Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
58 detections
Filters
Last updated
All Time
Detection languages
27
17
10
4
Contributors
21
19
8
4
4
Categories
20
19
15
12
12
Platforms
46
16
8
1
1
Products / Services
20
12
10
10
8
MITRE Techniques
29
19
8
8
8
CVEs
71
71
64
58
49
IDS Classtypes
4
4
2
IDS Protocols
6
2
1
1
Detects command-line activity attempting to disable, unbind, or remove NetScaler AppFW (Web Application Firewall) profiles, signatures, or security policies. This activity is indicative of defense evasion following the exploitation of CVE-2026-88771 or CVE-2026-88772 to suppress security alerting on follow-on malicious activity.
Detects high-frequency restarts, HA failovers, or process crashes (e.g., nsppe, nsaaad) on Citrix NetScaler appliances. This behavior is indicative of potential denial-of-service exploitation, such as the CVE-2026-88772 DTLS memory-overflow vulnerability.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
Detects the creation or modification of SSH authorized_keys or authorized_keys2 files. This is a common persistence technique used to maintain remote access by adding an adversary-controlled public key to a user's configuration, often performed after initial access through exploitation of public-facing services.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
This rule identifies suspicious post-exploitation activity where an anomalous or unauthenticated NetScaler VPN session (potentially exploiting CVE-2026-88771 or CVE-2026-88772) is followed by the creation or modification of SSH authorized_keys files or related credential manipulation commands on internal hosts, suggesting an attacker establishing persistence.
Detects DNS queries originating from NetScaler appliances that exhibit algorithmically generated domain (DGA) characteristics or utilize top-level domains (TLDs) frequently associated with malicious command and control infrastructure. This rule aims to identify potential post-exploitation C2 communication following a compromise of a NetScaler ADC or Gateway appliance.
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
Page 3 of 3