NetScaler_forensik/src/netscaler_triage/data/filesystem_rules.json

{
  "updated": "2026-10-05",
  "classification": "review_candidate",
  "rules": [
    {
      "id": "php_nonstandard_handler",
      "regex": "\\b(?:addhandler|addtype|sethandler)\\b[^\\r\\n]{0,250}application/x-httpd-php[^\\r\\n]{0,100}\\.(?:deb|sig|ico|rpm|tgz|html|dat|png|so|sh)\\b",
      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
      "required_any_literal": [
        "application/x-httpd-php"
      ]
    },
    {
      "id": "php_engine_enabled",
      "regex": "\\bphp_(?:flag|admin_flag)\\s+engine\\s+on\\b",
      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
      "required_any_literal": [
        "php_flag",
        "php_admin_flag"
      ]
    },
    {
      "id": "web_alias_routing",
      "regex": "\\b(?:alias|aliasmatch|rewriterule)\\b[^\\r\\n]{0,800}(?:/vpn/(?:media|theme|images)|\\.sig|\\.ctxs\\.receiver|\\.local_journal|receiver\\.min|logonuisimple)",
      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
      "required_any_literal": [
        "alias",
        "rewriterule"
      ]
    },
    {
      "id": "css_webshell_alias",
      "regex": "(?:receiver\\.min(?:\\.[a-f0-9]*)?\\.css|logonuisimple\\.html\\.style\\.min(?:\\.[a-f0-9]+)?\\.css)",
      "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
      "required_any_literal": [
        "receiver.min",
        "logonuisimple"
      ]
    },
    {
      "id": "nsmon_cron",
      "regex": "^[ \\t]*\\*/5[ \\t]+\\*[ \\t]+\\*[ \\t]+\\*[ \\t]+\\*[^\\r\\n]{0,200}\\bperl\\b[^\\r\\n]{0,200}nsmon\\.pl",
      "source": "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md",
      "required_any_literal": [
        "nsmon.pl"
      ]
    },
    {
      "id": "privileged_monitor_account",
      "regex": "\\b(?:add|set|bind)\\s+system\\s+user\\s+sec_monitor\\b[^\\r\\n]*",
      "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
      "required_any_literal": [
        "sec_monitor"
      ]
    },
    {
      "id": "command_channel_header",
      "regex": "\\b(?:http[_-])?(?:nsc[_-](?:ldap|clienttype)|x[_-]ux(?:[_-][0-9]+)?)\\b",
      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
      "required_any_literal": [
        "ldap",
        "clienttype",
        "ux"
      ]
    },
    {
      "id": "cron_scrubbing_reference",
      "regex": "(?:preg_replace|sed)[^\\r\\n]{0,800}(?:crontab|/vpn/scripts/linux)",
      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
      "required_any_literal": [
        "preg_replace",
        "sed"
      ]
    },
    {
      "id": "shell_privilege_change",
      "regex": "\\bchmod\\s+(?:u\\+s|[2467][0-7]{3})\\s+/bin/sh\\b",
      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
      "required_any_literal": [
        "chmod"
      ]
    },
    {
      "id": "reverse_shell_reference",
      "regex": "/dev/tcp/|\\b(?:nc|ncat)\\s+[^\\r\\n]{0,100}-e\\s+/bin/(?:ba)?sh|\\bdup2\\s*\\(",
      "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
      "required_any_literal": [
        "/dev/tcp/",
        "nc",
        "dup2"
      ]
    },
    {
      "id": "configuration_staging_reference",
      "regex": "\\b(?:tar|cat)\\b[^\\r\\n]{0,500}/(?:flash/)?nsconfig[^\\r\\n]{0,500}(?:/var/netscaler|update_result)",
      "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
      "required_any_literal": [
        "nsconfig"
      ]
    }
  ]
}