Citrix NetScaler Post-Exploitation - setuid/setgid Root Shell via /bin/sh

Detects suspicious post-exploitation behaviors on Citrix NetScaler appliances, specifically tracking the modification of file permissions to grant setuid/setgid bits to the shell and the termination of httpd processes often associated with webshell persistence or manipulation.