THREAT_INTELLIGENCE.txt

PUBLIC THREAT INTELLIGENCE INVENTORY

Source review date: 2026-10-01
Catalog update: 2026-10-05

52 source records; all 37 distinct URLs supplied for this review checked.
262 unique indicator values; 41 behavior patterns; 57 Sigma rules.

CANONICAL DATA AND TRACEABILITY

config/threat_intel.json is the complete inventory in the source release.
The installed package includes identical data/threat_intel.json and public_sigma.yml.
Each IOC has a stable ID and literal type/value. Sixteen additional public search
candidates have no published attribution in this inventory: their source lists
are empty and provenance is unattributed_public_indicator. They are low-confidence
reference_only candidates, not independently verified malicious indicators.
The other indicators retain their existing source observations. Those
observations retain reporting context, confidence, source dates and roles. MISP
attribute types, comments and to_ids flags are retained even when they conflict.
Each source links to the indicator IDs and Sigma rule IDs derived from it.
Raw articles, downloaded source files and private evidence are not release data.

The exact requested URLs and subsequent alternate/raw URLs are distinct records.
HTTP 200 alone does not mean content was accessible: the VirusTotal collection
returned an application shell. The GreyNoise live tag was blocked. Neither was
used to infer additional collection membership. The original Deyda script URL
returned 404; the current filename was discovered from its repository tree.
Citrix/ACSC direct retrieval errors are recorded alongside successful rendered
page reviews. Undisclosed Citrix/Nextron matching logic is not reproduced.

MATCHING AND INTERPRETATION

Public references load automatically. Private packs remain explicitly opt-in
under gitignored private/ and are excluded from release archives.
URL and Base64 decoding, including nested/padding-free candidates, feeds the
same Sigma/IOC matches. Raw events, transformation chains and hash evidence
remain available. Encoding detection is bounded and heuristic, not exhaustive.

Shared WARP infrastructure, scanner/test markers, historical 2025 indicators
and tentative C2 associations keep their original qualifications. These are
investigation leads, not automatic firewall blocks or proof of compromise.
The legitimate customsnmpd path is inventoried but excluded from the standalone
Sigma path selector; a literal catalog occurrence remains contextual evidence.
Known-good baseline hashes are excluded from threat matching.

The 683 generic webshell YARA rules referenced by the historical NCSC tools are
indexed in external_rule_sets, with their original names and source hashes.
They require their original whole-file/byte/offset semantics or concern other
platforms. They are not advertised as equivalent line-oriented Sigma rules.
A separate historical core-memory ROP signature likewise needs binary evidence.
Generic PHP and configuration-text hunting adaptations are labeled separately.

No malware payload URL was contacted and no fetched scanner or PoC was executed.

SOURCE INDEX

cisa-direct
CISA: Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway
Published: 2026-09-27; retrieved: 2026-10-01
Requested URL: False; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Direct retrieval unavailable; the official mailing-list publication was reviewed as an alternative source.

cisa
CISA bulletin distributed through GovDelivery
https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42cc465
Published: 2026-09-27; retrieved: 2026-10-01
Requested URL: False; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Full text reviewed.

mandiant
Mandiant: Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances
Published: 2026-09-29; retrieved: 2026-10-01
Requested URL: True; detection use: True
Linked IOC IDs: 12; linked Sigma rule IDs: 11
Direct HTTP article verified.

watchtowr
watchTowr command injection analysis
https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/
Published: 2026-09-28; retrieved: 2026-10-01
Requested URL: True; detection use: True
Linked IOC IDs: 0; linked Sigma rule IDs: 2
Read as technical evidence only; no PoC execution. Delayed processing means request status alone is inconclusive.

levelblue
LevelBlue: Observed Exploitation Artifacts and Hunt Indicators
https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators
Published: 2026-09-30; retrieved: 2026-10-01
Requested URL: True; detection use: True
Linked IOC IDs: 24; linked Sigma rule IDs: 3
Direct HTTP article verified.

truesec
Truesec: Multiple Critical Vulnerabilities
https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway
Published: 2026-09-28; retrieved: 2026-10-01
Requested URL: True; detection use: True
Linked IOC IDs: 3; linked Sigma rule IDs: 0
Direct HTTP403; article independently readable through web retrieval, including detection section.

virustotal-mandiant
virustotal-mandiant
https://www.virustotal.com/gui/collection/c794f2e5d051c46cd2ff5e429128d7e68954ba78e66735fc69362ec726e63ee4
Published: not established; retrieved: 2026-10-01T19:36:45.064779+00:00
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
HTTP200 JavaScript application shell; web retrieval failed. Collection contents not verified; registered access needed. No indicators inferred from collection.

cert-eu
cert-eu
https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771
Published: 2026-09-28T19:30:00+02:00; retrieved: 2026-10-01T19:36:45.064857+00:00
Requested URL: True; detection use: True
Linked IOC IDs: 0; linked Sigma rule IDs: 2
Direct HTTP403; article independently readable through web retrieval, including detection section.

unit42
unit42
https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/
Published: 2026-09-30; retrieved: 2026-10-01T19:36:45.064965+00:00
Requested URL: True; detection use: True
Linked IOC IDs: 31; linked Sigma rule IDs: 4
Direct HTTP article verified. Page states updates Sep27 and Sep30 15:00 PT; current HTML published metadata Sep30, modification 2026-09-30T22:15:51Z.

greynoise
greynoise
https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation
Published: 2026-09-28; retrieved: 2026-10-01T19:36:45.065290+00:00
Requested URL: True; detection use: True
Linked IOC IDs: 4; linked Sigma rule IDs: 0
Direct HTTP article verified.

greynoise-tag
greynoise-tag
https://viz.greynoise.io/tag/citrix-netscaler-cve-2026-88771-login-command-injection-rce-attempt
Published: not established; retrieved: 2026-10-01T19:36:45.276736+00:00
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
HTTP403 and web retrieval failed. Dynamic tag membership unavailable; no IP inferred from tag.

esentire
esentire
https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772
Published: 2026-09-29; retrieved: 2026-10-01T19:36:45.424617+00:00
Requested URL: True; detection use: True
Linked IOC IDs: 16; linked Sigma rule IDs: 1
Direct HTTP article verified.

beazley
beazley
https://labs.beazley.security/advisories/BSL-A1216
Published: 2026-09-26; retrieved: 2026-10-01T19:36:45.510941+00:00
Requested URL: True; detection use: True
Linked IOC IDs: 10; linked Sigma rule IDs: 0
Direct HTTP article verified. Updated Sep29; secondary consolidation, attribution to originating reporters preserved.

ifin-event
ifin-event
https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json
Published: 2026-09-28; retrieved: 2026-10-01T19:44:37.039091+00:00
Requested URL: True; detection use: True
Linked IOC IDs: 68; linked Sigma rule IDs: 1
Direct HTTP retrieval successful; attacker resources were not requested.

ifin-manifest
ifin-manifest
https://misp.ifin.network/feed/manifest.json
Published: not established; retrieved: 2026-10-01T19:44:37.039380+00:00
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Direct HTTP retrieval successful; attacker resources were not requested.

ifin-thread
ifin-thread
https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867
Published: not established; retrieved: 2026-10-01T19:44:37.039382+00:00
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Direct HTTP retrieval successful; attacker resources were not requested.

elastic-toml
elastic-toml
https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml
Published: 2026-09-28; retrieved: 2026-10-01T19:44:37.039384+00:00
Requested URL: False; detection use: True
Linked IOC IDs: 0; linked Sigma rule IDs: 1
Direct HTTP retrieval successful; attacker resources were not requested.

rapid7
rapid7
https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/
Published: 2026-09-28; retrieved: 2026-10-01T19:44:37.039385+00:00
Requested URL: True; detection use: True
Linked IOC IDs: 4; linked Sigma rule IDs: 1
Direct HTTP retrieval successful; attacker resources were not requested.

arctic-wolf
arctic-wolf
https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md
Published: 2026-09-30; retrieved: 2026-10-01T19:44:37.039386+00:00
Requested URL: False; detection use: True
Linked IOC IDs: 37; linked Sigma rule IDs: 5
Direct HTTP retrieval successful; attacker resources were not requested.

sygnia
sygnia
https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/
Published: 2026-09-30; retrieved: 2026-10-01T19:44:37.039387+00:00
Requested URL: True; detection use: True
Linked IOC IDs: 15; linked Sigma rule IDs: 3
Direct HTTP retrieval successful; attacker resources were not requested.

CITRIX-CTX697096
NetScaler security bulletin CTX697096
https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscaler-gateway-security-bulletin-for-cve202688771-and-cve202688772.html
Published: not established; retrieved: 2026-10-01
Requested URL: False; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Canonical article accessible; attachment query-form URL failed. Authoritative fixed builds and exposure preconditions; no public attack IOC list. CVE-88778 additionally requires the Enhanced ISN configuration change. Configuration exposure is not compromise evidence.

CITRIX-SECURITY-BLOG-20260930
NetScaler security guidance, updated September 30
https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/
Published: 2026-09-27; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Official article updated 2026-09-30. IOC logic available via Console/Support, not published here. Patching does not establish cleanup; rebuild when compromise is suspected. 13.1-64.24 avoids the documented 64.23 reboot issue where NS variables exist. Reader comments are not vendor IOC statements and are excluded.

CITRIX-CTX694799
Steps after suspected NetScaler compromise
https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html
Published: 2025-06-25; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Preserve disk, logs and memory; record timezone/NTP; isolate; rotate exposed credentials and revoke certificates/private keys; investigate connected systems; rebuild. Packet-engine core generation triggers warm restart. Not a passive log-detection signature. Canonical support listing records modification 2026-05-13.

NETSCALER-CONSOLE-IOC
Console indicators-of-compromise detection
https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/ioc.html
Published: not established; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Telemetry required; BLX unsupported. Scan history and detection-logic updates are retained. No Compromise Detected is limited to current checks; failed/skipped scans are not negative findings. Detection internals absent; no invented equivalent rules.

NETSCALER-FIM
File integrity monitoring
https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/file-integrity-monitoring.html
Published: 2026-09-07; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Compares same-build vendor hashes against appliance files; distinguishes modified and added files and scan errors. BLX unsupported. A local log archive cannot reproduce vendor binary-baseline verification, exclusions, ownership/runtime checks or live device signatures.

NETSCALER-CONSOLE-RELEASES
Console service release notes
https://docs.netscaler.com/en-us/netscaler-console-service/release-notes/whats-new.html
Published: 2026-09-27; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
September 27 entry identifies CVE-88771 exposure through version scanning and recommends upgrade. Version-based exposure detection is separate from compromise detection and exact historical patch timing.

NEXTRON-20260929
THOR NetScaler detection coverage
https://www.nextron-systems.com/2026/09/29/new-thor-detection-coverage-for-citrix-netscaler-cve-2026-88771-and-cve-2026-88772/
Published: 2026-09-29; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Article explicitly withholds rule matching strings/implementation. Its filesystem IOC subset covers 12 checks consolidated into four definitions; 22 checks requiring logs/config/process/ownership/permissions/runtime context are omitted. PoC file detection is not proof of exploitation. No undisclosed rules reconstructed.

CERTFR-2026-ALE-011
CERT-FR NetScaler alert
https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/
Published: 2026-09-28; retrieved: 2026-10-01
Requested URL: True; detection use: True
Linked IOC IDs: 0; linked Sigma rule IDs: 3
Updated September 30. Reproduces Google DTLS/packet-engine hunting patterns and links YARA. Explicitly says ANSSI has not independently qualified them. Preserve original Google provenance and avoid counting duplicated patterns as independent confirmations.

CIRCL-TR100
CIRCL NetScaler critical vulnerabilities
https://circl.lu/pub/tr-100/
Published: not established; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Accessible public advisory. Configuration prerequisites, version recommendations, forensic preservation, external SIEM logs and investigation of outbound/internal activity. No additional concrete attack addresses/hashes or detection implementation imported.

ACSC-NETSCALER-20260930
ACSC NetScaler advisory
https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/critical-vulnerabilities-in-citrix-netscaler-adc-and-citrix-netscaler-gateway-products
Published: 2026-09-28; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Updated September 30: investigate back to at least September 4, 2026. This is a minimum lookback, not proof earlier compromise was impossible. Updated introduction reports Australian exploitation; older background wording still says none reported, so retain update precedence. No public literal IOC table.

watchtowr-dtls
watchTowr DTLS analysis
https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/
Published: not established; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Packet fragmentation/ROP and memory corruption need packet/core evidence; no packet exploit logic is converted to a log success verdict.

watchtowr-repo
watchTowr artifact generator repository
https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771
Published: not established; retrieved: 2026-10-01
Requested URL: True; detection use: True
Linked IOC IDs: 2; linked Sigma rule IDs: 1
Read source only. Active command injection generator, not a passive scanner. Example output paths classified as PoC markers.

poppelgaard
Community CTX697096 checker
https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker
Published: not established; retrieved: 2026-10-01
Requested URL: True; detection use: True
Linked IOC IDs: 143; linked Sigma rule IDs: 3
Read script only. Retain attributed infrastructure and scanner lists separately; community compromise labels are not adopted as local verdicts.

technion
Community NetScaler scanner
https://github.com/technion/netscaler_scanner
Published: not established; retrieved: 2026-10-01
Requested URL: True; detection use: True
Linked IOC IDs: 3; linked Sigma rule IDs: 0
Read source only. Adds author-reported theme webshell paths. Mandiant-derived checks keep original attribution. Build-only CVE-88778 conclusion is not imported.

deyda-guide
Community assessment guide
https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/
Published: not established; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Guide and corrected current script reviewed; no script executed. Known-clean platform hashes and normal diagnostic paths are not attack IOCs.

deyda-requested-script
Requested community script path
https://github.com/Deyda/Security/blob/main/netscaler-ioc-check.sh
Published: not established; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Requested path unavailable (raw equivalent HTTP404). Repository tree identifies deyda-netscaler-ioc-check.sh as current filename.

deyda-script
Current community assessment script
https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh
Published: not established; retrieved: 2026-10-01
Requested URL: False; detection use: True
Linked IOC IDs: 7; linked Sigma rule IDs: 3
Corrected filename discovered from repository tree. Read source only; no copied scanner execution or known-good hash import.

ncsc-nl-2025
NCSC-NL historical forensic checks
https://github.com/NCSC-NL/citrix-2025
Published: 2025-08-06; retrieved: 2026-10-01
Requested URL: True; detection use: True
Linked IOC IDs: 22; linked Sigma rule IDs: 2
2025 campaign, not evidence of 2026 CVE coverage. Extracted string observables; binary ROP, image metadata, timestomping, permissions and live checks remain external.

fox-it
Fox-IT forensic image triage
https://github.com/fox-it/citrix-netscaler-triage
Published: not established; retrieved: 2026-10-01
Requested URL: True; detection use: True
Linked IOC IDs: 0; linked Sigma rule IDs: 1
Read implementation. Core utility needs disk and RAM-disk evidence; string heuristics adapted with PHP context only. Expected SUID binaries are not attack IOCs.

poppelgaard-script
Reviewed source component: poppelgaard-script
https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh
Published: not established; retrieved: 2026-10-01
Requested URL: False; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Read-only source supporting parent repository review.

technion-script
Reviewed source component: technion-script
https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh
Published: not established; retrieved: 2026-10-01
Requested URL: False; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Read-only source supporting parent repository review.

fox-ioc
Reviewed source component: fox-ioc
https://raw.githubusercontent.com/fox-it/citrix-netscaler-triage/main/iocitrix.py
Published: not established; retrieved: 2026-10-01
Requested URL: False; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Read-only source supporting parent repository review.

ncsc-checks
Reviewed source component: ncsc-checks
https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/checks.yaml
Published: not established; retrieved: 2026-10-01
Requested URL: False; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Read-only source supporting parent repository review.

ncsc-core-yara
Reviewed source component: ncsc-core-yara
https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/core-dump-checks/iocs.yar
Published: not established; retrieved: 2026-10-01
Requested URL: False; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Read-only source supporting parent repository review.

ncsc-live
Reviewed source component: ncsc-live
https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/live-host-bash-check/TLPCLEAR_check_script_cve-2025-6543-v1.8.sh
Published: not established; retrieved: 2026-10-01
Requested URL: False; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Read-only source supporting parent repository review.

watch-poc
Reviewed source component: watch-poc
https://raw.githubusercontent.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py
Published: not established; retrieved: 2026-10-01
Requested URL: False; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Read-only source supporting parent repository review.

ncsc-php_webshell_rules.yara
NCSC-referenced general webshell YARA collection
https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/yara/php_webshell_rules.yara
Published: not established; retrieved: 2026-10-01
Requested URL: False; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Generic multi-platform historical webshell library, not campaign-specific NetScaler log rules. Indexed for external file/core scanning; no misleading line-by-line Sigma conversion.

ncsc-thor-webshells.yar
NCSC-referenced general webshell YARA collection
https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/yara/thor-webshells.yar
Published: not established; retrieved: 2026-10-01
Requested URL: False; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Generic multi-platform historical webshell library, not campaign-specific NetScaler log rules. Indexed for external file/core scanning; no misleading line-by-line Sigma conversion.

requested-77a190a3
requested-77a190a3
https://github.com/elastic/detection-rules/blob/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml
Published: not established; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Exact requested URL retained for audit; see linked alternate retrievals.

requested-7e6e5286
requested-7e6e5286
https://github.com/rtkwlf/wolf-tools/blob/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md
Published: not established; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Exact requested URL retained for audit; see linked alternate retrievals.

requested-f8052bbe
requested-f8052bbe
https://support.citrix.com/external/article?articleNumber=CTX697096
Published: not established; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Exact requested URL retained for audit; see linked alternate retrievals.

requested-6c93ceb2
requested-6c93ceb2
https://www.elastic.co/guide/en/security/8.19/potential-netscaler-log-poisoning-command-injection-attempt.html
Published: not established; retrieved: 2026-10-01
Requested URL: True; detection use: False
Linked IOC IDs: 0; linked Sigma rule IDs: 0
Unavailable or not verified; no indicator invented.

REPRODUCIBLE CHECKS

uv run python -W error -m unittest discover -s tests
uv run mypy
uv run ruff check src tests typing_stubs

The tests verify catalog uniqueness and source links, raw and decoded matches,
IP boundaries and preservation of encoding evidence. They do not establish
the truth of every vendor attribution or successful exploitation of a device.