, 0)
| eval is_security = if(sourcetype="WinEventLog:Security", 1, 0)
| search (cs_uri_stem IN ("*/portal/*", "*/triofox/*", "*/centrestack/*", "*/fileserver/*") cs_method="POST") OR (EventCode IN (4688, 4624) AND (process_name IN ("w3wp.exe", "cmd.exe", "powershell.exe", "wscript.exe")))
| eval viewstate_hit = if(match(cs_uri_query, "__VIEWSTATE=[A-Za-z0-9+/]{200,}"), 1, 0)
| eval suspicious_process = if(process_name IN ("cmd.exe", "powershell.exe", "wscript.exe") AND parent_process_name="w3wp.exe", 1, 0)
| eval score = viewstate_hit + suspicious_process
| where score >= 1
| eval risk_level = case(suspicious_process=1, "CRITICAL", viewstate_hit=1, "HIGH", true(), "MEDIUM")
| stats count, values(c_ip) as source_ips, values(cs_uri_stem) as endpoints, values(process_name) as processes, max(risk_level) as max_risk by host, _time span=5m
| where count > 1
| sort -max_risk, -count

sequence by host.name with maxspan=2m
  [network where event.dataset == "iis.access" and
   http.request.method == "POST" and
   url.path : ("*/portal/*", "*/triofox/*", "*/centrestack/*", "*/fileserver/*") and
   (
     length(url.query) > 500 or
     http.response.status_code == 500
   )
  ] by host.name
  [process where event.type == "start" and
   process.parent.name : ("w3wp.exe", "IIS Worker Process") and
   process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe")
  ] by host.name

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  URL,
  "HTTP Method",
  "HTTP Response Code",
  username,
  "Process Name",
  "Parent Process Name"
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Microsoft Windows Security Event Log')
  AND starttime > NOW() - 3600000
  AND (
    (
      "HTTP Method" = 'POST'
      AND (
        URL ILIKE '%/portal/%'
        OR URL ILIKE '%/triofox/%'
        OR URL ILIKE '%/centrestack/%'
        OR URL ILIKE '%/fileserver/%'
      )
      AND (
        LENGTH(URL) > 600
        OR "HTTP Response Code" = '500'
      )
    )
    OR (
      eventid IN (4688, 4624)
      AND "Process Name" ILIKE '%cmd.exe%'
      AND "Parent Process Name" ILIKE '%w3wp.exe%'
    )
    OR (
      eventid = 4688
      AND "Process Name" ILIKE '%powershell.exe%'
      AND "Parent Process Name" ILIKE '%w3wp.exe%'
    )
  )
GROUP BY
  sourceip, destinationip, TRUNC(starttime, 'minute')
HAVING COUNT(*) >= 1
ORDER BY event_time DESC
LIMIT 500

_sourceCategory=iis OR _sourceCategory=windows/security
| parse "* * * * * * * * * *" as date, time, s_sitename, s_ip, cs_method, cs_uri_stem, cs_uri_query, s_port, cs_username, c_ip nodrop
| parse "EventCode=*" as event_code nodrop
| parse "ProcessName=*" as process_name nodrop
| parse "ParentProcessName=*" as parent_process nodrop
| where (cs_method = "POST" and (cs_uri_stem matches "*/portal/*" or cs_uri_stem matches "*/triofox/*" or cs_uri_stem matches "*/centrestack/*" or cs_uri_stem matches "*/fileserver/*") and (length(cs_uri_query) > 500))
  or (event_code in ("4688", "4624") and (process_name matches "*cmd.exe*" or process_name matches "*powershell.exe*") and parent_process matches "*w3wp.exe*")
| eval risk = if(parent_process matches "*w3wp.exe*" and (process_name matches "*cmd.exe*" or process_name matches "*powershell.exe*"), "CRITICAL", "HIGH")
| count by _sourceHost, c_ip, cs_uri_stem, process_name, risk
| where _count >= 1
| sort by risk, _count desc

rule cve_2025_14611_gladinet_hardcoded_key {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-14611 exploitation in Gladinet CentreStack/Triofox via hard-coded cryptographic key abuse"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-14611"
    mitre_attack = "T1190, T1059, T1078"

  events:
    // IIS POST to Gladinet endpoints with large payload (ViewState deserialization)
    $web.metadata.event_type = "NETWORK_HTTP"
    $web.network.http.method = "POST"
    (
      $web.target.url.path = /\/portal\// or
      $web.target.url.path = /\/triofox\// or
      $web.target.url.path = /\/centrestack\// or
      $web.target.url.path = /\/fileserver\//
    )
    (
      $web.network.http.response_code = 500 or
      strings.length($web.target.url.query) > 500
    )
    $web.target.hostname = $host

    // Suspicious process spawn from IIS worker within 2 minutes
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    (
      $proc.target.process.file.full_path = /cmd\.exe/ or
      $proc.target.process.file.full_path = /powershell\.exe/ or
      $proc.target.process.file.full_path = /wscript\.exe/ or
      $proc.target.process.file.full_path = /cscript\.exe/
    )
    $proc.target.process.parent_process.file.full_path = /w3wp\.exe/
    $proc.principal.hostname = $host

    $web.metadata.event_timestamp.seconds < $proc.metadata.event_timestamp.seconds
    $proc.metadata.event_timestamp.seconds - $web.metadata.event_timestamp.seconds < 120

  condition:
    $web and $proc
}

#event_simpleName IN (NetworkConnectIP4, ProcessRollup2, SyntheticProcessRollup2)
| $falcon.event_type = ProcessRollup2
| ImageFileName = /\\(cmd|powershell|wscript|cscript|mshta)\.exe$/i
| ParentImageFileName = /\\w3wp\.exe$/i
| CommandLine != null
// Correlate with network events on same host
| join (
    #event_simpleName = NetworkConnectIP4
    | RemotePort IN (80, 443, 8080, 8443)
    | LocalAddressIP4 != null
  ) key=aid
| eval risk_indicator = if(CommandLine matches /.*(-enc|-encoded|iex|invoke-expression|downloadstring|webclient).*/i, "CRITICAL", "HIGH")
| stats count() as event_count, values(ImageFileName) as spawned_processes, values(CommandLine) as command_lines, values(RemoteAddressIP4) as remote_ips, max(risk_indicator) as risk by ComputerName, ParentImageFileName
| where event_count >= 1
| sort -risk, -event_count