Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
64 detections
Filters
Last updated
All Time
Detection languages
39
19
4
1
1
Contributors
26
24
4
4
3
Categories
23
15
15
13
12
Platforms
46
18
8
3
1
Products / Services
32
13
9
8
8
MITRE Techniques
42
21
10
10
8
CVEs
71
71
64
58
49
IDS Classtypes
1
IDS Protocols
1
This rule monitors NetScaler ADC logs for indicators associated with the PitScaler campaign, specifically targeting exploitation of CVE-2026-88771 and CVE-2026-88772. It detects exploitation artifacts (DTLS handshake errors, NSPPE crashes), deployment of WHIPSHOT/SLAPSHOT malware, web shell installation, httpd.conf configuration tampering, persistence mechanisms involving privilege escalation (chmod), and connections to known malicious infrastructure.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Detects the spawning of shells, interpreters, or system reconnaissance binaries by primary Citrix NetScaler ADC/Gateway processes (httpd, nsppe, aslearning). This behavior is strongly indicative of post-exploitation activity, such as remote command execution, often following the exploitation of vulnerabilities like CVE-2026-88771.
This rule detects indicators of the PitScaler campaign targeting Citrix NetScaler ADC and Gateway appliances, exploiting vulnerabilities (CVE-2026-88771, CVE-2026-88772). It identifies the full attack chain including initial DTLS heap corruption exploitation, WHIPSHOT web shell C2 patterns, SLAPSHOT tunneling artifacts, web shell deployment files, httpd.conf PHP configuration tampering for persistence, privilege escalation via setuid /bin/sh modification, and anti-forensic log tampering.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
Detects the initiation of VPN or ICA sessions on Citrix NetScaler devices where there is no record of a corresponding successful AAA (Authentication, Authorization, and Accounting) login event from the same source IP address within a one-hour lookback window. This pattern may indicate potential authentication bypass attempts, such as those associated with recent vulnerabilities in NetScaler products.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
Detects inbound network connections to NetScaler ADC management console interfaces (nsconfig, NetScaler AAA) from untrusted, external IP addresses. This rule identifies internet-facing exposure of critical management infrastructure, which is a common prerequisite for exploiting vulnerabilities such as CVE-2026-88771.
Detects modifications to core NetScaler startup configuration files 'ns.conf' or 'rc.netscaler'. Attackers often target these files after initial access to establish persistence by injecting malicious commands, rewrite, or responder policies to maintain access to the appliance.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
Detects unauthorized process activity that reads, copies, archives, or transmits the NetScaler ns.conf configuration file. This file contains highly sensitive information, including AAA/LDAP bind credentials and certificates. Adversaries may stage or exfiltrate this file following the exploitation of vulnerabilities (such as CVE-2026-88771 or CVE-2026-88772) on NetScaler appliances to facilitate further network compromise.
This rule detects potential post-exploitation activity on a NetScaler appliance where a crontab modification occurs within a short window (1 hour) following suspicious syslog entries indicative of oversized-parameter buffer overflow exploitation attempts (CVE-2026-88771/CVE-2026-88772).
Detects the creation or modification of a local NetScaler administrative account with superuser (nsroot-level) privileges via the appliance CLI or management API. This activity is indicative of persistent administrative backdoors potentially established after the exploitation of vulnerabilities such as CVE-2026-88771 or CVE-2026-88772.
This rule monitors NetScaler ADC/Gateway system logs for configuration modifications (save, add, or set commands) that occur outside of a designated maintenance window. Such activities, when performed off-hours, may indicate unauthorized persistence, defense evasion, or configuration tampering following successful exploitation.
Detects outbound network connections from Citrix NetScaler appliances that exhibit high periodic regularity (beaconing behavior) towards rare external destinations. This pattern is indicative of potential command and control (C2) communication, possibly following the exploitation of vulnerabilities like CVE-2026-88771/88772.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Detects incoming HTTP POST requests with unusually large payloads or malformed URI structures directed at Citrix NetScaler Gateway authentication endpoints, which are characteristic of exploitation attempts against CVE-2026-88771.
Detects the spawning of shells, network utilities, or scripting interpreters from Citrix NetScaler processes (nsppe or httpd), which may indicate post-exploitation activity following an initial access vulnerability.
Detects core NetScaler service processes (nsppe, httpd, aslearning) initiating outbound network connections to external, non-private IP addresses. This behavior is indicative of post-exploitation C2 beaconing activity on a compromised NetScaler appliance.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Page 2 of 4