NetScaler httpd/nsppe/aslearning Spawning Shell or Interpreter

Ibrahim Saud@tektrix

•updated Sep 28, 2026•7•0•26

Detects the spawning of shells, interpreters, or system reconnaissance binaries by primary Citrix NetScaler ADC/Gateway processes (httpd, nsppe, aslearning). This behavior is strongly indicative of post-exploitation activity, such as remote command execution, often following the exploitation of vulnerabilities like CVE-2026-88771.