Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
2
1
Categories
2
2
2
1
Platforms
2
1
Products / Services
1
1
1
MITRE Techniques
3
3
1
1
1
CVEs
71
71
64
58
49
IDS Classtypes
1
IDS Protocols
1
Triofox CVE-2025-12480
Suricata
Triofox CVE-2025-12480 - localhost Host header to admin setup pages
This detection is designed to help you find activity related to Triofox CVE-2025-12480 (Host header localhost). It is based on the specific threat intelligence in the reference, so it focuses on concrete, easy-to-verify signals rather than vague patterns. It uses exact indicators and tightly scoped behaviors described in the referenced threat intelligence. A match does not automatically prove a compromise, and it does not prove the activity was successful, but it is a strong reason to investigate because the signal lines up with published reporting. When this fires, start by confirming which host, account, or server produced the event and whether the behavior is expected for that system. If it is not expected, preserve the relevant logs and files, check for repeated attempts over time, and look for nearby signs such as new admin accounts, unusual remote access, or suspicious downloads. Treat a match as a scoping signal and pivot to other telemetry around the same host, account, and time window. Use the reference link to document why you treated the alert as significant and to support incident notes.
Detects attempts to exploit the Triofox authentication bypass vulnerability (CVE-2025-12480) by sending a request with a 'localhost' Host header from an external IP address to access administrative pages. This allows an attacker to create a new administrative account.
