NetScaler_forensik/src/netscaler_triage/data/filesystem_rules.json

{
  "updated": "2026-10-05",
  "classification": "review_candidate",
  "rules": [
    {
      "id": "php_nonstandard_handler",
      "regex": "\\b(?:addhandler|addtype|sethandler)\\b[^\\r\\n]{0,250}application/x-httpd-php[^\\r\\n]{0,100}\\.(?:deb|sig|ico|rpm|tgz|html|dat|png|so|sh)\\b",
      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
      "required_any_literal": [
        "application/x-httpd-php"
      ]
    },
    {
      "id": "php_engine_enabled",
      "regex": "\\bphp_(?:flag|admin_flag)\\s+engine\\s+on\\b",
      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
      "required_any_literal": [
        "php_flag",
        "php_admin_flag"
      ]
    },
    {
      "id": "web_alias_routing",
      "regex": "\\b(?:alias|aliasmatch|rewriterule)\\b[^\\r\\n]{0,800}(?:/vpn/(?:media|theme|images)|\\.sig|\\.ctxs\\.receiver|\\.local_journal|receiver\\.min|logonuisimple)",
      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
      "required_any_literal": [
        "alias",
        "rewriterule"
      ]
    },
    {
      "id": "css_webshell_alias",
      "regex": "(?:receiver\\.min(?:\\.[a-f0-9]*)?\\.css|logonuisimple\\.html\\.style\\.min(?:\\.[a-f0-9]+)?\\.css)",
      "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
      "required_any_literal": [
        "receiver.min",
        "logonuisimple"
      ]
    },
    {
      "id": "nsmon_cron",
      "regex": "^[ \\t]*\\*/5[ \\t]+\\*[ \\t]+\\*[ \\t]+\\*[ \\t]+\\*[^\\r\\n]{0,200}\\bperl\\b[^\\r\\n]{0,200}nsmon\\.pl",
      "source": "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md",
      "required_any_literal": [
        "nsmon.pl"
      ]
    },
    {
      "id": "privileged_monitor_account",
      "regex": "\\b(?:add|set|bind)\\s+system\\s+user\\s+sec_monitor\\b[^\\r\\n]*",
      "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
      "required_any_literal": [
        "sec_monitor"
      ]
    },
    {
      "id": "command_channel_header",
      "regex": "\\b(?:http[_-])?(?:nsc[_-](?:ldap|clienttype)|x[_-]ux(?:[_-][0-9]+)?)\\b",
      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
      "required_any_literal": [
        "ldap",
        "clienttype",
        "ux"
      ]
    },
    {
      "id": "cron_scrubbing_reference",
      "regex": "(?:preg_replace|sed)[^\\r\\n]{0,800}(?:crontab|/vpn/scripts/linux)",
      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
      "required_any_literal": [
        "preg_replace",
        "sed"
      ]
    },
    {
      "id": "shell_privilege_change",
      "regex": "\\bchmod\\s+(?:u\\+s|[2467][0-7]{3})\\s+/bin/sh\\b",
      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
      "required_any_literal": [
        "chmod"
      ]
    },
    {
      "id": "reverse_shell_reference",
      "regex": "/dev/tcp/|\\b(?:nc|ncat)\\s+[^\\r\\n]{0,100}-e\\s+/bin/(?:ba)?sh|\\bdup2\\s*\\(",
      "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
      "required_any_literal": [
        "/dev/tcp/",
        "nc",
        "dup2"
      ]
    },
    {
      "id": "configuration_staging_reference",
      "regex": "\\b(?:tar|cat)\\b[^\\r\\n]{0,500}/(?:flash/)?nsconfig[^\\r\\n]{0,500}(?:/var/netscaler|update_result)",
      "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
      "required_any_literal": [
        "nsconfig"
      ]
    },
    {
      "id": "httpd_commented_security_directive",
      "regex": "^[ \\t]*#[ \\t]*(?:Require[ \\t]+all[ \\t]+denied|php_flag[ \\t]+engine[ \\t]+off)\\b",
      "description": "An Apache restriction is commented out. Compare with a trusted configuration of the same build; comments can be vendor defaults.",
      "source": "",
      "required_any_literal": [
        "#"
      ],
      "path_regex": "(?:^|/)(?:httpd|nshttpd)\\.conf$"
    },
    {
      "id": "httpd_php_handler_review",
      "regex": "^[ \\t]*AddHandler[ \\t]+application/x-httpd-php\\b",
      "description": "PHP handler declaration. Check the mapped extensions and vendor baseline; a handler alone is not malicious.",
      "source": "",
      "required_any_literal": [
        "addhandler"
      ],
      "path_regex": "(?:^|/)(?:httpd|nshttpd)\\.conf$"
    },
    {
      "id": "startup_python_reference",
      "regex": "(?:/flash)?/nsconfig/rc\\.netscaler[^\\r\\n]{0,300}\\bpython(?:[23](?:\\.\\d+)?)?\\b",
      "description": "Python is referenced alongside the startup configuration path. Verify actual file contents and administrative intent.",
      "source": "",
      "required_any_literal": [
        "rc.netscaler"
      ]
    },
    {
      "id": "core_file_removal",
      "regex": "\\brm[ \\t]+(?:-[a-z]+[ \\t]+){0,3}[\\x22\\x27]?/var/core/\\*",
      "description": "A command references removal of core files. This can be maintenance or evidence deletion; a logged command alone does not prove execution.",
      "source": "",
      "required_any_literal": [
        "/var/core/"
      ],
      "path_regex": "(?:^|/)(?:notice|sh|bash)\\.log(?:\\.|$)"
    },
    {
      "id": "wsfed_request_id_anomaly",
      "regex": "WSFed:[ \\t]*request_id[^\\r\\n]{0,2048}(?:[\\x80-\\xff\\xfe]|\\^[^\\r\\n]{0,256}\\^)",
      "description": "WS-Federation request ID contains unusual characters. Encoding, corruption and malformed input are alternatives; this does not prove memory disclosure.",
      "source": "",
      "required_any_literal": [
        "wsfed:"
      ],
      "path_regex": "(?:^|/)ns\\.log(?:\\.|$)"
    },
    {
      "id": "acs_control_marker",
      "regex": "acs=<[^\\r\\n]{0,2048}\\xf0\\^M[^\\r\\n]{0,2048}>,[ \\t]*for",
      "description": "ACS field contains an unusual byte/control representation. Inspect original bytes and authentication context; not proof of memory disclosure.",
      "source": "",
      "required_any_literal": [
        "acs=<"
      ],
      "path_regex": "(?:^|/)ns\\.log(?:\\.|$)"
    },
    {
      "id": "web_artifact_response_review",
      "regex": "(?:nsginstaller\\.deb|nsgclient[^\\s\\x22?]*|[0-9a-f]{6}\\.ico)[^\\r\\n\\x22]{0,512}HTTP/1\\.[01]\\x22[ \\t]+(?:404|202)[ \\t]+[0-9]{4}\\b",
      "description": "A candidate artifact returned 202 or 404 with a four-digit response size. Status and size do not establish a web shell; inspect response content and filesystem evidence.",
      "source": "",
      "required_any_literal": [
        "nsginstaller",
        "nsgclient",
        ".ico"
      ],
      "path_regex": "(?:^|/)httpaccess[^/]*$"
    },
    {
      "id": "web_artifact_error_review",
      "regex": "(?:File does not exist|not found|\\[error\\])[^\\r\\n]{0,1024}(?:nsginstaller\\.deb|nsgclient|[0-9a-f]{6}/\\.sig)",
      "description": "Web server error mentions a candidate artifact. A missing-file error usually supports absence at that moment, not successful installation.",
      "source": "",
      "required_any_literal": [
        "nsginstaller",
        "nsgclient",
        "/.sig"
      ],
      "path_regex": "(?:^|/)httperror[^/]*$"
    },
    {
      "id": "packet_engine_open_file_review",
      "regex": "^NSPPE\\S*[ \\t]+\\d+[^\\r\\n]{0,1024}(?:/var/netscaler/|callhome)",
      "description": "A captured open-file listing associates NSPPE with a candidate path. Inspect file type and process context; legitimate open files can match.",
      "source": "",
      "required_any_literal": [
        "nsppe"
      ]
    },
    {
      "id": "web_user_process_review",
      "regex": "^(?:nobody|daemon)[ \\t]+\\d+[ \\t]+(?!(?:[^\\r\\n]*)(?:/bin/httpd|/usr/sbin/nshttpd)\\b)[^\\r\\n]{1,2048}$",
      "description": "A captured process listing contains a non-httpd process under a web-service account. Validate the executable and parent; legitimate helper processes can match.",
      "source": "",
      "required_any_literal": [
        "nobody",
        "daemon"
      ]
    },
    {
      "id": "startup_python_content",
      "regex": "^[ \\t]*(?!#)[^\\r\\n]{0,512}\\bpython(?:[23](?:\\.\\d+)?)?\\b",
      "path_regex": "(?:^|/)(?:flash/)?nsconfig/rc\\.netscaler$",
      "description": "Python in startup configuration; compare with authorized configuration.",
      "source": "",
      "required_any_literal": [
        "python"
      ]
    }
  ]
}