NetScaler Recon: Multi-URI Version Fingerprinting from Single Source IP
Detects anomalous, high-frequency requests from a single source IP targeting sensitive NetScaler/Citrix ADC Gateway paths. This behavior is indicative of automated reconnaissance or vulnerability scanning often preceding exploitation attempts.
Microsoft Sentinel (KQL)
