NetScaler Web Shell File Write in Web-Accessible Paths

Ibrahim Saud@tektrix

•updated Sep 28, 2026•15•0•36

This rule monitors NetScaler Syslog events for file creation or modification actions targeting web-accessible directories (/netscaler/, /var/vpn/, /var/netscaler/logon/) involving common web shell scripting extensions (.php, .pl, .sh, .py). It is designed to detect post-exploitation activity such as the manual deployment of backdoors following a vulnerability compromise.