Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
58 detections
Filters
Last updated
All Time
Detection languages
27
17
10
4
Contributors
21
19
8
4
4
Categories
20
19
15
12
12
Platforms
46
16
8
1
1
Products / Services
20
12
10
10
8
MITRE Techniques
29
19
8
8
8
CVEs
71
71
64
58
49
IDS Classtypes
4
4
2
IDS Protocols
6
2
1
1
Detects SLAPSHOT Python proxy daemon and tunneling tool deployed alongside WHIPSHOT on compromised NetScaler appliances
Detects SLAPSHOT Python proxy daemon and tunneling tool deployed alongside WHIPSHOT on compromised NetScaler appliances
This detection identifies potential Citrix NetScaler persistence and anti-forensic activity associated with CVE-2026-88772. It monitors for suspicious modifications within VPN-related directories and execution of commands indicative of SUID root backdoor creation or Apache web server restart activity, which may indicate efforts to establish persistence, conceal attacker activity, or activate malicious web content.
This detection identifies potential Citrix NetScaler persistence and anti-forensic activity associated with CVE-2026-88772. It monitors for suspicious modifications within VPN-related directories and execution of commands indicative of SUID root backdoor creation or Apache web server restart activity, which may indicate efforts to establish persistence, conceal attacker activity, or activate malicious web content.
This rule monitors network traffic from CommonSecurityLog data to detect bidirectional communication between NetScaler appliances and known malicious infrastructure associated with the CVE-2026-88772 campaign, which is indicative of command-and-control activity.
This rule monitors NetScaler ADC logs for indicators associated with the PitScaler campaign, specifically targeting exploitation of CVE-2026-88771 and CVE-2026-88772. It detects exploitation artifacts (DTLS handshake errors, NSPPE crashes), deployment of WHIPSHOT/SLAPSHOT malware, web shell installation, httpd.conf configuration tampering, persistence mechanisms involving privilege escalation (chmod), and connections to known malicious infrastructure.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
This rule monitors network traffic for communication with known malicious IP addresses (143.198.7.94 and 157.254.167.12) associated with the exploitation of NetScaler CVE-2026-88772 as part of the WHIPSHOT_SLAPSHOT campaign. These IPs are linked to staging, exploitation, and web shell backdoor installation activities.
Detects anomalous, high-frequency outbound connection attempts from a NetScaler appliance to internal network hosts. This pattern is indicative of potential post-exploitation lateral movement or internal network scanning by the SLAPSHOT malware (associated with CVE-2026-88772), as an appliance typically should not engage in rapid internal fan-out behavior.
This rule detects indicators of the PitScaler campaign targeting Citrix NetScaler ADC and Gateway appliances, exploiting vulnerabilities (CVE-2026-88771, CVE-2026-88772). It identifies the full attack chain including initial DTLS heap corruption exploitation, WHIPSHOT web shell C2 patterns, SLAPSHOT tunneling artifacts, web shell deployment files, httpd.conf PHP configuration tampering for persistence, privilege escalation via setuid /bin/sh modification, and anti-forensic log tampering.
This rule monitors NetScaler Syslog events for file creation or modification actions targeting web-accessible directories (/netscaler/, /var/vpn/, /var/netscaler/logon/) involving common web shell scripting extensions (.php, .pl, .sh, .py). It is designed to detect post-exploitation activity such as the manual deployment of backdoors following a vulnerability compromise.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
This rule monitors NetScaler ADC logs for indicators associated with the PitScaler campaign, specifically targeting exploitation of CVE-2026-88771 and CVE-2026-88772. It detects exploitation artifacts (DTLS handshake errors, NSPPE crashes), deployment of WHIPSHOT/SLAPSHOT malware, web shell installation, httpd.conf configuration tampering, persistence mechanisms involving privilege escalation (chmod), and connections to known malicious infrastructure.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
This rule detects indicators of the PitScaler campaign targeting Citrix NetScaler ADC and Gateway appliances, exploiting vulnerabilities (CVE-2026-88771, CVE-2026-88772). It identifies the full attack chain including initial DTLS heap corruption exploitation, WHIPSHOT web shell C2 patterns, SLAPSHOT tunneling artifacts, web shell deployment files, httpd.conf PHP configuration tampering for persistence, privilege escalation via setuid /bin/sh modification, and anti-forensic log tampering.
Detects an attempt to exploit CVE-2026-88772 by identifying an oversized DTLS handshake record on a NetScaler Gateway. The rule looks for UDP traffic on port 443 where the initial handshake record exceeds the expected size threshold, indicative of a potential buffer overflow attempt.
Detects high-frequency, short-duration UDP flow activity on NetScaler VPN ports (443/4433) indicative of volumetric or malformed DTLS handshake probing, potentially associated with exploitation attempts like CVE-2026-88772.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
This rule detects anomalous outbound SMTP (port 25) traffic originating from a NetScaler ADC or Gateway appliance. Since these appliances have no legitimate business requirement to initiate outbound SMTP communication, such traffic is a strong indicator of post-compromise activity, potentially used for command and control or data exfiltration.
Page 1 of 3