From 711c42b270acbcdeb09fad0ab46c81ca18cd4b3b Mon Sep 17 00:00:00 2001 From: StasonJatham Date: Thu, 1 Oct 2026 23:08:50 +0200 Subject: [PATCH] Initial release: offline NetScaler triage with Sigma rules and MIT license --- .gitignore | 12 + .python-version | 1 + LICENSE.txt | 21 + README.md | 149 + README.txt | 190 + RULES.txt | 247 + THREAT_INTELLIGENCE.txt | 476 + VALIDATION.txt | 133 + config/threat_intel.json | 20000 ++++++++++++++++++ examples/rules.json | 17 + examples/rules.yml | 23 + examples/time.json | 5 + pyproject.toml | 60 + src/netscaler_triage/__init__.py | 3 + src/netscaler_triage/__main__.py | 3 + src/netscaler_triage/cli.py | 457 + src/netscaler_triage/config_loading.py | 195 + src/netscaler_triage/correlation.py | 92 + src/netscaler_triage/data/public_sigma.yml | 13164 ++++++++++++ src/netscaler_triage/data/threat_intel.json | 20000 ++++++++++++++++++ src/netscaler_triage/decoding.py | 328 + src/netscaler_triage/engine.py | 449 + src/netscaler_triage/indicators.py | 94 + src/netscaler_triage/ingest.py | 392 + src/netscaler_triage/matching.py | 254 + src/netscaler_triage/parsing.py | 197 + src/netscaler_triage/preparation.py | 453 + src/netscaler_triage/sigma_rules.py | 357 + tests/test_archive_password.py | 62 + tests/test_cli.py | 113 + tests/test_command_probes.py | 65 + tests/test_config_loading.py | 177 + tests/test_correlation.py | 70 + tests/test_decoding.py | 58 + tests/test_easy_cli.py | 214 + tests/test_encoding_gate.py | 102 + tests/test_engine.py | 143 + tests/test_indicator_matching.py | 97 + tests/test_indicators.py | 42 + tests/test_ingest.py | 129 + tests/test_intel_inventory.py | 171 + tests/test_parsing.py | 88 + tests/test_preparation.py | 173 + tests/test_public_boundaries.py | 95 + tests/test_public_defaults.py | 69 + tests/test_release_hygiene.py | 65 + tests/test_review.py | 86 + tests/test_rule_details.py | 105 + tests/test_sigma_integration.py | 132 + tests/test_sigma_rules.py | 173 + typing_stubs/pyzipper/__init__.pyi | 25 + uv.lock | 996 + 52 files changed, 61222 insertions(+) create mode 100644 .gitignore create mode 100644 .python-version create mode 100644 LICENSE.txt create mode 100644 README.md create mode 100644 README.txt create mode 100644 RULES.txt create mode 100644 THREAT_INTELLIGENCE.txt create mode 100644 VALIDATION.txt create mode 100644 config/threat_intel.json create mode 100644 examples/rules.json create mode 100644 examples/rules.yml create mode 100644 examples/time.json create mode 100644 pyproject.toml create mode 100644 src/netscaler_triage/__init__.py create mode 100644 src/netscaler_triage/__main__.py create mode 100644 src/netscaler_triage/cli.py create mode 100644 src/netscaler_triage/config_loading.py create mode 100644 src/netscaler_triage/correlation.py create mode 100644 src/netscaler_triage/data/public_sigma.yml create mode 100644 src/netscaler_triage/data/threat_intel.json create mode 100644 src/netscaler_triage/decoding.py create mode 100644 src/netscaler_triage/engine.py create mode 100644 src/netscaler_triage/indicators.py create mode 100644 src/netscaler_triage/ingest.py create mode 100644 src/netscaler_triage/matching.py create mode 100644 src/netscaler_triage/parsing.py create mode 100644 src/netscaler_triage/preparation.py create mode 100644 src/netscaler_triage/sigma_rules.py create mode 100644 tests/test_archive_password.py create mode 100644 tests/test_cli.py create mode 100644 tests/test_command_probes.py create mode 100644 tests/test_config_loading.py create mode 100644 tests/test_correlation.py create mode 100644 tests/test_decoding.py create mode 100644 tests/test_easy_cli.py create mode 100644 tests/test_encoding_gate.py create mode 100644 tests/test_engine.py create mode 100644 tests/test_indicator_matching.py create mode 100644 tests/test_indicators.py create mode 100644 tests/test_ingest.py create mode 100644 tests/test_intel_inventory.py create mode 100644 tests/test_parsing.py create mode 100644 tests/test_preparation.py create mode 100644 tests/test_public_boundaries.py create mode 100644 tests/test_public_defaults.py create mode 100644 tests/test_release_hygiene.py create mode 100644 tests/test_review.py create mode 100644 tests/test_rule_details.py create mode 100644 tests/test_sigma_integration.py create mode 100644 tests/test_sigma_rules.py create mode 100644 typing_stubs/pyzipper/__init__.pyi create mode 100644 uv.lock diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..488e9a5 --- /dev/null +++ b/.gitignore @@ -0,0 +1,12 @@ +.venv/ +.runtime/ +__pycache__/ +*.pyc +.ruff_cache/ +results/ +dist/ +*.egg-info/ +*.log +private/ +.mypy_cache/ +.DS_Store diff --git a/.python-version b/.python-version new file mode 100644 index 0000000..9b8fe2f --- /dev/null +++ b/.python-version @@ -0,0 +1 @@ +3.14.8 diff --git a/LICENSE.txt b/LICENSE.txt new file mode 100644 index 0000000..fb190e8 --- /dev/null +++ b/LICENSE.txt @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 NetScaler Triage contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md new file mode 100644 index 0000000..36b23d9 --- /dev/null +++ b/README.md @@ -0,0 +1,149 @@ +# NetScaler Triage + +Offline forensic triage for Citrix NetScaler ADC and Gateway logs. Point it at a +folder or archive to find suspicious requests, public indicators, encoded +payloads, update records and related events across logs. + +Original inputs are not modified. Payloads are decoded as data, never executed +or downloaded. A finding is an investigation lead, **not proof of compromise**. + +## Quick start + +Requires **Python 3.14 or newer**. + +```sh +git clone https://tea.karlcom.de/karl/NetScaler_forensik.git +cd NetScaler_forensik +python3 -m venv .venv +source .venv/bin/activate +python -m pip install . +netscaler-triage ./logs.7z +``` + +On Windows PowerShell, create and activate the environment with: + +```powershell +py -3.14 -m venv .venv +.venv\Scripts\Activate.ps1 +python -m pip install . +netscaler-triage .\logs.7z +``` + +Installation may require internet access. Analysis runs offline. + +## Everyday use + +```sh +# Unpacked logs, an archive, or multiple appliance exports +netscaler-triage ./logs +netscaler-triage export.tar.gz +netscaler-triage ./appliance-a ./appliance-b export.zip + +# Discover inputs in the current directory +netscaler-triage + +# Encrypted archive: prompt for a password without displaying it +netscaler-triage export.7z --password +``` + +ZIP (including ZipCrypto/AES), TAR, TAR.GZ/TGZ, GZIP and 7z inputs are supported, +including nested archives within preparation limits. Unsupported formats are +reported. `--password VALUE` is also supported, but can expose the password in +shell history or process listings. Passwords are not stored in results. + +The tool prints the result directory. Use `--output PATH` to choose a new one; +existing results are not overwritten. Appliance grouping is inferred from +directories; review the preparation manifest for unusual export layouts. + +## Read the results + +| File | Purpose | +| --- | --- | +| `summary.json` | Processing status, counts and incomplete coverage | +| `findings.jsonl` | Events, source lines, matching rules and decoding explanations | +| `IOCS.csv` | Exact SIEM search values and separate defanged display values | +| `updates.jsonl` | Installation and software-version evidence | +| `correlations.jsonl` | Related events on the same appliance; temporal candidates, not causal proof | +| `coverage.json` | Per-file coverage and errors | +| `input_manifest.json` | Original relative paths and SHA-256 checksums | +| `preparation_manifest.json` | Archive preparation and appliance grouping | + +The output also includes an SQLite event index, effective configuration and +indicator/hash hit files. JSONL contains one JSON object per line. URL/Base64 +decoding retains original values, transformation steps, checksums and errors. +An installer command alone does not establish successful patch completion. + +## Add indicators and Sigma rules + +Put your packs in a directory and validate them before scanning: + +```sh +netscaler-triage rules --config ./my-rules +netscaler-triage ./logs --config ./my-rules +``` + +Directories load Sigma YAML, JSON, CSV and TXT recursively. Repeat `--config` +to combine packs. No Python changes are needed to add an IP, path or rule. +For example, an IOC CSV can contain: + +```csv +type,value,status,source,description +ipv4,192.0.2.42,reference_only,local-review,Investigate matching events +path,/example/suspicious-file,reference_only,local-review,Check file context +``` + +These are synthetic examples. Use original, non-defanged values for matching. +TXT accepts one value per line; unambiguous IP addresses, SHA-256 hashes, URLs +and Unix paths are inferred. Other values remain literal strings. + +Sigma is parsed with pySigma and evaluated locally using the subset documented +in [RULES.txt](RULES.txt). Unsupported features fail explicitly. Sigma metadata +does not bypass detection conditions. Rule packs are data, not executable plugins. + +Defaults include 47 Sigma rules and 246 public reference indicators. Attribution +and limitations are recorded in [THREAT_INTELLIGENCE.txt](THREAT_INTELLIGENCE.txt) +and [config/threat_intel.json](config/threat_intel.json). This is a dated reference +collection, not a promise of exhaustive intelligence or zero false positives. + +Keep confidential packs in `private/`, excluded from Git and release archives. +Load them explicitly. Never put customer logs or generated findings in a public +repository. Examples under [examples/](examples/) use synthetic data. + +## Limits and interpretation + +- Exit `0`: configured processing completed; **not** a clean-system verdict. +- Exit `2`: an error or incomplete processing; inspect `summary.json`. +- Missing years/timezones are not guessed. See [README.txt](README.txt) for time configuration. +- Binary appliance logs may need an external decoder. Decode failures can also come from ordinary text. +- Damaged inputs and regex timeouts are reported. Archive path traversal, unsafe links and exhausted quotas stop preparation. +- Processing uses one worker, incremental reads and disk-backed SQLite. There is no hard process-wide RAM/CPU quota or automatic resume. +- Default limits: 2 GiB preparation budget, 100,000 archive entries, depth 3, 1 MiB per line and 512 MiB expanded per log file. Advanced options can raise limits. + +Tests were executed on macOS/ARM64. Windows and Linux instructions are provided, +but those platforms have not yet been validated in the recorded test environment. + +## Help and development + +```sh +netscaler-triage --help +netscaler-triage scan --help-all +netscaler-triage decode payload.txt +netscaler-triage inventory ./logs + +uv sync --locked +uv run python -W error -m unittest discover -s tests +uv run mypy +uv run ruff check src tests typing_stubs +uv run ruff format --check src tests typing_stubs +uv build +``` + +See [README.txt](README.txt) for the detailed plain-text manual and +[VALIDATION.txt](VALIDATION.txt) for test scope and known coverage limits. + +## License + +Project code is licensed under the [MIT License](LICENSE.txt). +Third-party dependencies and referenced external materials retain their own +licenses. Source attribution does not imply affiliation with Citrix or the +referenced researchers, and does not relicense their original publications. diff --git a/README.txt b/README.txt new file mode 100644 index 0000000..38af2dd --- /dev/null +++ b/README.txt @@ -0,0 +1,190 @@ +NETSCALER TRIAGE + +Offline log triage for NetScaler ADC and Gateway. +Give it a log folder or archive. It prepares the input, searches for suspicious +patterns and public indicators, explains matching rules and decoded command text, +finds update/version records, and links related events on the same appliance. +Original files are not modified. Payloads are never executed or fetched. + +INSTALL + +Requires Python 3.14 or newer. From the unpacked source folder, on macOS/Linux: + python3 -m venv .venv + source .venv/bin/activate + +Or on Windows PowerShell: + py -m venv .venv + .venv\Scripts\Activate.ps1 + +Then install the local project: + python -m pip install . + +A built wheel can instead be installed with python -m pip install PATH_TO_WHEEL. +For a locked developer installation, use uv sync --locked with a suitable +installed Python interpreter. The lockfile records exact dependency versions. +Installation may need internet access; analysis itself runs offline. + +START HERE + + netscaler-triage logs.7z + +Or use an unpacked folder: + netscaler-triage ./logs + +Or run inside the folder containing your logs: + netscaler-triage + +ZIP, TAR, TAR.GZ/TGZ, GZIP and 7z are detected automatically, including nested +archives. Unsupported formats are reported. Several inputs can be combined: + netscaler-triage ./appliance-a ./appliance-b another-export.zip + +The result folder is created automatically and printed when the run finishes. +--output PATH chooses a new result folder. Existing results are never overwritten. +Appliance groups are inferred from folder structure; review the preparation +manifest when a combined export has an unusual layout. + +For an encrypted archive, request a hidden password prompt: + netscaler-triage logs.7z --password + +--password VALUE also works, but may expose the password in shell history or +process listings. The same password is used for nested archives. 7z, ZipCrypto +and AES-ZIP are supported. Passwords are not saved in results. + +WHAT TO READ FIRST + +summary.json tells you what was processed and whether anything was incomplete. +findings.jsonl contains selected events, original source/line references, matching +rule details, extracted indicators and safe decoding steps with explanations. +Each line is a separate JSON object. Explanations describe what command text +could do; they do not establish that it ran successfully. + +IOCS.csv contains exact values for SIEM searches and a separate defanged display +value. Observed values are candidates, not an automatic blocklist. +updates.jsonl contains update/version evidence. An installer command is not by +itself proof of a completed patch. correlations.jsonl contains temporal candidates +between log files on the same appliance, not proof of causation. + +Other outputs support verification: + evidence.sqlite On-disk event index + coverage.json Per-file coverage and read/matching errors + input_manifest.json Original relative paths and SHA-256 checksums + configuration.json Effective rules, references and time assumptions + indicator_hits.csv Matches against configured reference indicators + file_hash_hits.json Reference matches against original file SHA-256 + preparation_manifest.json Preparation actions, groups and exclusions + inputs/ Prepared inputs when automatic preparation runs + +URL/Base64 transformations retain the original value, transformation, parent +step, decoded result or error, and checksum. Binary decoded content is displayed +as hex and is not executed. Finding rule_details retain matching rule descriptions +and source metadata; custom packs can provide their own explanations. + +ADD YOUR OWN RULES OR IOCS + +Bundled public references are loaded automatically. They are a dated, attributed +collection, not a claim to cover every known attack. No private case addresses, +appliance identities or environment-specific assumptions are included in defaults. +References are not downloaded during a scan. + + netscaler-triage ./logs --config examples/rules.yml + netscaler-triage ./logs --ioc-file indicators.txt + netscaler-triage ./logs --pattern "(?i)your_search_expression" + +Repeat --config or --ioc-file to combine packs. An explicit --config directory +loads supported packs recursively in sorted relative-path order; no private or +customer directory is loaded unless you select it. + + netscaler-triage ./logs --config ./my-rules + Sigma YAML is the primary rule +format, parsed with pySigma and evaluated locally with the supported subset in +RULES.txt. Unsupported features are rejected explicitly. Defaults include 47 +Sigma rules and 246 deduplicated public reference indicators. +THREAT_INTELLIGENCE.txt indexes all 52 sources, uses and limitations; +config/threat_intel.json is the complete machine-readable inventory. + +JSON, CSV and one reference per line in TXT remain supported. TXT infers clear +IP addresses, SHA-256 hashes, HTTP(S) URLs and absolute Unix paths; other text +stays literal. Explicit CSV/JSON types are unchanged. An exported IOCS.csv +can be loaded again. Examples contain synthetic values, not real intelligence. +Keep local case rules under private/, which is gitignored and excluded from +release builds; load them explicitly with --config private/your_rules.yml. +Private packs are never discovered or enabled automatically. +Example files are included in the source release. +Rule packs are data files. Python plugin code is not loaded from them. + +TIME AND DEVICE IDENTITY + +Explicit timestamps are retained. A missing year or timezone is not guessed. +For known time settings and explicit appliance names on prepared folders: + netscaler-triage scan --input ADC-A=./logs --year 2026 --timezone ADC-A=UTC + +Use your actual device settings; UTC and the year above are examples only. +Ambiguous daylight-saving times remain unresolved. Time assumptions and per-file +year overrides can be supplied using --time-config; see examples/time.json. + +LIMITS AND INCOMPLETE RESULTS + +Exit 0 means the configured processing completed, not that the appliance is clean. +Exit 2 means an error or incomplete processing; inspect summary.json. +Invalid decoding candidates may be ordinary text, not malicious payloads. +Unknown text formats remain searchable, even if no timestamp is parsed. +Proprietary binary logs require an appropriate external decoder. + +Unreadable files, damaged archives and regex timeouts are recorded while other +valid inputs continue. Path traversal, unsafe links and exhausted archive quotas +stop preparation. A controlled interruption preserves the processed database +where possible. There is no automatic resume after interruption. + +A single worker reads lines incrementally. SQLite stores events and large sorts +on disk; small decoding caches are bounded. One CPU core can be busy. This is not +a hard process-wide RAM or CPU quota: archive metadata, large rule lists and file +inventories need additional memory. Allow disk space for preparation and results. + +Defaults: 2 GiB preparation budget, 100,000 archive entries, nesting depth 3, +1 MiB per line and 512 MiB expanded per log file. Limits never mean a silent +successful scan. Advanced options can raise them for legitimate larger inputs. + +HELP AND OPTIONAL COMMANDS + + netscaler-triage --help + netscaler-triage scan --help-all + netscaler-triage extract logs.7z prepared + netscaler-triage decode payload.txt + netscaler-triage indicators text.txt + netscaler-triage inventory ./logs + +Short help shows common options. Advanced help includes resource limits, time +assumptions and --no-default-patterns, which disables built-in rules and bundled +public references; explicitly supplied packs still apply. + +DEVELOPMENT AND RELEASE + + uv run python -W error -m unittest discover -s tests + uv run mypy + uv run ruff check src tests typing_stubs + uv run ruff format --check src tests typing_stubs + uv build + +Synthetic tests cover parsing, archive safety, decoding, matching, correlations +and packaging hygiene. VALIDATION.txt records what was actually tested. Runtime +environments and analysis outputs are not release files. Source distributions +use an explicit allowlist to avoid bundling unrelated documents or case settings. + +LICENSE + +Project code is licensed under the MIT License; see LICENSE.txt. +Third-party dependencies and referenced external materials retain their own +licenses. The project does not relicense original external publications. + +VALIDATE PACKS BEFORE A SCAN + + netscaler-triage rules --config ./my-rules + +This offline command loads and compiles the bundled defaults and selected packs, +then prints the Sigma rule, regex rule and explicit active indicator counts. It +does not prepare or scan logs, contact external services or create artifacts. +Use --no-default-patterns to validate only the selected files; --json gives a +machine-readable result. Invalid Sigma, unsupported rules and conflicting rule +identifiers fail validation. Syntax validation does not prove detection quality. +Directory discovery skips README.txt, LICENSE.txt and CHANGELOG.txt documents +(case-insensitive); an explicitly named TXT file still loads as references using TXT type inference. diff --git a/RULES.txt b/RULES.txt new file mode 100644 index 0000000..588c0aa --- /dev/null +++ b/RULES.txt @@ -0,0 +1,247 @@ +RULE PACKS AND IOC LISTS + +A pack is loaded with --config; repeat the option to combine packs. Matching is +offline. YAML files are genuine Sigma detection rules parsed by official pySigma. +The local evaluator supports the explicit subset below, not full Sigma semantics. +JSON, CSV and TXT remain supported as described in LEGACY JSON PACKS below. + +Bundled data/public_sigma.yml provides 47 rules: 41 behavior rules and six IOC +groups containing 246 attributed public references. These are not local findings. +Use --no-default-patterns to disable bundled defaults. Private packs are opt-in; +keep them in the ignored private/ directory and load them explicitly: + +netscaler-triage ./logs --config examples/rules.yml +netscaler-triage ./logs --config private/rules.yml --config private/more-rules.yml + +SUPPORTED SIGMA SUBSET + +examples/rules.yml is a synthetic example with a UUID and provenance. Separate +rules with ---. IDs, or titles when IDs are absent, must be unique within a pack. +Use stable unique IDs across packs. Rules supply detections, not executable code. + +Required logsource product: netscaler. Optional service must equal the normalized +event kind: http_access, http_error, syslog, shell_log or unknown. Omit service to +include all kinds. Other products, categories, custom logsource attributes and +custom taxonomies are rejected. A descriptive definition adds no filtering logic. + +Supported detection semantics: + Keyword lists: substring matching against raw; list entries use OR. + Field maps: fields use AND; values in a list normally use OR. + Strings: case-insensitive; * and ? are Sigma wildcards with standard literal + wildcard escaping. Field strings match the complete field value. + Modifiers: contains, startswith, endswith, re and all, including combinations + accepted by pySigma. all requires every listed value to match. + Regex: search semantics; case-sensitive unless inline flags such as (?i) + change it. The configured regex timeout applies. + Null: matches a missing or null field. Numeric/Boolean comparisons preserve + value types; integer 200 and string "200" differ. + Conditions: and, or, not, parentheses, 1 of and all of selector patterns or + them. A list of conditions is evaluated with OR. + +Unsupported rules fail at loading, without silent reinterpretation. Rejected +constructs include aggregation, Sigma correlation rules, filters, collection +actions, timeframe, backend pipelines, placeholders and modifiers such as cidr, +exists, base64, fieldref or cased. This evaluator does not generate SIEM queries. +The separate event correlation stage does not implement Sigma correlation rules. + +NORMALIZED FIELDS AND DECODED VIEWS + +Parsed fields are flattened, then top-level event metadata is overlaid. Names are +case-insensitive. Common fields, available only when present in the input, are: + raw, kind, appliance, source, line, timestamp + source_ip, uri, user_agent, method, protocol, status, bytes, referer + session_id, transaction_id, request_id, context, return_code, command_status + sha256 + +source is the relative log filename. src/client_ip alias source_ip; _raw/message +alias raw. HTTP status is an integer. sha256 is a list of hashes of successfully +transformed payload bytes; it is not evidence of execution. List-valued string +fields match if any item matches. Other field names can be matched when supplied +by a caller, but are not automatically extracted. Decoded SHA-1 and MD5 fields +are not calculated by the engine. Missing fields are not invented. + +Sigma is evaluated once per event against its original view and available +successfully decoded text views. Decoded views replace raw only, never uri, +user_agent, source_ip or other structured fields. A rule can therefore combine +decoded content with the original request context and explicit exclusions. + +rule_details preserves ID/name/title/description/references/level/falsepositives, +source and basis. raw identifies the original event view, including structured +fields. For decoded:N, sigma_decoded_views[N] identifies the corresponding entry +in the event's decoding list. Structured-only matches are not attributed to +unrelated decoded views. A matching view is not evidence that a payload ran. + +Optional custom indicators metadata contains type/value/status plus provenance. +It is retained only as provenance, not as unconditional IOC checks. To activate +an independent indicator, provide an explicit CSV, TXT or JSON indicator pack. +This prevents catalog values from bypassing a Sigma condition. Catalog arrays +are excluded from each hit's custom_attributes to avoid repeated large exports. +Metadata does not replace the actual Sigma detection/condition definition. + +LIMITS AND COVERAGE + +Per YAML file: 4 MiB UTF-8 input, at most 256 documents, bounded token count, +32 nesting levels and 10,000 nodes per compiled condition. Anchors, aliases, +custom YAML tags and duplicate mapping keys are rejected. Unsupported rules +cause a startup error. Per event: at most 64 decoded views and 1,048,576 characters +per evaluated string field or decoded view, in addition to ingestion byte limits. +Referenced list fields are limited to 10,000 elements. Unreferenced metadata is +not evaluated. Sigma IDs must be unique across all selected packs. +Timeouts and SigmaEvaluationLimit preserve the affected event, record incomplete +matching, mark coverage partial and allow later records to be processed. They are +neither negative findings nor proof of attacks. + +Custom metadata repeated per hit is limited to 16 KiB serialized JSON. Each rule +may provide at most 10,000 catalog rows, each limited to 128 KiB; type/value strings +are limited to 65,536 characters. Pack-size limits also apply. + +Sigma references: +https://sigmahq.io/sigma-specification/specification/sigma-rules-specification.html +https://sigmahq-pysigma.readthedocs.io/en/latest/reference/collection.html + +LEGACY JSON PACKS + +A UTF-8 JSON pack may contain patterns and indicators. Bundled defaults still +apply unless explicitly disabled. The following address is documentation-only. + +Minimal example: + +{ + "patterns": [ + { + "id": "custom_download_command", + "pattern": "(?i)\\b(?:curl|wget)\\s+https?://", + "description": "A download command appears in the log. Verify its arguments, origin and whether it executed." + } + ], + "indicators": [ + {"type": "ipv4", "value": "192.0.2.42", "status": "reference_only"} + ] +} + +The address is a documentation example, not an attack indicator. +A complete synthetic pack is available in examples/rules.json. + +PATTERNS + +patterns is a list of objects with pattern (a regex) and an optional stable id. +description explains why a match may matter without claiming an attack succeeded. +source/source_id/sources can identify provenance. Use distinct IDs across packs. +Matched rule metadata is retained in rule_details, including matches after safe +decoding. Keep rules specific: broad matches on ordinary IPs or login messages +can create large, low-value result sets. Inline flags such as (?i) control case. +Regex timeouts mean incomplete checks, not negative results. + +INDICATORS + +indicators is a list with type, value and optional status and source. +Common types: ipv4, ipv6, domain, url, path, sha256 and literal. Use original values, +not defanged display strings. IP boundaries are checked. SHA-256 values are checked +against original file bytes and successfully decoded bytes, as well as log text. +Other hash-shaped text can be extracted; file hashing computes SHA-256 only. + +Status records context; it does not suppress the source event: + reference_only Published or supplied reference, not a local verdict + authorized_test An explicitly identified permitted test + context_only Environment/context value, not automatically hostile + +Document sources in a top-level sources list with id, title and url. Preserve +dates, attribution and uncertainty. A reference match is a lead; establish its +local role from the actual log fields. + +OTHER INPUT FORMATS + +TXT: one reference per line; blank lines and lines starting with # are ignored. +Unambiguous IPv4/IPv6 addresses, 64-digit hexadecimal SHA-256 hashes, HTTP(S) +URLs and whitespace-free absolute Unix paths receive their matching type. IP +boundaries then prevent 192.0.2.1 from matching 192.0.2.10. Other text, including +multiword commands, stays literal. CSV/JSON explicit types remain unchanged. +CSV: type,value,status, or indicator_type,indicator,status. The tool's IOCS.csv +output can be used directly. A legacy ip column is also accepted. +Legacy rule CSV: ID,Muster, where Muster contains the regex expression. +JSON: the pack object above, or a list of pattern objects. + +TIME CONFIGURATION + +--time-config accepts JSON with year, timezones and file_years. timezones maps +explicit appliance labels to IANA timezones. file_years maps APPLIANCE/relative/log +to a year when a specific yearless file needs an override. Example: + +{ + "year": 2026, + "timezones": {"ADC-A": "UTC"}, + "file_years": {"ADC-A/messages.previous": 2025} +} + +These values are examples, not inferred settings. Explicit timestamps take +precedence. Choose assumptions based on the actual evidence. + +PUBLIC INTELLIGENCE PROVENANCE + +The bundled threat_intel.json is the canonical inventory. Indicators are unique +by type and normalized value, with stable IDs. source_ids/source_urls enumerate +all reporting sources; observations retain each source's role, confidence, dates, +original status and any MISP direction/to_ids conflicts. The source field can +contain multiple source IDs after deduplication. Reference-only matching does +not turn shared infrastructure, scanner markers or historical IOCs into confirmed +attackers. context_only and observation_category retain those distinctions. + +Sources list retrieval attempts, requested URLs, access limitations and linked +indicator/rule IDs. Excluded observables and external whole-file YARA libraries +remain inventoried with reasons, without claiming equivalent Sigma coverage. +THREAT_INTELLIGENCE.txt provides the readable index. + +Percent decoding, Base64 (including padding-free candidates) and nested layers +feed both IOC and Sigma matching. Raw records remain unchanged. The candidate +gate uses encoding evidence; arbitrary obfuscation is not exhaustively decoded. +A plain indicator match, a decoded byte hash and a source-file hash are different +evidence types. Do not interpret a textual pathname as proof that a file exists. + +ADDING RULES WITHOUT CHANGING CODE + +Create a directory such as my-rules and put Sigma YAML, JSON, CSV or TXT packs +inside it. Load it explicitly: + netscaler-triage ./logs --config ./my-rules +Repeat --config for additional files or directories. Directory discovery is +recursive and sorted by relative filename; repeated identical files load once. +Hidden entries, __pycache__ and node_modules directories are ignored. Symlinks +are rejected. Unsupported file extensions inside a directory are ignored. +An empty directory or a malformed supported pack produces a named error. +Discovery is bounded to 64 files, 4096 directories and 32 nested levels. Each +Sigma file is limited to 4 MiB; other formats to 16 MiB; the total is 32 MiB. +No customer or private pack is activated automatically. + +For exact IP or path references, create my-rules/local.csv: + type,value,status,source,description + ipv4,192.0.2.9,authorized_test,local,Approved external test + path,/example/suspicious-file,reference_only,local,Investigate file context + +The addresses and paths above are synthetic examples. Extra CSV columns such as +source, description, confidence and evidence are preserved verbatim. This also +applies to legacy ID,Muster regex CSV files. Use JSON when metadata requires +structured lists or nested objects. Keep reference values in their original +form rather than defanged display form; matching does not establish compromise. + +VALIDATE PACKS BEFORE A SCAN + + netscaler-triage rules --config ./my-rules + +This offline command loads and compiles the bundled defaults and selected packs, +then prints the Sigma rule, regex rule and explicit active indicator counts. It +does not prepare or scan logs, contact external services or create artifacts. +Use --no-default-patterns to validate only the selected files; --json gives a +machine-readable result. Invalid Sigma, unsupported rules and conflicting rule +identifiers fail validation. Syntax validation does not prove detection quality. +Directory discovery skips README.txt, LICENSE.txt and CHANGELOG.txt documents +(case-insensitive); an explicitly named TXT file still loads as references using TXT type inference. + +TYPED INDICATOR MATCHING + +IP addresses and hashes require complete token boundaries. Domain indicators +also match subdomains, but not concatenated names or unrelated suffixes. Paths +are case-sensitive; a trailing slash denotes a directory prefix. URL schemes +and authorities are case-insensitive, while paths and queries are exact. +Typed indicators prevent incidental substrings from becoming matches. Use an +explicit regex rule when different matching semantics are needed. A reference +match or an authentication failure is not automatically malicious; preserve +status and provenance and evaluate the surrounding event. diff --git a/THREAT_INTELLIGENCE.txt b/THREAT_INTELLIGENCE.txt new file mode 100644 index 0000000..8b3728b --- /dev/null +++ b/THREAT_INTELLIGENCE.txt @@ -0,0 +1,476 @@ +PUBLIC THREAT INTELLIGENCE INVENTORY + +Review date: 2026-10-01 + +52 source records; all 37 distinct URLs supplied for this review checked. +246 unique indicator values; 41 behavior patterns; 47 Sigma rules. + +CANONICAL DATA AND TRACEABILITY + +config/threat_intel.json is the complete inventory in the source release. +The installed package includes identical data/threat_intel.json and public_sigma.yml. +Each IOC has a stable ID, literal type/value and all source observations. Those +observations retain reporting context, confidence, source dates and roles. MISP +attribute types, comments and to_ids flags are retained even when they conflict. +Each source links to the indicator IDs and Sigma rule IDs derived from it. +Raw articles, downloaded source files and private evidence are not release data. + +The exact requested URLs and subsequent alternate/raw URLs are distinct records. +HTTP 200 alone does not mean content was accessible: the VirusTotal collection +returned an application shell. The GreyNoise live tag was blocked. Neither was +used to infer additional collection membership. The original Deyda script URL +returned 404; the current filename was discovered from its repository tree. +Citrix/ACSC direct retrieval errors are recorded alongside successful rendered +page reviews. Undisclosed Citrix/Nextron matching logic is not reproduced. + +MATCHING AND INTERPRETATION + +Public references load automatically. Private packs remain explicitly opt-in +under gitignored private/ and are excluded from release archives. +URL and Base64 decoding, including nested/padding-free candidates, feeds the +same Sigma/IOC matches. Raw events, transformation chains and hash evidence +remain available. Encoding detection is bounded and heuristic, not exhaustive. + +Shared WARP infrastructure, scanner/test markers, historical 2025 indicators +and tentative C2 associations keep their original qualifications. These are +investigation leads, not automatic firewall blocks or proof of compromise. +The legitimate customsnmpd path is inventoried but excluded from the standalone +Sigma path selector; a literal catalog occurrence remains contextual evidence. +Known-good baseline hashes are excluded from threat matching. + +The 683 generic webshell YARA rules referenced by the historical NCSC tools are +indexed in external_rule_sets, with their original names and source hashes. +They require their original whole-file/byte/offset semantics or concern other +platforms. They are not advertised as equivalent line-oriented Sigma rules. +A separate historical core-memory ROP signature likewise needs binary evidence. +Generic PHP and configuration-text hunting adaptations are labeled separately. + +No malware payload URL was contacted and no fetched scanner or PoC was executed. + +SOURCE INDEX + +cisa-direct +CISA: Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway +https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway +Published: 2026-09-27; retrieved: 2026-10-01 +Requested URL: False; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Direct retrieval unavailable; the official mailing-list publication was reviewed as an alternative source. + +cisa +CISA bulletin distributed through GovDelivery +https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42cc465 +Published: 2026-09-27; retrieved: 2026-10-01 +Requested URL: False; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Full text reviewed. + +mandiant +Mandiant: Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances +https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances +Published: 2026-09-29; retrieved: 2026-10-01 +Requested URL: True; detection use: True +Linked IOC IDs: 12; linked Sigma rule IDs: 11 +Direct HTTP article verified. + +watchtowr +watchTowr command injection analysis +https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ +Published: 2026-09-28; retrieved: 2026-10-01 +Requested URL: True; detection use: True +Linked IOC IDs: 0; linked Sigma rule IDs: 2 +Read as technical evidence only; no PoC execution. Delayed processing means request status alone is inconclusive. + +levelblue +LevelBlue: Observed Exploitation Artifacts and Hunt Indicators +https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators +Published: 2026-09-30; retrieved: 2026-10-01 +Requested URL: True; detection use: True +Linked IOC IDs: 24; linked Sigma rule IDs: 3 +Direct HTTP article verified. + +truesec +Truesec: Multiple Critical Vulnerabilities +https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway +Published: 2026-09-28; retrieved: 2026-10-01 +Requested URL: True; detection use: True +Linked IOC IDs: 3; linked Sigma rule IDs: 0 +Direct HTTP403; article independently readable through web retrieval, including detection section. + +virustotal-mandiant +virustotal-mandiant +https://www.virustotal.com/gui/collection/c794f2e5d051c46cd2ff5e429128d7e68954ba78e66735fc69362ec726e63ee4 +Published: not established; retrieved: 2026-10-01T19:36:45.064779+00:00 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +HTTP200 JavaScript application shell; web retrieval failed. Collection contents not verified; registered access needed. No indicators inferred from collection. + +cert-eu +cert-eu +https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771 +Published: 2026-09-28T19:30:00+02:00; retrieved: 2026-10-01T19:36:45.064857+00:00 +Requested URL: True; detection use: True +Linked IOC IDs: 0; linked Sigma rule IDs: 2 +Direct HTTP403; article independently readable through web retrieval, including detection section. + +unit42 +unit42 +https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ +Published: 2026-09-30; retrieved: 2026-10-01T19:36:45.064965+00:00 +Requested URL: True; detection use: True +Linked IOC IDs: 31; linked Sigma rule IDs: 4 +Direct HTTP article verified. Page states updates Sep27 and Sep30 15:00 PT; current HTML published metadata Sep30, modification 2026-09-30T22:15:51Z. + +greynoise +greynoise +https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation +Published: 2026-09-28; retrieved: 2026-10-01T19:36:45.065290+00:00 +Requested URL: True; detection use: True +Linked IOC IDs: 4; linked Sigma rule IDs: 0 +Direct HTTP article verified. + +greynoise-tag +greynoise-tag +https://viz.greynoise.io/tag/citrix-netscaler-cve-2026-88771-login-command-injection-rce-attempt +Published: not established; retrieved: 2026-10-01T19:36:45.276736+00:00 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +HTTP403 and web retrieval failed. Dynamic tag membership unavailable; no IP inferred from tag. + +esentire +esentire +https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772 +Published: 2026-09-29; retrieved: 2026-10-01T19:36:45.424617+00:00 +Requested URL: True; detection use: True +Linked IOC IDs: 16; linked Sigma rule IDs: 1 +Direct HTTP article verified. + +beazley +beazley +https://labs.beazley.security/advisories/BSL-A1216 +Published: 2026-09-26; retrieved: 2026-10-01T19:36:45.510941+00:00 +Requested URL: True; detection use: True +Linked IOC IDs: 10; linked Sigma rule IDs: 0 +Direct HTTP article verified. Updated Sep29; secondary consolidation, attribution to originating reporters preserved. + +ifin-event +ifin-event +https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json +Published: 2026-09-28; retrieved: 2026-10-01T19:44:37.039091+00:00 +Requested URL: True; detection use: True +Linked IOC IDs: 68; linked Sigma rule IDs: 1 +Direct HTTP retrieval successful; attacker resources were not requested. + +ifin-manifest +ifin-manifest +https://misp.ifin.network/feed/manifest.json +Published: not established; retrieved: 2026-10-01T19:44:37.039380+00:00 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Direct HTTP retrieval successful; attacker resources were not requested. + +ifin-thread +ifin-thread +https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867 +Published: not established; retrieved: 2026-10-01T19:44:37.039382+00:00 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Direct HTTP retrieval successful; attacker resources were not requested. + +elastic-toml +elastic-toml +https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml +Published: 2026-09-28; retrieved: 2026-10-01T19:44:37.039384+00:00 +Requested URL: False; detection use: True +Linked IOC IDs: 0; linked Sigma rule IDs: 1 +Direct HTTP retrieval successful; attacker resources were not requested. + +rapid7 +rapid7 +https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/ +Published: 2026-09-28; retrieved: 2026-10-01T19:44:37.039385+00:00 +Requested URL: True; detection use: True +Linked IOC IDs: 4; linked Sigma rule IDs: 1 +Direct HTTP retrieval successful; attacker resources were not requested. + +arctic-wolf +arctic-wolf +https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md +Published: 2026-09-30; retrieved: 2026-10-01T19:44:37.039386+00:00 +Requested URL: False; detection use: True +Linked IOC IDs: 37; linked Sigma rule IDs: 5 +Direct HTTP retrieval successful; attacker resources were not requested. + +sygnia +sygnia +https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ +Published: 2026-09-30; retrieved: 2026-10-01T19:44:37.039387+00:00 +Requested URL: True; detection use: True +Linked IOC IDs: 15; linked Sigma rule IDs: 3 +Direct HTTP retrieval successful; attacker resources were not requested. + +CITRIX-CTX697096 +NetScaler security bulletin CTX697096 +https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscaler-gateway-security-bulletin-for-cve202688771-and-cve202688772.html +Published: not established; retrieved: 2026-10-01 +Requested URL: False; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Canonical article accessible; attachment query-form URL failed. Authoritative fixed builds and exposure preconditions; no public attack IOC list. CVE-88778 additionally requires the Enhanced ISN configuration change. Configuration exposure is not compromise evidence. + +CITRIX-SECURITY-BLOG-20260930 +NetScaler security guidance, updated September 30 +https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/ +Published: 2026-09-27; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Official article updated 2026-09-30. IOC logic available via Console/Support, not published here. Patching does not establish cleanup; rebuild when compromise is suspected. 13.1-64.24 avoids the documented 64.23 reboot issue where NS variables exist. Reader comments are not vendor IOC statements and are excluded. + +CITRIX-CTX694799 +Steps after suspected NetScaler compromise +https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html +Published: 2025-06-25; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Preserve disk, logs and memory; record timezone/NTP; isolate; rotate exposed credentials and revoke certificates/private keys; investigate connected systems; rebuild. Packet-engine core generation triggers warm restart. Not a passive log-detection signature. Canonical support listing records modification 2026-05-13. + +NETSCALER-CONSOLE-IOC +Console indicators-of-compromise detection +https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/ioc.html +Published: not established; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Telemetry required; BLX unsupported. Scan history and detection-logic updates are retained. No Compromise Detected is limited to current checks; failed/skipped scans are not negative findings. Detection internals absent; no invented equivalent rules. + +NETSCALER-FIM +File integrity monitoring +https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/file-integrity-monitoring.html +Published: 2026-09-07; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Compares same-build vendor hashes against appliance files; distinguishes modified and added files and scan errors. BLX unsupported. A local log archive cannot reproduce vendor binary-baseline verification, exclusions, ownership/runtime checks or live device signatures. + +NETSCALER-CONSOLE-RELEASES +Console service release notes +https://docs.netscaler.com/en-us/netscaler-console-service/release-notes/whats-new.html +Published: 2026-09-27; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +September 27 entry identifies CVE-88771 exposure through version scanning and recommends upgrade. Version-based exposure detection is separate from compromise detection and exact historical patch timing. + +NEXTRON-20260929 +THOR NetScaler detection coverage +https://www.nextron-systems.com/2026/09/29/new-thor-detection-coverage-for-citrix-netscaler-cve-2026-88771-and-cve-2026-88772/ +Published: 2026-09-29; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Article explicitly withholds rule matching strings/implementation. Its filesystem IOC subset covers 12 checks consolidated into four definitions; 22 checks requiring logs/config/process/ownership/permissions/runtime context are omitted. PoC file detection is not proof of exploitation. No undisclosed rules reconstructed. + +CERTFR-2026-ALE-011 +CERT-FR NetScaler alert +https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/ +Published: 2026-09-28; retrieved: 2026-10-01 +Requested URL: True; detection use: True +Linked IOC IDs: 0; linked Sigma rule IDs: 3 +Updated September 30. Reproduces Google DTLS/packet-engine hunting patterns and links YARA. Explicitly says ANSSI has not independently qualified them. Preserve original Google provenance and avoid counting duplicated patterns as independent confirmations. + +CIRCL-TR100 +CIRCL NetScaler critical vulnerabilities +https://circl.lu/pub/tr-100/ +Published: not established; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Accessible public advisory. Configuration prerequisites, version recommendations, forensic preservation, external SIEM logs and investigation of outbound/internal activity. No additional concrete attack addresses/hashes or detection implementation imported. + +ACSC-NETSCALER-20260930 +ACSC NetScaler advisory +https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/critical-vulnerabilities-in-citrix-netscaler-adc-and-citrix-netscaler-gateway-products +Published: 2026-09-28; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Updated September 30: investigate back to at least September 4, 2026. This is a minimum lookback, not proof earlier compromise was impossible. Updated introduction reports Australian exploitation; older background wording still says none reported, so retain update precedence. No public literal IOC table. + +watchtowr-dtls +watchTowr DTLS analysis +https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/ +Published: not established; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Packet fragmentation/ROP and memory corruption need packet/core evidence; no packet exploit logic is converted to a log success verdict. + +watchtowr-repo +watchTowr artifact generator repository +https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 +Published: not established; retrieved: 2026-10-01 +Requested URL: True; detection use: True +Linked IOC IDs: 2; linked Sigma rule IDs: 1 +Read source only. Active command injection generator, not a passive scanner. Example output paths classified as PoC markers. + +poppelgaard +Community CTX697096 checker +https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker +Published: not established; retrieved: 2026-10-01 +Requested URL: True; detection use: True +Linked IOC IDs: 143; linked Sigma rule IDs: 3 +Read script only. Retain attributed infrastructure and scanner lists separately; community compromise labels are not adopted as local verdicts. + +technion +Community NetScaler scanner +https://github.com/technion/netscaler_scanner +Published: not established; retrieved: 2026-10-01 +Requested URL: True; detection use: True +Linked IOC IDs: 3; linked Sigma rule IDs: 0 +Read source only. Adds author-reported theme webshell paths. Mandiant-derived checks keep original attribution. Build-only CVE-88778 conclusion is not imported. + +deyda-guide +Community assessment guide +https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/ +Published: not established; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Guide and corrected current script reviewed; no script executed. Known-clean platform hashes and normal diagnostic paths are not attack IOCs. + +deyda-requested-script +Requested community script path +https://github.com/Deyda/Security/blob/main/netscaler-ioc-check.sh +Published: not established; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Requested path unavailable (raw equivalent HTTP404). Repository tree identifies deyda-netscaler-ioc-check.sh as current filename. + +deyda-script +Current community assessment script +https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh +Published: not established; retrieved: 2026-10-01 +Requested URL: False; detection use: True +Linked IOC IDs: 7; linked Sigma rule IDs: 3 +Corrected filename discovered from repository tree. Read source only; no copied scanner execution or known-good hash import. + +ncsc-nl-2025 +NCSC-NL historical forensic checks +https://github.com/NCSC-NL/citrix-2025 +Published: 2025-08-06; retrieved: 2026-10-01 +Requested URL: True; detection use: True +Linked IOC IDs: 22; linked Sigma rule IDs: 2 +2025 campaign, not evidence of 2026 CVE coverage. Extracted string observables; binary ROP, image metadata, timestomping, permissions and live checks remain external. + +fox-it +Fox-IT forensic image triage +https://github.com/fox-it/citrix-netscaler-triage +Published: not established; retrieved: 2026-10-01 +Requested URL: True; detection use: True +Linked IOC IDs: 0; linked Sigma rule IDs: 1 +Read implementation. Core utility needs disk and RAM-disk evidence; string heuristics adapted with PHP context only. Expected SUID binaries are not attack IOCs. + +poppelgaard-script +Reviewed source component: poppelgaard-script +https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh +Published: not established; retrieved: 2026-10-01 +Requested URL: False; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Read-only source supporting parent repository review. + +technion-script +Reviewed source component: technion-script +https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh +Published: not established; retrieved: 2026-10-01 +Requested URL: False; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Read-only source supporting parent repository review. + +fox-ioc +Reviewed source component: fox-ioc +https://raw.githubusercontent.com/fox-it/citrix-netscaler-triage/main/iocitrix.py +Published: not established; retrieved: 2026-10-01 +Requested URL: False; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Read-only source supporting parent repository review. + +ncsc-checks +Reviewed source component: ncsc-checks +https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/checks.yaml +Published: not established; retrieved: 2026-10-01 +Requested URL: False; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Read-only source supporting parent repository review. + +ncsc-core-yara +Reviewed source component: ncsc-core-yara +https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/core-dump-checks/iocs.yar +Published: not established; retrieved: 2026-10-01 +Requested URL: False; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Read-only source supporting parent repository review. + +ncsc-live +Reviewed source component: ncsc-live +https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/live-host-bash-check/TLPCLEAR_check_script_cve-2025-6543-v1.8.sh +Published: not established; retrieved: 2026-10-01 +Requested URL: False; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Read-only source supporting parent repository review. + +watch-poc +Reviewed source component: watch-poc +https://raw.githubusercontent.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py +Published: not established; retrieved: 2026-10-01 +Requested URL: False; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Read-only source supporting parent repository review. + +ncsc-php_webshell_rules.yara +NCSC-referenced general webshell YARA collection +https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/yara/php_webshell_rules.yara +Published: not established; retrieved: 2026-10-01 +Requested URL: False; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Generic multi-platform historical webshell library, not campaign-specific NetScaler log rules. Indexed for external file/core scanning; no misleading line-by-line Sigma conversion. + +ncsc-thor-webshells.yar +NCSC-referenced general webshell YARA collection +https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/yara/thor-webshells.yar +Published: not established; retrieved: 2026-10-01 +Requested URL: False; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Generic multi-platform historical webshell library, not campaign-specific NetScaler log rules. Indexed for external file/core scanning; no misleading line-by-line Sigma conversion. + +requested-77a190a3 +requested-77a190a3 +https://github.com/elastic/detection-rules/blob/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml +Published: not established; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Exact requested URL retained for audit; see linked alternate retrievals. + +requested-7e6e5286 +requested-7e6e5286 +https://github.com/rtkwlf/wolf-tools/blob/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md +Published: not established; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Exact requested URL retained for audit; see linked alternate retrievals. + +requested-f8052bbe +requested-f8052bbe +https://support.citrix.com/external/article?articleNumber=CTX697096 +Published: not established; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Exact requested URL retained for audit; see linked alternate retrievals. + +requested-6c93ceb2 +requested-6c93ceb2 +https://www.elastic.co/guide/en/security/8.19/potential-netscaler-log-poisoning-command-injection-attempt.html +Published: not established; retrieved: 2026-10-01 +Requested URL: True; detection use: False +Linked IOC IDs: 0; linked Sigma rule IDs: 0 +Unavailable or not verified; no indicator invented. + +REPRODUCIBLE CHECKS + +uv run python -W error -m unittest discover -s tests +uv run mypy +uv run ruff check src tests typing_stubs + +The tests verify catalog uniqueness and source links, raw and decoded matches, +IP boundaries and preservation of encoding evidence. They do not establish +the truth of every vendor attribution or successful exploitation of a device. diff --git a/VALIDATION.txt b/VALIDATION.txt new file mode 100644 index 0000000..b84680c --- /dev/null +++ b/VALIDATION.txt @@ -0,0 +1,133 @@ +VALIDATION SCOPE + +CPython 3.14.8 on macOS/ARM64. Windows and Linux were not executed in this +validation environment. Synthetic path checks do not replace target-OS tests. + +CODE AUDIT + +134 tests passed with Python warnings treated as errors in 36.475 seconds. +Strict mypy passed for 35 source files. Ruff lint and format checks passed for +36 files. The enabled +lint families are E, F, I, UP, B, SIM, RUF and PERF; this is not a claim that every +optional rule from every analyzer is enabled. + +Reproduce from the source directory: + uv sync --locked + uv run python -W error -m unittest discover -s tests + uv run mypy + uv run ruff check src tests typing_stubs + uv run ruff format --check src tests typing_stubs + +Tests cover archive preparation, encrypted and nested archives, original file +preservation, multi-appliance parsing, time ambiguity, update evidence, bounded +decoding, defanging, rule packs, correlations, incomplete results, interruption +and release hygiene. Sigma tests exercise supported semantics, decoded views, +explicit unsupported-feature rejection and local matching limits. + +A separate sequential CLI matrix passed all 21 invocations with warnings fatal: +common and advanced help, scan/extract/decode/indicators/inventory, JSON output, +implicit folder and archive inputs, current-folder discovery of multiple +archives, encrypted 7z input, URL decoding and Base64 decoding. + +RELEASE INSTALLATION + +A wheel and source distribution were built. Locked runtime requirements were +exported with hashes and installed into a fresh virtual environment outside the +source tree, followed by the wheel without dependency resolution. Installed-package +verification is repeated after changes to code or bundled intelligence. Source +metadata is included so the packaging allowlist test remains active. +CLI help, bundled Sigma matching and the 246-entry public IOC catalog passed. + +The wheel includes 47 public Sigma rules and the attributed public reference +catalog. Private packs are opt-in, gitignored and excluded from both release +formats. Artifact inventories and text contents were checked for private +case indicators, identities, home paths, logs, evidence and runtime directories. +Tests and examples use synthetic documentation addresses. + +Runtime versions checked: pySigma 1.5.1, regex 2026.9.29, PyYAML 6.0.3, +py7zr 1.1.3, pyzipper 0.4.0, rich 15.0.0, rich-argparse 1.8.0, tzdata 2026.4. +The lockfile records all dependency versions. + +INTERPRETING RESULTS + +No private incident data is required to run these software tests. Independent +real-dataset findings are retained in separate customer case folders in their +BERICHT.txt reports, outside this shared tool and its release. +Original inputs are hashed before and after analysis. Forensic coverage limits +are retained even when software tests and code checks pass: binary logs, +ambiguous timestamps, invalid UTF-8 and failed decoding are not silently fixed. + +A match, decoded command or correlation is not proof of execution or compromise. +Passing software tests does not establish investigation completeness. The local +Sigma evaluator implements the subset documented in RULES.txt, not every Sigma +feature or a Splunk query exporter. + +Scanning is sequential with buffered input/output, bounded decoding caches and +an approximately 8 MiB SQLite page cache. File inventory, archive metadata, +custom rule packs and result volume still affect total process memory. There +is no hard process-wide CPU or RAM quota and no automatic parallel worker pool. + +INTELLIGENCE REFRESH CHECKS + +All 37 requested public URLs were retrieved or attempted and recorded, including +access errors, application-only responses and verified alternate source URLs. +The inventory has 52 sources, 246 unique indicators and 41 behavior patterns, +expressed as 47 Sigma rules. All source/indicator/rule joins are checked. + +Every catalog indicator has a literal positive test; 245 have raw and decoded +Sigma positives. The legitimate customsnmpd pathname is deliberately excluded +from standalone Sigma matching and retains its contextual catalog occurrence. +All IPv4 values are checked against prefix/suffix overmatching. HTTP tests cover +percent encoding, Base64, no padding, nesting, Referer and additional headers. +Original raw text and decoding spans remain verified. + +The preceding frozen baseline completed two independent real datasets: 2,405 +files and 4,043,139 records, with every original/reference hash preserved. That +full run predates this intelligence refresh and decoding-gate change. Its counts +and timings must not be presented as a full-run test of the updated rule pack. +Updated bounded real-data findings are retained in the corresponding customer +BERICHT.txt reports. Temporary verification outputs are not required runtime inputs. + +A separate frozen-baseline, warm-cache repeated-sample experiment used the same +30,720 records per mode: one/two/four processes took 12.555/6.230/3.913 seconds. +All twelve per-job outputs were semantically equivalent. Four processes used a +conservative aggregate peak sum of 262.9 MiB. This is a throughput experiment, +not an implemented parallel scanner, hard memory cap or full-archive forecast. + +The final gate also checks every public IOC encoded as padded and unpadded +Base64, including all-uppercase tokens and four-character encodings. Canonical +short/full-field decoding requires a printable UTF-8 roundtrip and is bounded +to 4-4096 characters. This does not attempt to decode every ordinary word. + +PREVIOUS INSTALLATION AND RUNTIME SMOKE CHECK + +The previous installed wheel passed all 106 tests with warnings treated as errors +in 28.839 seconds in a fresh environment outside the source tree. Locked +runtime installation used 33 dependencies. CLI help, default Sigma matching and +uppercase-only Base64 decoding passed. After relocating the interpreter into +the shared tool directory, the same 106 tests passed in 29.001 seconds and CLI +help passed again. Python imports and module paths no longer depend on an +obsolete analysis checkout. These checks validate software operation, not +customer-specific compromise conclusions. + +EXTENSIBLE RULE PACK REGRESSION + +The current source passes 134 tests, including recursive pack loading, offline +validation, typed indicator boundaries, overlapping references, contextual Sigma +conditions, numeric selectors, limits and encoded command probes. Catalog +metadata cannot bypass a Sigma condition. The release was rebuilt after these +changes. The older installed-wheel result above is not a test of this revision. + +A bounded private regression verified 19,625 original referenced log lines from +two separate investigations, including all 94 recorded finding families in the +earlier investigation. Public-rule matching completed without matching errors. +The case-IOC run recorded one literal matching timeout; an independent retry of +that original record completed with a finding and no matching error. The initial +partial coverage remains recorded; decoding-candidate errors are reported +separately and are not silently treated as successful decoding. + +The bounded regression is not a repeat of the earlier full 4,043,139-record run. +A subsequent Unicode literal-lookup guard has synthetic regression coverage, +but the entire private fixture set was not rerun after that guard. These checks +validate known examples and important negative cases, not zero false positives +or complete detection of all future attacks. Private evidence is not shipped. diff --git a/config/threat_intel.json b/config/threat_intel.json new file mode 100644 index 0000000..53c39f8 --- /dev/null +++ b/config/threat_intel.json @@ -0,0 +1,20000 @@ +{ + "schema_version": 2, + "updated": "2026-10-01", + "sources": [ + { + "id": "cisa-direct", + "url": "https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", + "title": "CISA: Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway", + "published": "2026-09-27", + "retrieved": "2026-10-01", + "campaign": "2026-09", + "access": "Direct retrieval unavailable; the official mailing-list publication was reviewed as an alternative source.", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "use_or_omission_reason": "Direct retrieval unavailable; the official mailing-list publication was reviewed as an alternative source.", + "requested": false + }, + { + "id": "cisa", + "url": "https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42cc465", + "title": "CISA bulletin distributed through GovDelivery", + "published": "2026-09-27", + "retrieved": "2026-10-01", + "campaign": "2026-09", + "access": "Full text reviewed.", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "use_or_omission_reason": "Full text reviewed.", + "requested": false + }, + { + "id": "mandiant", + "url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "title": "Mandiant: Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances", + "published": "2026-09-29", + "retrieved": "2026-10-01", + "campaign": "2026-09", + "access": "Full text reviewed without the language parameter; the ?hl=en URL variant was unavailable.", + "retrieved_utc": "2026-10-01T19:36:45.063963+00:00", + "http_status": 200, + "final_url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "bytes": 400523, + "sha256": "f89b6942e28d8b4de5f563f90f8fe74043e4135ff8415eea984511d3630edcb4", + "publication_date": "2026-09-29", + "used": true, + "scope": "Public article body and tables; no downloaded malware", + "access_notes": "Direct HTTP article verified.", + "indicator_ids": [ + "ioc-d41442c2-d7b7-5457-a56c-3d8b0d5f47f8", + "ioc-ff6e3066-e7b8-5a6f-8605-c856ce3594e5", + "ioc-2cf64745-120f-53f7-9eca-d474b481b99f", + "ioc-c8992c16-710d-584d-863e-4d154f19beb5", + "ioc-dc82bcbc-de78-570e-bbae-ab486a372e8e", + "ioc-b88caa4a-407c-50cc-b8b0-2660661c7801", + "ioc-0e4c1e75-090e-57f2-b359-ee17374180c3", + "ioc-3e4d7419-2f2e-5cc4-a5de-e1a2ffee2726", + "ioc-a9d659c4-0eed-53d7-b042-d9ca9dcf21e7", + "ioc-a71cff59-53a9-55a7-8c3e-ae19f9072b18", + "ioc-e16b4205-4942-5cb7-a6b4-d218dcd3f2f5", + "ioc-e38612e8-8199-5afb-9615-1733293a94d1" + ], + "rule_ids": [ + "9d719506-517e-50fb-9675-48d2907c8733", + "f2b2bc2b-d781-56e6-a464-5731efb85c10", + "5aef80fe-3a2a-5f9e-b109-7d768d0a8f23", + "35bc541e-25f4-5d4b-80e4-b22f2e9ff801", + "f2336666-9fca-5688-93b7-bf4fa85e082e", + "2fe32158-28e3-5512-8640-f713c7f6d2c0", + "3aa3db2c-e2c7-583d-9203-e96833e5b5c2", + "86c468d2-0afc-5eb2-9070-62a4d0f0ba42", + "5614e015-a1e0-5c80-bce4-f20f3e689a50", + "052a9870-fe4b-5b43-8261-5e523636590b", + "79c6ea05-8efd-51b4-8fd2-79613054863d" + ], + "retrieval_attempts": [ + { + "url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "retrieved_utc": "2026-10-01T19:48:14.465321+00:00", + "http_status": 200, + "final_url": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "bytes_observed": 400524, + "body_truncated": false, + "sha256": "d31921f2c064d3d3c9d463419147efc12f1445a03766fc0443ed5ef2514ea101" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "use_or_omission_reason": "Direct HTTP article verified.", + "requested": true + }, + { + "id": "watchtowr", + "url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", + "title": "watchTowr command injection analysis", + "published": "2026-09-28", + "retrieved": "2026-10-01", + "campaign": "2026-09", + "access": "Rendered web page reviewed", + "classification": "exploit_research", + "use_or_omission_reason": "Read as technical evidence only; no PoC execution. Delayed processing means request status alone is inconclusive.", + "retrieval_evidence": { + "id": "watch-771", + "url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", + "http_status": 200, + "final_url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", + "sha256": "f88c63605f3f5d206dd1685bc3701e8444411ac649f589bcadedd554ea05c7e7", + "bytes": 54786 + }, + "indicator_ids": [], + "rule_ids": [ + "3ec17436-eb51-5768-9b72-aece3b7d907a", + "324d542c-d00d-5ee9-be43-7f6e44d30afa" + ], + "retrieval_attempts": [ + { + "id": "watch-771", + "url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", + "http_status": 200, + "final_url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", + "sha256": "f88c63605f3f5d206dd1685bc3701e8444411ac649f589bcadedd554ea05c7e7", + "bytes": 54786 + }, + { + "url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", + "retrieved_utc": "2026-10-01T19:48:16.520346+00:00", + "http_status": 200, + "final_url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", + "bytes_observed": 54786, + "body_truncated": false, + "sha256": "f88c63605f3f5d206dd1685bc3701e8444411ac649f589bcadedd554ea05c7e7" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "requested": true + }, + { + "id": "levelblue", + "url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", + "title": "LevelBlue: Observed Exploitation Artifacts and Hunt Indicators", + "published": "2026-09-30", + "retrieved": "2026-10-01", + "campaign": "2026-09", + "access": "Initial direct retrieval failed; the search result was subsequently opened as full text and its IOC table was reviewed.", + "retrieved_utc": "2026-10-01T19:36:45.303996+00:00", + "http_status": 200, + "final_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", + "bytes": 106202, + "sha256": "7c534ea34d4d14d44fc5481ac5820ec422cffbe023303958c99af6a197d1acd1", + "publication_date": "2026-09-30", + "used": true, + "scope": "Public article body and tables; no downloaded malware", + "access_notes": "Direct HTTP article verified.", + "indicator_ids": [ + "ioc-5cc26cb1-9301-5d78-bfad-edef1f5545fa", + "ioc-3ac70540-bc3f-5e22-9543-20b6a3f1f5a3", + "ioc-17e10bf5-fbb9-5fc2-a303-ec38fd5f5c5b", + "ioc-b11ecb89-cf23-5101-919e-978c52921122", + "ioc-3b43d01c-e3ff-5dff-9d31-9a3dfa2fee78", + "ioc-b4150ad2-76af-5932-a838-359da95b1b48", + "ioc-c8358d1e-503f-51d7-81f8-68d88e4f49ee", + "ioc-ad18b0ac-923c-5a92-a2ea-fc4536d4e729", + "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", + "ioc-0ca245ac-8c4a-550c-a481-ce38d4f90ec6", + "ioc-94302100-6f11-53c2-a8e3-e9f7547bacad", + "ioc-daac9d9a-2c5d-56e4-aa37-20aea1d31b0f", + "ioc-4624107f-3f54-58f3-8634-aa9218c919d2", + "ioc-fbf3d4d7-beec-524f-83a0-e51a211662b3", + "ioc-6b2c5f46-4b51-542a-ac4a-22a82ca18d34", + "ioc-aa684f87-82f4-590c-83ba-1d285df74fb8", + "ioc-cd3ee9e8-d0e7-5eec-886c-fef590f7be79", + "ioc-d33d9d79-6b65-5e52-902a-b1c4b3e17959", + "ioc-a44e9690-5d11-5243-949f-466159b1d305", + "ioc-18759636-db24-5aa3-ac75-3fd7e5fd5eb0", + "ioc-9950a2fc-13e0-5b63-babc-17ca8da89680", + "ioc-0296bd8b-9ab2-5a1b-9c6b-c45800b7d785", + "ioc-9403c81b-60f9-5a30-ac36-990b112a43e6", + "ioc-a4ab0f40-9fa5-5d27-a5c7-ac97e740c74d" + ], + "rule_ids": [ + "db27552c-3c30-5a99-9e82-7ec76c7ba3cd", + "11c3813f-894b-51f6-80fb-d7dab0c0e8dd", + "5907a6d1-0c74-5eae-9e9b-588c0bab859d" + ], + "retrieval_attempts": [ + { + "url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", + "retrieved_utc": "2026-10-01T19:48:19.598698+00:00", + "http_status": 200, + "final_url": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", + "bytes_observed": 106202, + "body_truncated": false, + "sha256": "7c534ea34d4d14d44fc5481ac5820ec422cffbe023303958c99af6a197d1acd1" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "use_or_omission_reason": "Direct HTTP article verified.", + "requested": true + }, + { + "id": "truesec", + "url": "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway", + "title": "Truesec: Multiple Critical Vulnerabilities", + "published": "2026-09-28", + "retrieved": "2026-10-01", + "campaign": "2026-09", + "access": "Full text reviewed; the source describes these addresses only as possible command-and-control infrastructure.", + "retrieved_utc": "2026-10-01T19:36:45.444603+00:00", + "http_status": 403, + "final_url": "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway", + "bytes": 146, + "sha256": "32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864", + "publication_date": "2026-09-28", + "used": true, + "scope": "Public article body and tables; no downloaded malware", + "access_notes": "Direct HTTP403; article independently readable through web retrieval, including detection section.", + "indicator_ids": [ + "ioc-d303c696-5789-5803-9ef3-05942ad7455f", + "ioc-e8d81126-8f30-5a43-a1fe-7a209e3c9f46", + "ioc-922dbc10-2b45-5110-8011-cbd7566243d0" + ], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway", + "retrieved_utc": "2026-10-01T19:48:20.131463+00:00", + "http_status": 200, + "final_url": "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway", + "bytes_observed": 61057, + "body_truncated": false, + "sha256": "ff7a63f2db8c793e37af25876683427ff12723cba3c8fb2ee70763e2a9d1008a" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "use_or_omission_reason": "Direct HTTP403; article independently readable through web retrieval, including detection section.", + "requested": true + }, + { + "id": "virustotal-mandiant", + "url": "https://www.virustotal.com/gui/collection/c794f2e5d051c46cd2ff5e429128d7e68954ba78e66735fc69362ec726e63ee4", + "retrieved_utc": "2026-10-01T19:36:45.064779+00:00", + "http_status": 200, + "final_url": "https://www.virustotal.com/gui/collection/c794f2e5d051c46cd2ff5e429128d7e68954ba78e66735fc69362ec726e63ee4", + "bytes": 7308, + "sha256": "082cd84b1d5b2b10427d6c9417ffcc4a9c770ae1ea05a38b9b0943a71c695c09", + "publication_date": null, + "used": false, + "scope": "Public article body and tables; no downloaded malware", + "access_notes": "HTTP200 JavaScript application shell; web retrieval failed. Collection contents not verified; registered access needed. No indicators inferred from collection.", + "published": null, + "retrieved": "2026-10-01T19:36:45.064779+00:00", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://www.virustotal.com/gui/collection/c794f2e5d051c46cd2ff5e429128d7e68954ba78e66735fc69362ec726e63ee4", + "retrieved_utc": "2026-10-01T19:48:20.226156+00:00", + "http_status": 200, + "final_url": "https://www.virustotal.com/gui/collection/c794f2e5d051c46cd2ff5e429128d7e68954ba78e66735fc69362ec726e63ee4", + "bytes_observed": 7308, + "body_truncated": false, + "sha256": "082cd84b1d5b2b10427d6c9417ffcc4a9c770ae1ea05a38b9b0943a71c695c09" + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "use_or_omission_reason": "HTTP200 JavaScript application shell; web retrieval failed. Collection contents not verified; registered access needed. No indicators inferred from collection.", + "requested": true + }, + { + "id": "cert-eu", + "url": "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", + "retrieved_utc": "2026-10-01T19:36:45.064857+00:00", + "http_status": 403, + "final_url": "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", + "bytes": 179, + "sha256": "1f2e1251b1d5fab2f47bbfe3e09b149064e61571f98a5e02c6ace5f86bacb1d5", + "publication_date": "2026-09-28T19:30:00+02:00", + "used": true, + "scope": "Public article body and tables; no downloaded malware", + "access_notes": "Direct HTTP403; article independently readable through web retrieval, including detection section.", + "published": "2026-09-28T19:30:00+02:00", + "retrieved": "2026-10-01T19:36:45.064857+00:00", + "indicator_ids": [], + "rule_ids": [ + "d90f1337-428b-5156-adaf-3cba3906c11c", + "3ec17436-eb51-5768-9b72-aece3b7d907a" + ], + "retrieval_attempts": [ + { + "url": "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", + "retrieved_utc": "2026-10-01T19:48:14.464758+00:00", + "http_status": 200, + "final_url": "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", + "bytes_observed": 20501, + "body_truncated": false, + "sha256": "989be84f751e50c133db328d1bba4e8f4b189872006aa9f57e26e0d27f7fb37a" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "use_or_omission_reason": "Direct HTTP403; article independently readable through web retrieval, including detection section.", + "requested": true + }, + { + "id": "unit42", + "url": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", + "retrieved_utc": "2026-10-01T19:36:45.064965+00:00", + "http_status": 200, + "final_url": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", + "bytes": 245887, + "sha256": "5b83ac0a1cff93b64e04f33cdf234574e49260a6c4f6cfe630326627aca79c37", + "publication_date": "2026-09-30", + "used": true, + "scope": "Public article body and tables; no downloaded malware", + "access_notes": "Direct HTTP article verified. Page states updates Sep27 and Sep30 15:00 PT; current HTML published metadata Sep30, modification 2026-09-30T22:15:51Z.", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00", + "indicator_ids": [ + "ioc-d303c696-5789-5803-9ef3-05942ad7455f", + "ioc-e8d81126-8f30-5a43-a1fe-7a209e3c9f46", + "ioc-922dbc10-2b45-5110-8011-cbd7566243d0", + "ioc-f3b37063-7d80-5809-95c5-234731b080cb", + "ioc-e9bc4d4a-3c55-5a00-bcba-463416b6e201", + "ioc-0e94e1b4-f698-5632-93fc-070d0dd6ce91", + "ioc-58a85e7c-0f3b-528a-a4d1-c363751df656", + "ioc-5d7bb685-145e-596d-af2a-98899689f550", + "ioc-c8516943-75d8-53bf-a2e7-cd3a30bfa397", + "ioc-3f59b4a2-81f4-52d3-ad85-341b77d123af", + "ioc-88277771-c097-5e0a-be71-fa648013d363", + "ioc-8db8c7f4-b7de-53a1-a515-7e0b14defddc", + "ioc-fe8a84c1-10d4-5f6d-8398-8258d294cbec", + "ioc-8673a250-0f1b-5b6e-8eb1-7f6a6aee74ff", + "ioc-f84c61ba-0640-5302-9394-a286f1af181a", + "ioc-622575db-b2df-5cee-aa27-b40711cbcf44", + "ioc-c2d9f32e-3441-5034-9f20-9810fad7d3d4", + "ioc-eeca8bef-5aa4-524c-b5de-52976350cbcb", + "ioc-9fffc883-a4a3-50aa-a44b-c0a10fb3c99c", + "ioc-6aadf255-b9d5-5708-a4cb-39814fa86cc9", + "ioc-c7329309-8c04-5ce5-8303-92e89a112f48", + "ioc-4f7d5878-969d-5828-be5d-b5862d29c92e", + "ioc-3d510830-d3b1-5e44-a242-b699980c2a6e", + "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", + "ioc-505ea29d-cadf-5be7-8b9b-80b4f4f80edc", + "ioc-4b5a2e5c-067d-5f1b-a035-b7e5f711b9c0", + "ioc-49c42b1b-3068-5421-b851-a3454ed226d2", + "ioc-faf2d782-88a4-5c2d-9790-c1a75200decf", + "ioc-788900e2-b766-5d79-9e16-0ec3b808865f", + "ioc-f5d8fb8e-0bc3-51b5-8468-ca81e4bcd2af", + "ioc-49f8d35d-6564-592a-b57b-6355d475beab" + ], + "rule_ids": [ + "d90f1337-428b-5156-adaf-3cba3906c11c", + "623305d2-16b6-5710-adc8-b762522af1be", + "48774954-8559-562c-902a-2ba8a75f2e2c", + "31940357-e53f-57f8-b908-9599b0913fd2" + ], + "retrieval_attempts": [ + { + "url": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", + "retrieved_utc": "2026-10-01T19:48:17.660240+00:00", + "http_status": 200, + "final_url": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", + "bytes_observed": 245887, + "body_truncated": false, + "sha256": "146ce939151dec442511101646fd71dd9cfbaa7b268b13ae56a3aa39f0f9215a" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "use_or_omission_reason": "Direct HTTP article verified. Page states updates Sep27 and Sep30 15:00 PT; current HTML published metadata Sep30, modification 2026-09-30T22:15:51Z.", + "requested": true + }, + { + "id": "greynoise", + "url": "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", + "retrieved_utc": "2026-10-01T19:36:45.065290+00:00", + "http_status": 200, + "final_url": "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", + "bytes": 93784, + "sha256": "ae36cd56653edce8ab64062fa3268590c4dc4e73afc3e5e047c477c9c3061583", + "publication_date": "2026-09-28", + "used": true, + "scope": "Public article body and tables; no downloaded malware", + "access_notes": "Direct HTTP article verified.", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:36:45.065290+00:00", + "indicator_ids": [ + "ioc-5ddc05e7-b0e3-5ec8-89d0-d2a7b4004dc7", + "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", + "ioc-56976039-ce98-5925-9da5-42f80fe3d742", + "ioc-3cd0457e-f3b8-55bf-940c-98b77a6da663" + ], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", + "retrieved_utc": "2026-10-01T19:48:19.458922+00:00", + "http_status": 200, + "final_url": "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", + "bytes_observed": 93784, + "body_truncated": false, + "sha256": "ae36cd56653edce8ab64062fa3268590c4dc4e73afc3e5e047c477c9c3061583" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "use_or_omission_reason": "Direct HTTP article verified.", + "requested": true + }, + { + "id": "greynoise-tag", + "url": "https://viz.greynoise.io/tag/citrix-netscaler-cve-2026-88771-login-command-injection-rce-attempt", + "retrieved_utc": "2026-10-01T19:36:45.276736+00:00", + "http_status": 403, + "final_url": "https://viz.greynoise.io/tag/citrix-netscaler-cve-2026-88771-login-command-injection-rce-attempt", + "bytes": 919, + "sha256": "90f9a26059c54265cb90fdb8a75ec9642cfcaa7bab24e05993eebf84ee3e27d6", + "publication_date": null, + "used": false, + "scope": "Public article body and tables; no downloaded malware", + "access_notes": "HTTP403 and web retrieval failed. Dynamic tag membership unavailable; no IP inferred from tag.", + "published": null, + "retrieved": "2026-10-01T19:36:45.276736+00:00", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://viz.greynoise.io/tag/citrix-netscaler-cve-2026-88771-login-command-injection-rce-attempt", + "retrieved_utc": "2026-10-01T19:48:17.831526+00:00", + "http_status": 403, + "access_error": "Forbidden" + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "use_or_omission_reason": "HTTP403 and web retrieval failed. Dynamic tag membership unavailable; no IP inferred from tag.", + "requested": true + }, + { + "id": "esentire", + "url": "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", + "retrieved_utc": "2026-10-01T19:36:45.424617+00:00", + "http_status": 200, + "final_url": "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", + "bytes": 165423, + "sha256": "5073a9dd5ac0139ceda5ebf35b93ee0e3325c507f59ec1d0c98fc213e9c0e807", + "publication_date": "2026-09-29", + "used": true, + "scope": "Public article body and tables; no downloaded malware", + "access_notes": "Direct HTTP article verified.", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00", + "indicator_ids": [ + "ioc-e8d81126-8f30-5a43-a1fe-7a209e3c9f46", + "ioc-922dbc10-2b45-5110-8011-cbd7566243d0", + "ioc-c8358d1e-503f-51d7-81f8-68d88e4f49ee", + "ioc-ad18b0ac-923c-5a92-a2ea-fc4536d4e729", + "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", + "ioc-0ca245ac-8c4a-550c-a481-ce38d4f90ec6", + "ioc-b107d9fe-dd85-5b1e-97a8-4b18ac44e87a", + "ioc-162d81fe-cd64-58fa-8672-c3970e292c6a", + "ioc-5ddc05e7-b0e3-5ec8-89d0-d2a7b4004dc7", + "ioc-f20ace6b-d4a1-51e4-9f5d-bdb21ef8cf61", + "ioc-bdd9a621-f6c1-5802-994b-e2aa2d1b738e", + "ioc-cbe0df89-6929-5353-85ba-4a79328ea7cd", + "ioc-c3a95a53-417c-50eb-8367-6613bbb58ed5", + "ioc-1797b953-d34e-57ea-84f5-06686445bee6", + "ioc-92fc2c99-4cf5-58aa-a5d7-008d3155c8cd", + "ioc-f5816171-a941-52ac-bb19-94d0648bc8e8" + ], + "rule_ids": [ + "a5f6d8e8-e170-5aae-a7a2-710beac8ee28" + ], + "retrieval_attempts": [ + { + "url": "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", + "retrieved_utc": "2026-10-01T19:48:19.458377+00:00", + "http_status": 200, + "final_url": "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", + "bytes_observed": 166888, + "body_truncated": false, + "sha256": "b76b50464cbcc5500df047fedda52858be642e82128b0941a3c4b3d057382a3a" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "use_or_omission_reason": "Direct HTTP article verified.", + "requested": true + }, + { + "id": "beazley", + "url": "https://labs.beazley.security/advisories/BSL-A1216", + "retrieved_utc": "2026-10-01T19:36:45.510941+00:00", + "http_status": 200, + "final_url": "https://labs.beazley.security/advisories/BSL-A1216", + "bytes": 41508, + "sha256": "081e474a400e0ba402166423ede8ece9e5e86fd6e2f6481ee51494ee0fd7b301", + "publication_date": "2026-09-26", + "used": true, + "scope": "Public article body and tables; no downloaded malware", + "access_notes": "Direct HTTP article verified. Updated Sep29; secondary consolidation, attribution to originating reporters preserved.", + "published": "2026-09-26", + "retrieved": "2026-10-01T19:36:45.510941+00:00", + "indicator_ids": [ + "ioc-d41442c2-d7b7-5457-a56c-3d8b0d5f47f8", + "ioc-ff6e3066-e7b8-5a6f-8605-c856ce3594e5", + "ioc-5ddc05e7-b0e3-5ec8-89d0-d2a7b4004dc7", + "ioc-cbe0df89-6929-5353-85ba-4a79328ea7cd", + "ioc-0658af95-9f7b-53dc-883b-0dd538ebcc41", + "ioc-8a2625a4-0504-51b4-a137-121dba73ab19", + "ioc-98943c22-5071-5c8d-80af-1499a22bb82b", + "ioc-dd1dadd2-b5a0-5b09-aa76-490d04588bf0", + "ioc-976a698b-20b0-5c06-b8a8-13a87a34ba21", + "ioc-a17876e4-60d5-53e8-b9e0-038e6049d74e" + ], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://labs.beazley.security/advisories/BSL-A1216", + "retrieved_utc": "2026-10-01T19:48:16.437816+00:00", + "http_status": 200, + "final_url": "https://labs.beazley.security/advisories/BSL-A1216", + "bytes_observed": 41508, + "body_truncated": false, + "sha256": "da150923ced344b95264109bfa57b68bf25ee5aef211a54bce1b7535064cec6a" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "use_or_omission_reason": "Direct HTTP article verified. Updated Sep29; secondary consolidation, attribution to originating reporters preserved.", + "requested": true + }, + { + "id": "ifin-event", + "url": "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "http_status": 200, + "final_url": "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "bytes": 47482, + "sha256": "a941406df67cb1ae9462a352b444014e3a55c3469eaa59b91aa67d0bec16401e", + "source_id": "ifin-event", + "retrieved_utc": "2026-10-01T19:44:37.039091+00:00", + "published": "2026-09-28", + "access": "Direct HTTP retrieval successful; attacker resources were not requested.", + "retrieved": "2026-10-01T19:44:37.039091+00:00", + "indicator_ids": [ + "ioc-d41442c2-d7b7-5457-a56c-3d8b0d5f47f8", + "ioc-ff6e3066-e7b8-5a6f-8605-c856ce3594e5", + "ioc-d303c696-5789-5803-9ef3-05942ad7455f", + "ioc-e8d81126-8f30-5a43-a1fe-7a209e3c9f46", + "ioc-922dbc10-2b45-5110-8011-cbd7566243d0", + "ioc-5cc26cb1-9301-5d78-bfad-edef1f5545fa", + "ioc-3ac70540-bc3f-5e22-9543-20b6a3f1f5a3", + "ioc-17e10bf5-fbb9-5fc2-a303-ec38fd5f5c5b", + "ioc-b11ecb89-cf23-5101-919e-978c52921122", + "ioc-3b43d01c-e3ff-5dff-9d31-9a3dfa2fee78", + "ioc-b4150ad2-76af-5932-a838-359da95b1b48", + "ioc-c8358d1e-503f-51d7-81f8-68d88e4f49ee", + "ioc-ad18b0ac-923c-5a92-a2ea-fc4536d4e729", + "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", + "ioc-0ca245ac-8c4a-550c-a481-ce38d4f90ec6", + "ioc-94302100-6f11-53c2-a8e3-e9f7547bacad", + "ioc-daac9d9a-2c5d-56e4-aa37-20aea1d31b0f", + "ioc-4624107f-3f54-58f3-8634-aa9218c919d2", + "ioc-fbf3d4d7-beec-524f-83a0-e51a211662b3", + "ioc-6b2c5f46-4b51-542a-ac4a-22a82ca18d34", + "ioc-aa684f87-82f4-590c-83ba-1d285df74fb8", + "ioc-cd3ee9e8-d0e7-5eec-886c-fef590f7be79", + "ioc-d33d9d79-6b65-5e52-902a-b1c4b3e17959", + "ioc-a44e9690-5d11-5243-949f-466159b1d305", + "ioc-18759636-db24-5aa3-ac75-3fd7e5fd5eb0", + "ioc-9950a2fc-13e0-5b63-babc-17ca8da89680", + "ioc-0296bd8b-9ab2-5a1b-9c6b-c45800b7d785", + "ioc-2cf64745-120f-53f7-9eca-d474b481b99f", + "ioc-c8992c16-710d-584d-863e-4d154f19beb5", + "ioc-b88caa4a-407c-50cc-b8b0-2660661c7801", + "ioc-0e4c1e75-090e-57f2-b359-ee17374180c3", + "ioc-3e4d7419-2f2e-5cc4-a5de-e1a2ffee2726", + "ioc-5ddc05e7-b0e3-5ec8-89d0-d2a7b4004dc7", + "ioc-f3b37063-7d80-5809-95c5-234731b080cb", + "ioc-e9bc4d4a-3c55-5a00-bcba-463416b6e201", + "ioc-0e94e1b4-f698-5632-93fc-070d0dd6ce91", + "ioc-58a85e7c-0f3b-528a-a4d1-c363751df656", + "ioc-5d7bb685-145e-596d-af2a-98899689f550", + "ioc-c8516943-75d8-53bf-a2e7-cd3a30bfa397", + "ioc-3f59b4a2-81f4-52d3-ad85-341b77d123af", + "ioc-88277771-c097-5e0a-be71-fa648013d363", + "ioc-8db8c7f4-b7de-53a1-a515-7e0b14defddc", + "ioc-fe8a84c1-10d4-5f6d-8398-8258d294cbec", + "ioc-8673a250-0f1b-5b6e-8eb1-7f6a6aee74ff", + "ioc-f84c61ba-0640-5302-9394-a286f1af181a", + "ioc-622575db-b2df-5cee-aa27-b40711cbcf44", + "ioc-c2d9f32e-3441-5034-9f20-9810fad7d3d4", + "ioc-eeca8bef-5aa4-524c-b5de-52976350cbcb", + "ioc-9fffc883-a4a3-50aa-a44b-c0a10fb3c99c", + "ioc-6aadf255-b9d5-5708-a4cb-39814fa86cc9", + "ioc-c7329309-8c04-5ce5-8303-92e89a112f48", + "ioc-4f7d5878-969d-5828-be5d-b5862d29c92e", + "ioc-3d510830-d3b1-5e44-a242-b699980c2a6e", + "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", + "ioc-56976039-ce98-5925-9da5-42f80fe3d742", + "ioc-3414dcf4-1e3f-54fb-854a-034fe7d55024", + "ioc-cca66732-d7da-5495-a39a-3e9812f35db0", + "ioc-c0df2848-4379-5db5-a9c2-76979586eb5c", + "ioc-7cb798a0-7236-5dea-bc9f-ab06e9efacf2", + "ioc-8b6e9988-288e-5f68-9c68-bcc62ed7acc3", + "ioc-8498baad-3aed-5bb1-884f-65a777f79237", + "ioc-161bf202-a189-53a3-9a30-5f9ffcca29b2", + "ioc-7ba7dbfd-64f8-5dd5-9e02-6ab5ca52ef98", + "ioc-3363ed4f-2283-54d6-9d4f-5da305fdbc66", + "ioc-7c21e715-4cdc-58cd-9a78-2acaec7ea3dd", + "ioc-64a8e232-9e8a-5d2f-a526-019d24333de5", + "ioc-29321922-0dae-5e42-84a3-7c890a994b6b", + "ioc-dd8e0595-a5aa-5d86-aaf8-1afab388d2c2" + ], + "rule_ids": [ + "48774954-8559-562c-902a-2ba8a75f2e2c" + ], + "retrieval_attempts": [ + { + "url": "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "retrieved_utc": "2026-10-01T19:48:16.579774+00:00", + "http_status": 200, + "final_url": "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "bytes_observed": 47482, + "body_truncated": false, + "sha256": "a941406df67cb1ae9462a352b444014e3a55c3469eaa59b91aa67d0bec16401e" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", + "requested": true + }, + { + "id": "ifin-manifest", + "url": "https://misp.ifin.network/feed/manifest.json", + "http_status": 200, + "final_url": "https://misp.ifin.network/feed/manifest.json", + "bytes": 58613, + "sha256": "e0d17f8aa0f81cac28af72695225fee7e50ffb9152bc7ebb0c33f4de18fd62a0", + "source_id": "ifin-manifest", + "retrieved_utc": "2026-10-01T19:44:37.039380+00:00", + "published": null, + "access": "Direct HTTP retrieval successful; attacker resources were not requested.", + "retrieved": "2026-10-01T19:44:37.039380+00:00", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://misp.ifin.network/feed/manifest.json", + "retrieved_utc": "2026-10-01T19:48:16.580251+00:00", + "http_status": 200, + "final_url": "https://misp.ifin.network/feed/manifest.json", + "bytes_observed": 58613, + "body_truncated": false, + "sha256": "e0d17f8aa0f81cac28af72695225fee7e50ffb9152bc7ebb0c33f4de18fd62a0" + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", + "requested": true + }, + { + "id": "ifin-thread", + "url": "https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867", + "http_status": 200, + "final_url": "https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867", + "bytes": 72945, + "sha256": "8759efb88c08d4458f1a8ab4282a090c604062d95bdd1a05c831f9ec41ca6600", + "source_id": "ifin-thread", + "retrieved_utc": "2026-10-01T19:44:37.039382+00:00", + "published": null, + "access": "Direct HTTP retrieval successful; attacker resources were not requested.", + "retrieved": "2026-10-01T19:44:37.039382+00:00", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867", + "retrieved_utc": "2026-10-01T19:48:15.994956+00:00", + "http_status": 200, + "final_url": "https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867", + "bytes_observed": 72945, + "body_truncated": false, + "sha256": "7b97e2cf1ddfbe7b4a2f9175247c3ad288d63c3d0621e2cb3c18ed6ce321fe85" + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", + "requested": true + }, + { + "id": "elastic-toml", + "url": "https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml", + "http_status": 200, + "final_url": "https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml", + "bytes": 9810, + "sha256": "a296a6fa0570e39ac7b838f11d6eb40bee27667ba3d40531e9d693f151a3d87c", + "source_id": "elastic-toml", + "retrieved_utc": "2026-10-01T19:44:37.039384+00:00", + "published": "2026-09-28", + "access": "Direct HTTP retrieval successful; attacker resources were not requested.", + "retrieved": "2026-10-01T19:44:37.039384+00:00", + "indicator_ids": [], + "rule_ids": [ + "a0f728c2-6c21-50e7-9909-ae5df3b77538" + ], + "retrieval_attempts": [], + "used_for_detection": true, + "disposition": "detection_reference", + "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", + "requested": false + }, + { + "id": "rapid7", + "url": "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/", + "http_status": 200, + "final_url": "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/", + "bytes": 521420, + "sha256": "ca7b6e485f5f010d70d931b18f693de1d6749ae1c84989ed531a06ed253ffecb", + "source_id": "rapid7", + "retrieved_utc": "2026-10-01T19:44:37.039385+00:00", + "published": "2026-09-28", + "access": "Direct HTTP retrieval successful; attacker resources were not requested.", + "retrieved": "2026-10-01T19:44:37.039385+00:00", + "indicator_ids": [ + "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", + "ioc-161bf202-a189-53a3-9a30-5f9ffcca29b2", + "ioc-e3c53f68-c632-5ac9-b63a-3332c4e53e7e", + "ioc-f425d9f6-7fae-5179-9a3f-55d8b573ffc8" + ], + "rule_ids": [ + "156c151e-13b0-5dd7-a22c-07bdb4af9327" + ], + "retrieval_attempts": [ + { + "url": "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/", + "retrieved_utc": "2026-10-01T19:48:19.637183+00:00", + "http_status": 200, + "final_url": "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/", + "bytes_observed": 521420, + "body_truncated": false, + "sha256": "ca7b6e485f5f010d70d931b18f693de1d6749ae1c84989ed531a06ed253ffecb" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", + "requested": true + }, + { + "id": "arctic-wolf", + "url": "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "http_status": 200, + "final_url": "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "bytes": 6254, + "sha256": "1cc0a43f3d5cb3dca5a7e4bb2afc7224303fe892904e67373e2b7b18353587e1", + "source_id": "arctic-wolf", + "retrieved_utc": "2026-10-01T19:44:37.039386+00:00", + "published": "2026-09-30", + "access": "Direct HTTP retrieval successful; attacker resources were not requested.", + "retrieved": "2026-10-01T19:44:37.039386+00:00", + "indicator_ids": [ + "ioc-c8358d1e-503f-51d7-81f8-68d88e4f49ee", + "ioc-ad18b0ac-923c-5a92-a2ea-fc4536d4e729", + "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", + "ioc-0ca245ac-8c4a-550c-a481-ce38d4f90ec6", + "ioc-94302100-6f11-53c2-a8e3-e9f7547bacad", + "ioc-daac9d9a-2c5d-56e4-aa37-20aea1d31b0f", + "ioc-4624107f-3f54-58f3-8634-aa9218c919d2", + "ioc-fbf3d4d7-beec-524f-83a0-e51a211662b3", + "ioc-aa684f87-82f4-590c-83ba-1d285df74fb8", + "ioc-d33d9d79-6b65-5e52-902a-b1c4b3e17959", + "ioc-c3a95a53-417c-50eb-8367-6613bbb58ed5", + "ioc-b2c779cd-c0a6-56ee-bd4d-1a8fe9b08018", + "ioc-965e969a-aa75-541b-9191-d544bf92ca6e", + "ioc-afd36d04-8867-5378-888a-35110f025138", + "ioc-9612b66f-4245-59ae-9405-057c997c80a0", + "ioc-c2c23478-b170-5e0b-ab17-a37515ca3386", + "ioc-a177a90a-0a05-5dcf-a623-257a8268b012", + "ioc-791d9376-2278-579f-b65b-e2f1603eb86c", + "ioc-33152f79-ced9-5032-b8c5-5cdd2bd25022", + "ioc-262b6f76-9739-549a-b409-588867871d8d", + "ioc-300c029e-36a8-5fbf-bbcc-e2cae3850e63", + "ioc-41a963f1-9acb-5a20-bf71-cb40cce2f9c1", + "ioc-8a726a35-98c3-546d-a6e5-9fd610e11b9c", + "ioc-a1597715-32a1-5cb4-92b4-21b6e07b28ab", + "ioc-b3723f40-7003-5461-bc87-f147a3bb9479", + "ioc-c5347a81-e228-5319-98df-39890efbb198", + "ioc-01772fb3-a35a-5447-8d2c-7a4665bcea56", + "ioc-fb0b6f32-e20b-516a-951b-69158d6910a7", + "ioc-a72639b6-e8bd-5954-bc27-e56981f25122", + "ioc-f641d7d2-2d09-5490-8a90-d24e12541532", + "ioc-e1cab8ac-c435-58ec-a680-0b71d0f945dd", + "ioc-ed202314-1f91-5a66-8c36-502623bdbfd3", + "ioc-49be21fd-6b54-51f3-8ab5-6c4b65bcd3a6", + "ioc-48342f6c-9687-5227-9482-717ab428c77c", + "ioc-59dd2664-9887-539e-bc3a-b8972625933a", + "ioc-f3832e49-bc15-5a17-a33a-d18bcebaf835", + "ioc-3c8206c9-a9db-5cdc-9a56-2b845387e628" + ], + "rule_ids": [ + "985490ff-cbe4-50e7-b4a9-f962543255af", + "7ff4a684-f5e1-50b6-b543-ba30ae52818c", + "6bb4bd57-96bf-5bf5-b2b2-36ce721d4902", + "7f6eb722-0be4-581f-bed5-10d8d3b26247", + "0a8f1d34-83bb-5ade-bfc8-1bd45f221a27" + ], + "retrieval_attempts": [], + "used_for_detection": true, + "disposition": "detection_reference", + "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", + "requested": false + }, + { + "id": "sygnia", + "url": "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/", + "http_status": 200, + "final_url": "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/", + "bytes": 554280, + "sha256": "4fc8e0d83cb2cc7fdd217285f70bf33fb063b1fb3029430972e5276a379d8865", + "source_id": "sygnia", + "retrieved_utc": "2026-10-01T19:44:37.039387+00:00", + "published": "2026-09-30", + "access": "Direct HTTP retrieval successful; attacker resources were not requested.", + "retrieved": "2026-10-01T19:44:37.039387+00:00", + "indicator_ids": [ + "ioc-922dbc10-2b45-5110-8011-cbd7566243d0", + "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", + "ioc-9950a2fc-13e0-5b63-babc-17ca8da89680", + "ioc-92fc2c99-4cf5-58aa-a5d7-008d3155c8cd", + "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", + "ioc-62a944bc-91a2-55e0-bab3-439c7c6d8ffd", + "ioc-47605cce-3519-5bef-99ab-72e3470369a4", + "ioc-778a1ee5-2ae7-58d5-90b7-00922171eed0", + "ioc-07322dbb-0181-5251-aa32-1845d7735c37", + "ioc-e5d46efc-25d8-5489-8f0a-5c4b335c44a6", + "ioc-f76deaef-883d-5aae-b0b1-7ded0aeebd6e", + "ioc-00ff8419-6ddb-5974-8a48-0cc1ab2f54ee", + "ioc-13d74ad3-6b70-529b-9e67-89cdc4459ae7", + "ioc-76175645-cd94-5b71-839a-3f8735a279d9", + "ioc-307fbb23-f927-5c30-9aff-b629abea7ab0" + ], + "rule_ids": [ + "2fe32158-28e3-5512-8640-f713c7f6d2c0", + "3ec17436-eb51-5768-9b72-aece3b7d907a", + "9fb8bb55-fb55-535a-9b4c-6344f8b08bfe" + ], + "retrieval_attempts": [ + { + "url": "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/", + "retrieved_utc": "2026-10-01T19:48:19.714422+00:00", + "http_status": 200, + "final_url": "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/", + "bytes_observed": 554280, + "body_truncated": false, + "sha256": "04a4bd97b36e0aa7b58f2c52f08e8a7d4cd8b46a7a98a442433f6a9f02c1b08b" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "use_or_omission_reason": "Direct HTTP retrieval successful; attacker resources were not requested.", + "requested": true + }, + { + "id": "CITRIX-CTX697096", + "url": "https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscaler-gateway-security-bulletin-for-cve202688771-and-cve202688772.html", + "title": "NetScaler security bulletin CTX697096", + "published": null, + "retrieved": "2026-10-01", + "access": "verified", + "status": "guidance_only", + "use_or_omission_reason": "Canonical article accessible; attachment query-form URL failed. Authoritative fixed builds and exposure preconditions; no public attack IOC list. CVE-88778 additionally requires the Enhanced ISN configuration change. Configuration exposure is not compromise evidence.", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [], + "used_for_detection": false, + "disposition": "guidance_only", + "requested": false + }, + { + "id": "CITRIX-SECURITY-BLOG-20260930", + "url": "https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/", + "title": "NetScaler security guidance, updated September 30", + "published": "2026-09-27", + "retrieved": "2026-10-01", + "access": "verified", + "status": "guidance_only", + "use_or_omission_reason": "Official article updated 2026-09-30. IOC logic available via Console/Support, not published here. Patching does not establish cleanup; rebuild when compromise is suspected. 13.1-64.24 avoids the documented 64.23 reboot issue where NS variables exist. Reader comments are not vendor IOC statements and are excluded.", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/", + "retrieved_utc": "2026-10-01T19:48:14.576535+00:00", + "http_status": 403, + "access_error": "Forbidden" + } + ], + "used_for_detection": false, + "disposition": "guidance_only", + "requested": true + }, + { + "id": "CITRIX-CTX694799", + "url": "https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html", + "title": "Steps after suspected NetScaler compromise", + "published": "2025-06-25", + "retrieved": "2026-10-01", + "access": "verified", + "status": "guidance_only", + "use_or_omission_reason": "Preserve disk, logs and memory; record timezone/NTP; isolate; rotate exposed credentials and revoke certificates/private keys; investigate connected systems; rebuild. Packet-engine core generation triggers warm restart. Not a passive log-detection signature. Canonical support listing records modification 2026-05-13.", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html", + "retrieved_utc": "2026-10-01T19:48:16.658089+00:00", + "http_status": 200, + "final_url": "https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html", + "bytes_observed": 104944, + "body_truncated": false, + "sha256": "ebad4b1453adb35719beca6ba98f4d6dd9a8e690cbc0d0c20f50507acd254798" + } + ], + "used_for_detection": false, + "disposition": "guidance_only", + "requested": true + }, + { + "id": "NETSCALER-CONSOLE-IOC", + "url": "https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/ioc.html", + "title": "Console indicators-of-compromise detection", + "published": null, + "retrieved": "2026-10-01", + "access": "verified", + "status": "guidance_only", + "use_or_omission_reason": "Telemetry required; BLX unsupported. Scan history and detection-logic updates are retained. No Compromise Detected is limited to current checks; failed/skipped scans are not negative findings. Detection internals absent; no invented equivalent rules.", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/ioc.html", + "retrieved_utc": "2026-10-01T19:48:14.720145+00:00", + "http_status": 200, + "final_url": "https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/ioc.html", + "bytes_observed": 226879, + "body_truncated": false, + "sha256": "db63e9abcf4da79bea04bf34eaffa5dc1b090386b3ef69c59d229e23e3330ac7" + } + ], + "used_for_detection": false, + "disposition": "guidance_only", + "requested": true + }, + { + "id": "NETSCALER-FIM", + "url": "https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/file-integrity-monitoring.html", + "title": "File integrity monitoring", + "published": "2026-09-07", + "retrieved": "2026-10-01", + "access": "verified", + "status": "guidance_only", + "use_or_omission_reason": "Compares same-build vendor hashes against appliance files; distinguishes modified and added files and scan errors. BLX unsupported. A local log archive cannot reproduce vendor binary-baseline verification, exclusions, ownership/runtime checks or live device signatures.", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/file-integrity-monitoring.html", + "retrieved_utc": "2026-10-01T19:48:14.696478+00:00", + "http_status": 200, + "final_url": "https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/file-integrity-monitoring.html", + "bytes_observed": 229446, + "body_truncated": false, + "sha256": "7be109e0a236ae1b052226efb5a20e31f1faec826b06e1063756645c585483dc" + } + ], + "used_for_detection": false, + "disposition": "guidance_only", + "requested": true + }, + { + "id": "NETSCALER-CONSOLE-RELEASES", + "url": "https://docs.netscaler.com/en-us/netscaler-console-service/release-notes/whats-new.html", + "title": "Console service release notes", + "published": "2026-09-27", + "retrieved": "2026-10-01", + "access": "verified", + "status": "guidance_only", + "use_or_omission_reason": "September 27 entry identifies CVE-88771 exposure through version scanning and recommends upgrade. Version-based exposure detection is separate from compromise detection and exact historical patch timing.", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://docs.netscaler.com/en-us/netscaler-console-service/release-notes/whats-new.html", + "retrieved_utc": "2026-10-01T19:48:14.730148+00:00", + "http_status": 200, + "final_url": "https://docs.netscaler.com/en-us/netscaler-console-service/release-notes/whats-new.html", + "bytes_observed": 472458, + "body_truncated": false, + "sha256": "39272930fae5d93d787ae027b65d50cd5be0630ccd351a8f1f8d9360b95ae587" + } + ], + "used_for_detection": false, + "disposition": "guidance_only", + "requested": true + }, + { + "id": "NEXTRON-20260929", + "url": "https://www.nextron-systems.com/2026/09/29/new-thor-detection-coverage-for-citrix-netscaler-cve-2026-88771-and-cve-2026-88772/", + "title": "THOR NetScaler detection coverage", + "published": "2026-09-29", + "retrieved": "2026-10-01", + "access": "verified", + "status": "coverage_mapping_only", + "use_or_omission_reason": "Article explicitly withholds rule matching strings/implementation. Its filesystem IOC subset covers 12 checks consolidated into four definitions; 22 checks requiring logs/config/process/ownership/permissions/runtime context are omitted. PoC file detection is not proof of exploitation. No undisclosed rules reconstructed.", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://www.nextron-systems.com/2026/09/29/new-thor-detection-coverage-for-citrix-netscaler-cve-2026-88771-and-cve-2026-88772/", + "retrieved_utc": "2026-10-01T19:48:19.620713+00:00", + "http_status": 200, + "final_url": "https://www.nextron-systems.com/2026/09/29/new-thor-detection-coverage-for-citrix-netscaler-cve-2026-88771-and-cve-2026-88772/", + "bytes_observed": 294849, + "body_truncated": false, + "sha256": "1150d1b167674cb370aa4a797bc15988e2ed2cabac9c4efb36c1282f732ea5f5" + } + ], + "used_for_detection": false, + "disposition": "coverage_mapping_only", + "requested": true + }, + { + "id": "CERTFR-2026-ALE-011", + "url": "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", + "title": "CERT-FR NetScaler alert", + "published": "2026-09-28", + "retrieved": "2026-10-01", + "access": "verified", + "status": "secondary_pattern_provenance", + "use_or_omission_reason": "Updated September 30. Reproduces Google DTLS/packet-engine hunting patterns and links YARA. Explicitly says ANSSI has not independently qualified them. Preserve original Google provenance and avoid counting duplicated patterns as independent confirmations.", + "indicator_ids": [], + "rule_ids": [ + "f2b2bc2b-d781-56e6-a464-5731efb85c10", + "5aef80fe-3a2a-5f9e-b109-7d768d0a8f23", + "35bc541e-25f4-5d4b-80e4-b22f2e9ff801" + ], + "retrieval_attempts": [ + { + "url": "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", + "retrieved_utc": "2026-10-01T19:48:14.465183+00:00", + "http_status": 200, + "final_url": "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", + "bytes_observed": 20907, + "body_truncated": false, + "sha256": "fae697b8230c9ed435fafb9d1195d9bba3b44a69426bef436b51e64e23d8b638" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "requested": true + }, + { + "id": "CIRCL-TR100", + "url": "https://circl.lu/pub/tr-100/", + "title": "CIRCL NetScaler critical vulnerabilities", + "published": null, + "retrieved": "2026-10-01", + "access": "verified", + "status": "guidance_only", + "use_or_omission_reason": "Accessible public advisory. Configuration prerequisites, version recommendations, forensic preservation, external SIEM logs and investigation of outbound/internal activity. No additional concrete attack addresses/hashes or detection implementation imported.", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://circl.lu/pub/tr-100/", + "retrieved_utc": "2026-10-01T19:48:14.465263+00:00", + "http_status": 200, + "final_url": "https://circl.lu/pub/tr-100/", + "bytes_observed": 22914, + "body_truncated": false, + "sha256": "472cc7606781039780d6bf26790df01c1d60af03de5f660b45f6456bf0bed9e9" + } + ], + "used_for_detection": false, + "disposition": "guidance_only", + "requested": true + }, + { + "id": "ACSC-NETSCALER-20260930", + "url": "https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/critical-vulnerabilities-in-citrix-netscaler-adc-and-citrix-netscaler-gateway-products", + "title": "ACSC NetScaler advisory", + "published": "2026-09-28", + "retrieved": "2026-10-01", + "access": "verified", + "status": "guidance_only", + "use_or_omission_reason": "Updated September 30: investigate back to at least September 4, 2026. This is a minimum lookback, not proof earlier compromise was impossible. Updated introduction reports Australian exploitation; older background wording still says none reported, so retain update precedence. No public literal IOC table.", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/critical-vulnerabilities-in-citrix-netscaler-adc-and-citrix-netscaler-gateway-products", + "retrieved_utc": "2026-10-01T19:48:18.011737+00:00", + "access_error": "The read operation timed out" + } + ], + "used_for_detection": false, + "disposition": "guidance_only", + "requested": true + }, + { + "id": "watchtowr-dtls", + "url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", + "title": "watchTowr DTLS analysis", + "classification": "exploit_research", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Packet fragmentation/ROP and memory corruption need packet/core evidence; no packet exploit logic is converted to a log success verdict.", + "retrieval_evidence": { + "id": "watch-772", + "url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", + "http_status": 200, + "final_url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", + "sha256": "5ffa11027eca202202a5f200a54c3d06ff02862d92161f9690f6e41105b3ea91", + "bytes": 49730 + }, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "id": "watch-772", + "url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", + "http_status": 200, + "final_url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", + "sha256": "5ffa11027eca202202a5f200a54c3d06ff02862d92161f9690f6e41105b3ea91", + "bytes": 49730 + }, + { + "url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", + "retrieved_utc": "2026-10-01T19:48:16.507096+00:00", + "http_status": 200, + "final_url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", + "bytes_observed": 49730, + "body_truncated": false, + "sha256": "5ffa11027eca202202a5f200a54c3d06ff02862d92161f9690f6e41105b3ea91" + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": true + }, + { + "id": "watchtowr-repo", + "url": "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", + "title": "watchTowr artifact generator repository", + "classification": "exploit_research", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Read source only. Active command injection generator, not a passive scanner. Example output paths classified as PoC markers.", + "retrieval_evidence": { + "id": "watch-poc", + "url": "https://raw.githubusercontent.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py", + "http_status": 200, + "sha256": "c206c6da679260a0bb5d325ceb55984fed16a9016e8346cbe8344f59e3f76669", + "bytes": 1917 + }, + "indicator_ids": [ + "ioc-f2f08d48-92f4-5bf6-b51f-0fdfacc854de", + "ioc-aacbb570-45a0-557c-a81e-a3a34ae45b95" + ], + "rule_ids": [ + "3ec17436-eb51-5768-9b72-aece3b7d907a" + ], + "retrieval_attempts": [ + { + "id": "watch-poc", + "url": "https://raw.githubusercontent.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py", + "http_status": 200, + "sha256": "c206c6da679260a0bb5d325ceb55984fed16a9016e8346cbe8344f59e3f76669", + "bytes": 1917 + }, + { + "url": "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", + "retrieved_utc": "2026-10-01T19:48:15.980062+00:00", + "http_status": 200, + "final_url": "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", + "bytes_observed": 239508, + "body_truncated": false, + "sha256": "d57dd2ac1a040e362f969ce587e4454b50ad6ad5ecbbca3df1efd6916b05bed7" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "requested": true + }, + { + "id": "poppelgaard", + "url": "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "title": "Community CTX697096 checker", + "classification": "community_aggregation", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Read script only. Retain attributed infrastructure and scanner lists separately; community compromise labels are not adopted as local verdicts.", + "retrieval_evidence": { + "id": "poppelgaard-script", + "url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", + "http_status": 200, + "final_url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", + "sha256": "f917bcb95dd6a28b940b4842c33f48dda9c4ea8c44e3276ffffedf90270c7199", + "bytes": 81274 + }, + "indicator_ids": [ + "ioc-d41442c2-d7b7-5457-a56c-3d8b0d5f47f8", + "ioc-ff6e3066-e7b8-5a6f-8605-c856ce3594e5", + "ioc-d303c696-5789-5803-9ef3-05942ad7455f", + "ioc-e8d81126-8f30-5a43-a1fe-7a209e3c9f46", + "ioc-922dbc10-2b45-5110-8011-cbd7566243d0", + "ioc-3b43d01c-e3ff-5dff-9d31-9a3dfa2fee78", + "ioc-b4150ad2-76af-5932-a838-359da95b1b48", + "ioc-c8358d1e-503f-51d7-81f8-68d88e4f49ee", + "ioc-ad18b0ac-923c-5a92-a2ea-fc4536d4e729", + "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", + "ioc-0ca245ac-8c4a-550c-a481-ce38d4f90ec6", + "ioc-94302100-6f11-53c2-a8e3-e9f7547bacad", + "ioc-d33d9d79-6b65-5e52-902a-b1c4b3e17959", + "ioc-b107d9fe-dd85-5b1e-97a8-4b18ac44e87a", + "ioc-162d81fe-cd64-58fa-8672-c3970e292c6a", + "ioc-5ddc05e7-b0e3-5ec8-89d0-d2a7b4004dc7", + "ioc-f20ace6b-d4a1-51e4-9f5d-bdb21ef8cf61", + "ioc-bdd9a621-f6c1-5802-994b-e2aa2d1b738e", + "ioc-cbe0df89-6929-5353-85ba-4a79328ea7cd", + "ioc-c3a95a53-417c-50eb-8367-6613bbb58ed5", + "ioc-1797b953-d34e-57ea-84f5-06686445bee6", + "ioc-92fc2c99-4cf5-58aa-a5d7-008d3155c8cd", + "ioc-f5816171-a941-52ac-bb19-94d0648bc8e8", + "ioc-fe8a84c1-10d4-5f6d-8398-8258d294cbec", + "ioc-8673a250-0f1b-5b6e-8eb1-7f6a6aee74ff", + "ioc-622575db-b2df-5cee-aa27-b40711cbcf44", + "ioc-c2d9f32e-3441-5034-9f20-9810fad7d3d4", + "ioc-eeca8bef-5aa4-524c-b5de-52976350cbcb", + "ioc-9fffc883-a4a3-50aa-a44b-c0a10fb3c99c", + "ioc-6aadf255-b9d5-5708-a4cb-39814fa86cc9", + "ioc-c7329309-8c04-5ce5-8303-92e89a112f48", + "ioc-56976039-ce98-5925-9da5-42f80fe3d742", + "ioc-0658af95-9f7b-53dc-883b-0dd538ebcc41", + "ioc-8a2625a4-0504-51b4-a137-121dba73ab19", + "ioc-98943c22-5071-5c8d-80af-1499a22bb82b", + "ioc-976a698b-20b0-5c06-b8a8-13a87a34ba21", + "ioc-a17876e4-60d5-53e8-b9e0-038e6049d74e", + "ioc-3414dcf4-1e3f-54fb-854a-034fe7d55024", + "ioc-cca66732-d7da-5495-a39a-3e9812f35db0", + "ioc-c0df2848-4379-5db5-a9c2-76979586eb5c", + "ioc-7cb798a0-7236-5dea-bc9f-ab06e9efacf2", + "ioc-8b6e9988-288e-5f68-9c68-bcc62ed7acc3", + "ioc-8498baad-3aed-5bb1-884f-65a777f79237", + "ioc-161bf202-a189-53a3-9a30-5f9ffcca29b2", + "ioc-b2c779cd-c0a6-56ee-bd4d-1a8fe9b08018", + "ioc-965e969a-aa75-541b-9191-d544bf92ca6e", + "ioc-afd36d04-8867-5378-888a-35110f025138", + "ioc-9612b66f-4245-59ae-9405-057c997c80a0", + "ioc-c2c23478-b170-5e0b-ab17-a37515ca3386", + "ioc-a177a90a-0a05-5dcf-a623-257a8268b012", + "ioc-791d9376-2278-579f-b65b-e2f1603eb86c", + "ioc-33152f79-ced9-5032-b8c5-5cdd2bd25022", + "ioc-262b6f76-9739-549a-b409-588867871d8d", + "ioc-300c029e-36a8-5fbf-bbcc-e2cae3850e63", + "ioc-41a963f1-9acb-5a20-bf71-cb40cce2f9c1", + "ioc-8a726a35-98c3-546d-a6e5-9fd610e11b9c", + "ioc-a1597715-32a1-5cb4-92b4-21b6e07b28ab", + "ioc-b3723f40-7003-5461-bc87-f147a3bb9479", + "ioc-c5347a81-e228-5319-98df-39890efbb198", + "ioc-4c267388-41ee-5227-ba11-0d5dc7f04865", + "ioc-d868065f-7b8f-5967-a28e-999f3374e05e", + "ioc-2b52edf3-63e4-5891-99a9-851c701ef966", + "ioc-e5099e29-453c-549f-81c6-f021ea7eed4d", + "ioc-9fcb074c-31a3-59a2-b5f2-5ff1b0db5a04", + "ioc-8b1bf480-3e2c-5048-9b98-88ba4129ae24", + "ioc-6157a981-c183-5e32-819e-58da121efccf", + "ioc-90649d83-c1f6-578d-be53-189c899946cd", + "ioc-63c680c9-b1f1-5aee-a554-5e527f60c2d4", + "ioc-4f12e46e-4bf9-53f4-bb19-359adf58ed12", + "ioc-d7bb06f3-6e14-51de-b9d3-fd4a62848d70", + "ioc-ac2d267d-5c7f-5039-9290-4e67f064d836", + "ioc-48bd85f0-1c35-5e7d-9945-ada5a31375df", + "ioc-af13acba-cb3e-5da7-81c0-55317f6a40ad", + "ioc-1ad4e7d7-d388-5b18-a21a-a1498eac5db2", + "ioc-1174ab82-cd5e-51fe-99a6-437284c2ce45", + "ioc-f68754cd-53d6-5124-a672-16b8719e6abc", + "ioc-c080888d-00bf-5cf7-8949-fea4f573dd63", + "ioc-0b7b1700-fb00-534d-ae61-6ef9a4b41949", + "ioc-30c0c3e4-d183-5519-aba6-1be38489baf9", + "ioc-73292c42-9c98-5ce7-a8a5-b39ed9c93d18", + "ioc-2a11ac33-78e9-5681-baad-a8249056008f", + "ioc-f132a2db-c271-54b1-ab24-9c6d11ac8776", + "ioc-9a75ddc5-7ac4-5ef0-9e50-b01f3a7e4471", + "ioc-06e8ec49-8c49-504e-9b3d-e25ad61bd027", + "ioc-7b789a76-cc5a-5833-8f42-13256ec561d8", + "ioc-107a87f4-b8a8-54a9-9a11-6b2057c01bb2", + "ioc-b05a2dce-c9f6-583c-878e-96f21ca94fc4", + "ioc-ea140046-4e0d-5e16-a150-a5a68f69b635", + "ioc-66cfbde1-07c1-560f-b967-bcc78846ca0a", + "ioc-e7e4adf2-30dc-5f99-8744-dd8dd33d46f3", + "ioc-c54202eb-b7f3-5197-90ae-385d2eef2d19", + "ioc-124ac29e-4c30-5018-9cad-5b4112767c69", + "ioc-020335a1-0dfd-521b-a90d-7e85acd1827a", + "ioc-902af158-00bf-5776-b73f-dfdcc74d7b94", + "ioc-a2773efd-0847-5503-9e9b-bdc1e749668e", + "ioc-4f2b7167-4b7f-5f3f-a62f-a7e54565de90", + "ioc-9ec5e7f2-5eef-5915-b9ac-50d426d4ec8f", + "ioc-b1b5375a-1395-586c-8b62-be709809345b", + "ioc-45acd1bd-635f-54c3-b9ff-2262ffa20798", + "ioc-c538409c-b054-51a1-ab89-f8891525914a", + "ioc-b9506317-73f8-5d26-81e2-3e3ae03e24f4", + "ioc-20d469dc-580b-59c9-9672-b42cff9f681e", + "ioc-a9b0db77-074b-50d8-9116-8514f95cceb4", + "ioc-a0fa80e9-ea58-5c88-baef-ddb81abd1edd", + "ioc-aade0d13-89ea-5606-afc8-55f79ef679fe", + "ioc-c896dcc8-b975-54b6-9084-f8c446f4b0a5", + "ioc-c30a8ea6-1e2b-56d9-8437-75ac25954af4", + "ioc-1c09e2e0-9033-596e-a603-e11472506a5d", + "ioc-1ba4bd5c-bfe3-567b-a0b1-a59a8d64488a", + "ioc-52f895d6-25f7-520e-9082-4dfdc6667c04", + "ioc-bd0a1634-8c1d-517d-89c5-b51d6ffb60de", + "ioc-6db74410-e5b2-55f8-9442-9a7aad436b26", + "ioc-ee997307-6c49-5643-b348-8da03cbb7b78", + "ioc-d6b9aa88-aa2c-5dd4-82c1-5801baa6dc84", + "ioc-8272b998-64de-5808-afe8-46b2eda0fb9f", + "ioc-4a7f36a8-64df-55d9-9d4b-5165ee7ddeb8", + "ioc-a8a466ff-728a-5dcb-b817-6f3c8b1cc98b", + "ioc-5c19f867-d3b6-57fa-834c-1f85bf1b26f5", + "ioc-44fb3383-9982-5e76-bccd-767b3b4424eb", + "ioc-7e5fe335-5960-5d7b-ba98-450e10001601", + "ioc-a7e40372-95a9-5e86-80b0-50c39a7cd74b", + "ioc-42b1233a-f1fc-5fe8-9494-91b5ae207095", + "ioc-9b69e39c-44a1-5acc-af64-af5be1827253", + "ioc-6e25a2ab-a760-5589-8a66-41106fe9ca78", + "ioc-336b324e-32fd-5811-bcc9-c2f4583f6037", + "ioc-876a80d0-36c5-5483-b284-9a6a87937905", + "ioc-4a7041f8-d718-5f93-9591-92d3012dffa5", + "ioc-267e2670-40b8-51bc-9f83-7827b02a8302", + "ioc-d5aa72b1-1997-5f33-bbe1-7184bec9996b", + "ioc-b4f5b41c-47aa-5288-89d0-bae6a3f29b3c", + "ioc-5584f65a-17db-519c-b766-9887c285674a", + "ioc-ef2d4d25-3815-58bb-8527-8e7a4295eb15", + "ioc-51fd15cc-c5f6-5249-9f80-7bc44fadc7fd", + "ioc-6a9e81f7-5ac3-59b6-ae5d-0f0bff55e5fe", + "ioc-a2eab928-f892-5dbb-8864-79169e5c3e25", + "ioc-c620f066-7706-5c69-b5a6-b26ebdc502ae", + "ioc-ce847b0d-eaed-551d-9361-6c2ab92f66db", + "ioc-28e03118-efc5-54d6-83d4-a346b9448cfb", + "ioc-d249a2a1-2961-51e6-bded-02f39ec7cd9b", + "ioc-29cf0672-a8c2-588e-b51e-bcd965b9aecb", + "ioc-41e3003d-d7c1-5fd6-b593-2c0f46a09220", + "ioc-3b13e849-8762-5d90-b0f5-6e0f9bfa6da3", + "ioc-74e8790e-27ee-5c3e-9788-8e0e950ed02e" + ], + "rule_ids": [ + "b72b1566-d05a-5fca-8cb4-229fcb59cc95", + "5fbd05f0-df10-513d-acfc-e856fa90dd70", + "83dd2ce5-c181-534b-b8b4-0b58dd9501d5" + ], + "retrieval_attempts": [ + { + "id": "poppelgaard-script", + "url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", + "http_status": 200, + "final_url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", + "sha256": "f917bcb95dd6a28b940b4842c33f48dda9c4ea8c44e3276ffffedf90270c7199", + "bytes": 81274 + }, + { + "url": "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "retrieved_utc": "2026-10-01T19:48:15.257637+00:00", + "http_status": 200, + "final_url": "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "bytes_observed": 428972, + "body_truncated": false, + "sha256": "2cde3ef8303176a6ca27a1b3765fb2c6931cda7b57458dbd9799ff94cec6d89a" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "requested": true + }, + { + "id": "technion", + "url": "https://github.com/technion/netscaler_scanner", + "title": "Community NetScaler scanner", + "classification": "community_research", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Read source only. Adds author-reported theme webshell paths. Mandiant-derived checks keep original attribution. Build-only CVE-88778 conclusion is not imported.", + "retrieval_evidence": { + "id": "technion-script", + "url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", + "http_status": 200, + "final_url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", + "sha256": "b0cda4e882faecec4fe948f890a973fcf7721b5e03ab1fc0c904c5025e7af6f7", + "bytes": 9785 + }, + "indicator_ids": [ + "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", + "ioc-b6be1d96-6a37-5350-bade-d162ede2dae5", + "ioc-766da79a-4f98-5d5c-a12d-68de5383a0a9" + ], + "rule_ids": [], + "retrieval_attempts": [ + { + "id": "technion-script", + "url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", + "http_status": 200, + "final_url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", + "sha256": "b0cda4e882faecec4fe948f890a973fcf7721b5e03ab1fc0c904c5025e7af6f7", + "bytes": 9785 + }, + { + "url": "https://github.com/technion/netscaler_scanner", + "retrieved_utc": "2026-10-01T19:48:15.823462+00:00", + "http_status": 200, + "final_url": "https://github.com/technion/netscaler_scanner", + "bytes_observed": 257755, + "body_truncated": false, + "sha256": "ac51c80839a53eb8aaa244fec51c6a842bc125757cb3f6c2655e76b8fba81a45" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "requested": true + }, + { + "id": "deyda-guide", + "url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", + "title": "Community assessment guide", + "classification": "community_guidance", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Guide and corrected current script reviewed; no script executed. Known-clean platform hashes and normal diagnostic paths are not attack IOCs.", + "retrieval_evidence": { + "id": "deyda-guide", + "url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", + "http_status": 200, + "final_url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", + "sha256": "ec5ad90195e6f4542da677c7f3a45ac26a9cd3df96406db13707834abcb50997", + "bytes": 416158 + }, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "id": "deyda-guide", + "url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", + "http_status": 200, + "final_url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", + "sha256": "ec5ad90195e6f4542da677c7f3a45ac26a9cd3df96406db13707834abcb50997", + "bytes": 416158 + }, + { + "url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", + "retrieved_utc": "2026-10-01T19:48:18.017371+00:00", + "http_status": 200, + "final_url": "https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/", + "bytes_observed": 416158, + "body_truncated": false, + "sha256": "54ddaf26c9446b00cb27b97cb8bfb276de97ecdab965fa1d9795fc1469fcef0b" + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": true + }, + { + "id": "deyda-requested-script", + "url": "https://github.com/Deyda/Security/blob/main/netscaler-ioc-check.sh", + "title": "Requested community script path", + "classification": "unavailable", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Requested path unavailable (raw equivalent HTTP404). Repository tree identifies deyda-netscaler-ioc-check.sh as current filename.", + "retrieval_evidence": { + "id": "deyda-script", + "url": "https://raw.githubusercontent.com/Deyda/Security/main/netscaler-ioc-check.sh", + "error": "HTTP Error 404: Not Found" + }, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "id": "deyda-script", + "url": "https://raw.githubusercontent.com/Deyda/Security/main/netscaler-ioc-check.sh", + "error": "HTTP Error 404: Not Found" + }, + { + "url": "https://github.com/Deyda/Security/blob/main/netscaler-ioc-check.sh", + "retrieved_utc": "2026-10-01T19:48:14.933384+00:00", + "http_status": 404, + "access_error": "Not Found" + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": true + }, + { + "id": "deyda-script", + "url": "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "title": "Current community assessment script", + "classification": "community_aggregation", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Corrected filename discovered from repository tree. Read source only; no copied scanner execution or known-good hash import.", + "retrieval_evidence": { + "id": "deyda-script-corrected", + "url": "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "http_status": 200, + "sha256": "555a17b97c6e407430cf00bcf842b4ccb9eb48564c78a8b63cdbfbc57f1a3471", + "bytes": 82695 + }, + "indicator_ids": [ + "ioc-92fc2c99-4cf5-58aa-a5d7-008d3155c8cd", + "ioc-f5816171-a941-52ac-bb19-94d0648bc8e8", + "ioc-9fffc883-a4a3-50aa-a44b-c0a10fb3c99c", + "ioc-6aadf255-b9d5-5708-a4cb-39814fa86cc9", + "ioc-c7329309-8c04-5ce5-8303-92e89a112f48", + "ioc-56976039-ce98-5925-9da5-42f80fe3d742", + "ioc-161bf202-a189-53a3-9a30-5f9ffcca29b2" + ], + "rule_ids": [ + "742a1576-1923-58ce-801a-813820e41169", + "b72b1566-d05a-5fca-8cb4-229fcb59cc95", + "67e7c3f5-d648-516e-97fc-79ceb36453fb" + ], + "retrieval_attempts": [ + { + "id": "deyda-script-corrected", + "url": "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "http_status": 200, + "sha256": "555a17b97c6e407430cf00bcf842b4ccb9eb48564c78a8b63cdbfbc57f1a3471", + "bytes": 82695 + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "requested": false + }, + { + "id": "ncsc-nl-2025", + "url": "https://github.com/NCSC-NL/citrix-2025", + "title": "NCSC-NL historical forensic checks", + "classification": "government_historical", + "published": "2025-08-06", + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "2025 campaign, not evidence of 2026 CVE coverage. Extracted string observables; binary ROP, image metadata, timestomping, permissions and live checks remain external.", + "retrieval_evidence": { + "id": "ncsc-core-yara", + "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/core-dump-checks/iocs.yar", + "http_status": 200, + "sha256": "fc071672d877b1052b33cf5f3c025c643cbc5f8dbece4a0f6063b2f5733e0389", + "bytes": 12223 + }, + "indicator_ids": [ + "ioc-be1e1a69-053d-5f29-8142-f3d907a7fb50", + "ioc-9e92512b-49c6-576e-b491-9eadb7d13866", + "ioc-1c979393-6e8e-523c-b9b0-1f3014c50412", + "ioc-4b4f876e-b6a3-53f4-b372-c6953909c1f6", + "ioc-69ff3fac-a6fc-5988-bafe-301a29a099f6", + "ioc-58d728b8-87d2-5175-a1df-49467cd38262", + "ioc-27fb7299-cf82-5839-a8d3-027ba6fe9bbf", + "ioc-c3dc5cf6-51d6-5421-a096-cb5418f99d6f", + "ioc-406a5932-92ac-501f-afa2-b6c866702938", + "ioc-36638420-6816-5109-8048-31d3256b6882", + "ioc-41d198a3-3a03-5082-b7fb-8181df570fee", + "ioc-781c7a15-9413-5958-9cb2-128a16e18fab", + "ioc-a0f0fa36-4a34-543f-b932-a2b09d3a9598", + "ioc-6b7771cb-6d28-5f49-b1ec-024e1412076e", + "ioc-88e6d8ed-e9ee-5080-9df6-20744cd131cd", + "ioc-6d38ccdd-5436-5a80-9f61-e207fce26301", + "ioc-30475a4b-1a2a-5daa-99c3-c9ca447058fb", + "ioc-8554391a-cad4-5561-a54b-48fd507995e2", + "ioc-fafd0e8b-53b2-52bf-a57c-5e6601f02137", + "ioc-42937439-f9b2-5eea-b619-347c7d04988b", + "ioc-d660fdf4-7eaa-5b94-a6e3-c5289f69ce4f", + "ioc-f297377d-3c83-5e8a-9ed3-c73815436fe0" + ], + "rule_ids": [ + "742a1576-1923-58ce-801a-813820e41169", + "3fafb627-665f-5caa-9a4b-229086449433" + ], + "retrieval_attempts": [ + { + "id": "ncsc-core-yara", + "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/core-dump-checks/iocs.yar", + "http_status": 200, + "sha256": "fc071672d877b1052b33cf5f3c025c643cbc5f8dbece4a0f6063b2f5733e0389", + "bytes": 12223 + }, + { + "url": "https://github.com/NCSC-NL/citrix-2025", + "retrieved_utc": "2026-10-01T19:48:15.250881+00:00", + "http_status": 200, + "final_url": "https://github.com/NCSC-NL/citrix-2025", + "bytes_observed": 262588, + "body_truncated": false, + "sha256": "9d8aa1ea424c613253eb446eb1c62b356df93232d1a1f7fb8192bbaedba8fa13" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "requested": true + }, + { + "id": "fox-it", + "url": "https://github.com/fox-it/citrix-netscaler-triage", + "title": "Fox-IT forensic image triage", + "classification": "forensic_tool", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Read implementation. Core utility needs disk and RAM-disk evidence; string heuristics adapted with PHP context only. Expected SUID binaries are not attack IOCs.", + "retrieval_evidence": { + "id": "fox-ioc", + "url": "https://raw.githubusercontent.com/fox-it/citrix-netscaler-triage/main/iocitrix.py", + "http_status": 200, + "sha256": "dc41fac9651b5dabe3a281fedb61584307bd6e65a9c9bbba115c236de3a2d3b9", + "bytes": 8472 + }, + "indicator_ids": [], + "rule_ids": [ + "3fafb627-665f-5caa-9a4b-229086449433" + ], + "retrieval_attempts": [ + { + "id": "fox-ioc", + "url": "https://raw.githubusercontent.com/fox-it/citrix-netscaler-triage/main/iocitrix.py", + "http_status": 200, + "sha256": "dc41fac9651b5dabe3a281fedb61584307bd6e65a9c9bbba115c236de3a2d3b9", + "bytes": 8472 + }, + { + "url": "https://github.com/fox-it/citrix-netscaler-triage", + "retrieved_utc": "2026-10-01T19:48:15.414243+00:00", + "http_status": 200, + "final_url": "https://github.com/fox-it/citrix-netscaler-triage", + "bytes_observed": 333545, + "body_truncated": false, + "sha256": "da6e3d27d6c9541f75270387415c6e1e14e0ac039780605c925816a2e891318c" + } + ], + "used_for_detection": true, + "disposition": "detection_reference", + "requested": true + }, + { + "id": "poppelgaard-script", + "url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", + "title": "Reviewed source component: poppelgaard-script", + "classification": "source_component", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Read-only source supporting parent repository review.", + "retrieval_evidence": { + "id": "poppelgaard-script", + "url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", + "http_status": 200, + "final_url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", + "sha256": "f917bcb95dd6a28b940b4842c33f48dda9c4ea8c44e3276ffffedf90270c7199", + "bytes": 81274 + }, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "id": "poppelgaard-script", + "url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", + "http_status": 200, + "final_url": "https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh", + "sha256": "f917bcb95dd6a28b940b4842c33f48dda9c4ea8c44e3276ffffedf90270c7199", + "bytes": 81274 + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": false + }, + { + "id": "technion-script", + "url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", + "title": "Reviewed source component: technion-script", + "classification": "source_component", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Read-only source supporting parent repository review.", + "retrieval_evidence": { + "id": "technion-script", + "url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", + "http_status": 200, + "final_url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", + "sha256": "b0cda4e882faecec4fe948f890a973fcf7721b5e03ab1fc0c904c5025e7af6f7", + "bytes": 9785 + }, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "id": "technion-script", + "url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", + "http_status": 200, + "final_url": "https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh", + "sha256": "b0cda4e882faecec4fe948f890a973fcf7721b5e03ab1fc0c904c5025e7af6f7", + "bytes": 9785 + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": false + }, + { + "id": "fox-ioc", + "url": "https://raw.githubusercontent.com/fox-it/citrix-netscaler-triage/main/iocitrix.py", + "title": "Reviewed source component: fox-ioc", + "classification": "source_component", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Read-only source supporting parent repository review.", + "retrieval_evidence": { + "id": "fox-ioc", + "url": "https://raw.githubusercontent.com/fox-it/citrix-netscaler-triage/main/iocitrix.py", + "http_status": 200, + "sha256": "dc41fac9651b5dabe3a281fedb61584307bd6e65a9c9bbba115c236de3a2d3b9", + "bytes": 8472 + }, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "id": "fox-ioc", + "url": "https://raw.githubusercontent.com/fox-it/citrix-netscaler-triage/main/iocitrix.py", + "http_status": 200, + "sha256": "dc41fac9651b5dabe3a281fedb61584307bd6e65a9c9bbba115c236de3a2d3b9", + "bytes": 8472 + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": false + }, + { + "id": "ncsc-checks", + "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/checks.yaml", + "title": "Reviewed source component: ncsc-checks", + "classification": "source_component", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Read-only source supporting parent repository review.", + "retrieval_evidence": { + "id": "ncsc-checks", + "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/checks.yaml", + "http_status": 200, + "sha256": "02c7badf490f42c3f7084fab42bab2e5dfff76f5630cb071c8c0eb19e1d6c210", + "bytes": 3889 + }, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "id": "ncsc-checks", + "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/checks.yaml", + "http_status": 200, + "sha256": "02c7badf490f42c3f7084fab42bab2e5dfff76f5630cb071c8c0eb19e1d6c210", + "bytes": 3889 + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": false + }, + { + "id": "ncsc-core-yara", + "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/core-dump-checks/iocs.yar", + "title": "Reviewed source component: ncsc-core-yara", + "classification": "source_component", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Read-only source supporting parent repository review.", + "retrieval_evidence": { + "id": "ncsc-core-yara", + "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/core-dump-checks/iocs.yar", + "http_status": 200, + "sha256": "fc071672d877b1052b33cf5f3c025c643cbc5f8dbece4a0f6063b2f5733e0389", + "bytes": 12223 + }, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "id": "ncsc-core-yara", + "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/core-dump-checks/iocs.yar", + "http_status": 200, + "sha256": "fc071672d877b1052b33cf5f3c025c643cbc5f8dbece4a0f6063b2f5733e0389", + "bytes": 12223 + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": false + }, + { + "id": "ncsc-live", + "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/live-host-bash-check/TLPCLEAR_check_script_cve-2025-6543-v1.8.sh", + "title": "Reviewed source component: ncsc-live", + "classification": "source_component", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Read-only source supporting parent repository review.", + "retrieval_evidence": { + "id": "ncsc-live", + "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/live-host-bash-check/TLPCLEAR_check_script_cve-2025-6543-v1.8.sh", + "http_status": 200, + "sha256": "abd98a108998af6ec95229002a90a0eae320546c7fd08ae93bef5724390aafa0", + "bytes": 2068 + }, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "id": "ncsc-live", + "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/live-host-bash-check/TLPCLEAR_check_script_cve-2025-6543-v1.8.sh", + "http_status": 200, + "sha256": "abd98a108998af6ec95229002a90a0eae320546c7fd08ae93bef5724390aafa0", + "bytes": 2068 + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": false + }, + { + "id": "watch-poc", + "url": "https://raw.githubusercontent.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py", + "title": "Reviewed source component: watch-poc", + "classification": "source_component", + "published": null, + "retrieved": "2026-10-01", + "access": "Rendered web page reviewed", + "use_or_omission_reason": "Read-only source supporting parent repository review.", + "retrieval_evidence": { + "id": "watch-poc", + "url": "https://raw.githubusercontent.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py", + "http_status": 200, + "sha256": "c206c6da679260a0bb5d325ceb55984fed16a9016e8346cbe8344f59e3f76669", + "bytes": 1917 + }, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "id": "watch-poc", + "url": "https://raw.githubusercontent.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py", + "http_status": 200, + "sha256": "c206c6da679260a0bb5d325ceb55984fed16a9016e8346cbe8344f59e3f76669", + "bytes": 1917 + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": false + }, + { + "id": "ncsc-php_webshell_rules.yara", + "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/yara/php_webshell_rules.yara", + "title": "NCSC-referenced general webshell YARA collection", + "retrieved": "2026-10-01", + "published": null, + "http_status": 200, + "sha256": "e4c6b3816be2bb7d8795d3b6c266d617f1c871e7f72c35af5dcd7326775bca15", + "classification": "general_filesystem_yara", + "use_or_omission_reason": "Generic multi-platform historical webshell library, not campaign-specific NetScaler log rules. Indexed for external file/core scanning; no misleading line-by-line Sigma conversion.", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": false + }, + { + "id": "ncsc-thor-webshells.yar", + "url": "https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/yara/thor-webshells.yar", + "title": "NCSC-referenced general webshell YARA collection", + "retrieved": "2026-10-01", + "published": null, + "http_status": 200, + "sha256": "922db101bc89d8a3e928ac1a94762a2512e2cb6592c05b3e810bc61176067c67", + "classification": "general_filesystem_yara", + "use_or_omission_reason": "Generic multi-platform historical webshell library, not campaign-specific NetScaler log rules. Indexed for external file/core scanning; no misleading line-by-line Sigma conversion.", + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": false + }, + { + "id": "requested-77a190a3", + "url": "https://github.com/elastic/detection-rules/blob/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml", + "retrieved": "2026-10-01", + "access": "Alternative canonical/raw source used.", + "used": false, + "alternate_source_ids": [ + "elastic-toml" + ], + "use_or_omission_reason": "Exact requested URL retained for audit; see linked alternate retrievals.", + "published": null, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://github.com/elastic/detection-rules/blob/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml", + "retrieved_utc": "2026-10-01T19:48:15.389901+00:00", + "http_status": 200, + "final_url": "https://github.com/elastic/detection-rules/blob/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml", + "bytes_observed": 336859, + "body_truncated": false, + "sha256": "607e1bf8c2a222c7ea979a10d65a1eed45125ce8106322d7e864d8c44acf7110" + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": true + }, + { + "id": "requested-7e6e5286", + "url": "https://github.com/rtkwlf/wolf-tools/blob/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "retrieved": "2026-10-01", + "access": "Alternative canonical/raw source used.", + "used": false, + "alternate_source_ids": [ + "arctic-wolf" + ], + "use_or_omission_reason": "Exact requested URL retained for audit; see linked alternate retrievals.", + "published": null, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://github.com/rtkwlf/wolf-tools/blob/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "retrieved_utc": "2026-10-01T19:48:15.790062+00:00", + "http_status": 200, + "final_url": "https://github.com/rtkwlf/wolf-tools/blob/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "bytes_observed": 271763, + "body_truncated": false, + "sha256": "99c12e78ebe5d346b49ca31c9d00d6cd94f58b7cac0f2b741809ebedc1c491a1" + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": true + }, + { + "id": "requested-f8052bbe", + "url": "https://support.citrix.com/external/article?articleNumber=CTX697096", + "retrieved": "2026-10-01", + "access": "Alternative canonical/raw source used.", + "used": false, + "alternate_source_ids": [ + "CITRIX-CTX697096" + ], + "use_or_omission_reason": "Exact requested URL retained for audit; see linked alternate retrievals.", + "published": null, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://support.citrix.com/external/article?articleNumber=CTX697096", + "retrieved_utc": "2026-10-01T19:48:17.659872+00:00", + "http_status": 200, + "final_url": "https://support.citrix.com/external/article?articleNumber=CTX697096", + "bytes_observed": 197121, + "body_truncated": false, + "sha256": "9ef6a55ea7a6e83997095cc6b93df868a2f4c03a0f276fab76bf4d4f314103aa" + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": true + }, + { + "id": "requested-6c93ceb2", + "url": "https://www.elastic.co/guide/en/security/8.19/potential-netscaler-log-poisoning-command-injection-attempt.html", + "retrieved": "2026-10-01", + "access": "No independently verified content available in the research records.", + "used": false, + "alternate_source_ids": [], + "use_or_omission_reason": "Unavailable or not verified; no indicator invented.", + "published": null, + "indicator_ids": [], + "rule_ids": [], + "retrieval_attempts": [ + { + "url": "https://www.elastic.co/guide/en/security/8.19/potential-netscaler-log-poisoning-command-injection-attempt.html", + "retrieved_utc": "2026-10-01T19:48:19.060733+00:00", + "http_status": 200, + "final_url": "https://www.elastic.co/guide/en/security/8.19/potential-netscaler-log-poisoning-command-injection-attempt.html", + "bytes_observed": 26278, + "body_truncated": false, + "sha256": "0803d9e1e16f8698e61deaa9fa9bd67dcc9e878e646cd7fb0fab0a0b713292a3" + } + ], + "used_for_detection": false, + "disposition": "guidance_or_access_limitation", + "requested": true + } + ], + "indicators": [ + { + "id": "ioc-8498baad-3aed-5bb1-884f-65a777f79237", + "type": "domain", + "value": "echvista.com", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Associated exploit source domain — CVE-2026-88771 NetScaler 0-day exploitation", + "misp_type": "domain", + "misp_to_ids": true, + "attribute_uuid": "d3797228-94d1-4358-b5a8-e868b9de25bd", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated campaign domain", + "confidence": "low", + "description": "Community-aggregated campaign domain", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "poppelgaard" + ], + "roles": [ + "Community-aggregated campaign domain", + "Secondary-source artifact; validate cited original report." + ], + "role": "Community-aggregated campaign domain; Secondary-source artifact; validate cited original report.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c5347a81-e228-5319-98df-39890efbb198", + "type": "domain", + "value": "entretiensol.com", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated campaign domain", + "confidence": "low", + "description": "Community-aggregated campaign domain", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-aggregated campaign domain", + "Reported payload, persistence or network artifact." + ], + "role": "Community-aggregated campaign domain; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-dd1dadd2-b5a0-5b09-aa76-490d04588bf0", + "type": "domain", + "value": "httpworkbench.com", + "status": "reference_only", + "source_ids": [ + "beazley" + ], + "source_urls": [ + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "observations": [ + { + "status": "reference_only", + "role": "out_of_band_callback", + "description": "Shared callback service, context and exact subdomain required; not blanket malicious ownership.", + "confidence": "secondary_reported", + "source_ids": [ + "beazley" + ], + "source_urls": [ + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "beazley", + "published": "2026-09-26", + "retrieved": "2026-10-01T19:36:45.510941+00:00" + } + ] + } + ], + "source": [ + "beazley" + ], + "roles": [ + "out_of_band_callback" + ], + "role": "out_of_band_callback", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-4b4f876e-b6a3-53f4-b372-c6953909c1f6", + "type": "ipv4", + "value": "101.99.91.107", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-e7e4adf2-30dc-5f99-8744-dd8dd33d46f3", + "type": "ipv4", + "value": "104.203.50.26", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-d303c696-5789-5803-9ef3-05942ad7455f", + "type": "ipv4", + "value": "104.248.244.66", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "poppelgaard", + "truesec", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", + "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" + ], + "observations": [ + { + "status": "reference_only", + "description": "Possible command-and-control address according to the source; determine its role in local evidence separately.", + "source_ids": [ + "truesec" + ], + "source_urls": [ + "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "truesec", + "published": "2026-09-28", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "reconnaissance", + "description": "Version-fingerprinting requests observed Aug21–22.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "potential_c2", + "description": "Truesec explicitly calls these potential C2 IPs; uncertainty retained.", + "confidence": "suspected", + "source_ids": [ + "truesec" + ], + "source_urls": [ + "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "truesec", + "published": "2026-09-28", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Potential exploit source (Truesec) — CVE-2026-88771 NetScaler 0-day exploitation", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "63ac6c2d-e151-4cbc-8c20-18b5de1f191c", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "poppelgaard", + "truesec", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "potential_c2", + "reconnaissance", + "reference_indicator" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; potential_c2; reconnaissance; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-5d7bb685-145e-596d-af2a-98899689f550", + "type": "ipv4", + "value": "104.248.74.206", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_request_source", + "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Requested nsgclient18.deb and nsgser18.deb (Sep 7). Source: Unit42 threat brief.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "81a2c1fb-c32d-46a2-8280-340901da1e37", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "webshell_request_source" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; webshell_request_source", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-88277771-c097-5e0a-be71-fa648013d363", + "type": "ipv4", + "value": "104.28.215.136", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "shared_proxy_infrastructure", + "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure. Cloudflare WARP/shared egress: validate timestamp and behavior; not exclusive attacker ownership.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", + "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", + "confidence": "low", + "status": "context_only", + "original_comment": "Cloudflare WARP VPN egress — requested nsgclient18.deb, nsgsupport.deb, nsgpackage64.deb (Sep 9-11). Legitimate consumer VPN used by millions; blocking would cause false positives. Evaluate WARP usage in your environment first. Source: Unit42 threat brief.", + "misp_type": "ip-dst", + "misp_to_ids": false, + "attribute_uuid": "38cd859a-efb5-48e8-a4d5-834b4bd538cf", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "context_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Shared Cloudflare WARP egress; not suitable for blanket blocking.", + "shared_proxy_infrastructure" + ], + "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.; shared_proxy_infrastructure", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": true + }, + { + "id": "ioc-8db8c7f4-b7de-53a1-a515-7e0b14defddc", + "type": "ipv4", + "value": "104.28.215.137", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "shared_proxy_infrastructure", + "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure. Cloudflare WARP/shared egress: validate timestamp and behavior; not exclusive attacker ownership.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", + "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", + "confidence": "low", + "status": "context_only", + "original_comment": "Cloudflare WARP VPN egress — .deb webshell requests + continuous GetUserName page polling (Sep 10-27). Legitimate consumer VPN used by millions; blocking would cause false positives. Source: Unit42 threat brief.", + "misp_type": "ip-dst", + "misp_to_ids": false, + "attribute_uuid": "6dd6fa40-8166-4bed-9f3e-a9d19b8f39d9", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "context_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Shared Cloudflare WARP egress; not suitable for blanket blocking.", + "shared_proxy_infrastructure" + ], + "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.; shared_proxy_infrastructure", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": true + }, + { + "id": "ioc-3f59b4a2-81f4-52d3-ad85-341b77d123af", + "type": "ipv4", + "value": "104.28.247.136", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "shared_proxy_infrastructure", + "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure. Cloudflare WARP/shared egress: validate timestamp and behavior; not exclusive attacker ownership.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", + "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", + "confidence": "low", + "status": "context_only", + "original_comment": "Cloudflare WARP VPN egress — requested nsgclient18.deb, nsgsupport.deb, nsgpackage64.deb (Sep 9-11). Legitimate consumer VPN used by millions; blocking would cause false positives. Source: Unit42 threat brief.", + "misp_type": "ip-dst", + "misp_to_ids": false, + "attribute_uuid": "c99cf527-3734-4e00-893d-60ee8d2b0664", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "context_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Shared Cloudflare WARP egress; not suitable for blanket blocking.", + "shared_proxy_infrastructure" + ], + "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.; shared_proxy_infrastructure", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": true + }, + { + "id": "ioc-f84c61ba-0640-5302-9394-a286f1af181a", + "type": "ipv4", + "value": "104.28.247.137", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "shared_proxy_infrastructure", + "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure. Cloudflare WARP/shared egress: validate timestamp and behavior; not exclusive attacker ownership.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", + "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.", + "confidence": "low", + "status": "context_only", + "original_comment": "Cloudflare WARP VPN egress — continuous GetUserName page polling (Sep 10-27), continued 2.5 days past last webshell request. Legitimate consumer VPN used by millions; blocking would cause false positives. Source: Unit42 threat brief.", + "misp_type": "ip-dst", + "misp_to_ids": false, + "attribute_uuid": "878895c1-7b92-41d1-a0d6-985c6d5e8e83", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "context_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Shared Cloudflare WARP egress; not suitable for blanket blocking.", + "shared_proxy_infrastructure" + ], + "role": "Shared Cloudflare WARP egress; not suitable for blanket blocking.; shared_proxy_infrastructure", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": true + }, + { + "id": "ioc-1ba4bd5c-bfe3-567b-a0b1-a59a8d64488a", + "type": "ipv4", + "value": "113.137.102.68", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-af13acba-cb3e-5da7-81c0-55317f6a40ad", + "type": "ipv4", + "value": "120.28.233.211", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-9b69e39c-44a1-5acc-af64-af5be1827253", + "type": "ipv4", + "value": "125.122.56.47", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-902af158-00bf-5776-b73f-dfdcc74d7b94", + "type": "ipv4", + "value": "130.94.106.141", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-8a726a35-98c3-546d-a6e5-9fd610e11b9c", + "type": "ipv4", + "value": "130.94.42.226", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Reported payload, persistence or network artifact." + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a1597715-32a1-5cb4-92b4-21b6e07b28ab", + "type": "ipv4", + "value": "134.175.71.50", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Reported payload, persistence or network artifact." + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c8516943-75d8-53bf-a2e7-cd3a30bfa397", + "type": "ipv4", + "value": "137.184.91.207", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_request_source", + "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Requested nsgclient18.deb and nsgser18.deb (Sep 7). Source: Unit42 threat brief.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "1e2879f8-45c4-4e0a-8271-6b94a809bf9f", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "webshell_request_source" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; webshell_request_source", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-48bd85f0-1c35-5e7d-9945-ada5a31375df", + "type": "ipv4", + "value": "137.220.53.135", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-e5099e29-453c-549f-81c6-f021ea7eed4d", + "type": "ipv4", + "value": "138.199.200.90", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-0658af95-9f7b-53dc-883b-0dd538ebcc41", + "type": "ipv4", + "value": "138.28.234.38", + "status": "reference_only", + "source_ids": [ + "beazley", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "observations": [ + { + "status": "reference_only", + "role": "attempted_dns_exfiltration", + "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", + "confidence": "secondary_reported", + "source_ids": [ + "beazley" + ], + "source_urls": [ + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "beazley", + "published": "2026-09-26", + "retrieved": "2026-10-01T19:36:45.510941+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "beazley", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "attempted_dns_exfiltration" + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; attempted_dns_exfiltration", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-778a1ee5-2ae7-58d5-90b7-00922171eed0", + "type": "ipv4", + "value": "138.68.21.29", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "description": "Temporal and service-path association; attacker role unconfirmed.", + "role": "Temporal and service-path association; attacker role unconfirmed.", + "confidence": "medium", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "sygnia" + ], + "roles": [ + "Temporal and service-path association; attacker role unconfirmed." + ], + "role": "Temporal and service-path association; attacker role unconfirmed.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-e8d81126-8f30-5a43-a1fe-7a209e3c9f46", + "type": "ipv4", + "value": "139.180.152.138", + "status": "reference_only", + "source_ids": [ + "esentire", + "ifin-event", + "poppelgaard", + "truesec", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", + "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" + ], + "observations": [ + { + "status": "reference_only", + "description": "Possible command-and-control address according to the source; determine its role in local evidence separately.", + "source_ids": [ + "truesec" + ], + "source_urls": [ + "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "truesec", + "published": "2026-09-28", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Webshell delivery", + "description": "Webshell delivery", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "webshell_delivery", + "description": "Three-stage injection activity observed Sep21.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "potential_c2", + "description": "Truesec explicitly calls these potential C2 IPs; uncertainty retained.", + "confidence": "suspected", + "source_ids": [ + "truesec" + ], + "source_urls": [ + "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "truesec", + "published": "2026-09-28", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Potential exploit source (Truesec) — CVE-2026-88771 NetScaler 0-day exploitation", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "739ec179-995c-48bf-b6d1-30bd2a11e30a", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "esentire", + "ifin-event", + "poppelgaard", + "truesec", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Webshell delivery", + "potential_c2", + "reference_indicator", + "webshell_delivery" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Webshell delivery; potential_c2; reference_indicator; webshell_delivery", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-d7bb06f3-6e14-51de-b9d3-fd4a62848d70", + "type": "ipv4", + "value": "142.93.205.229", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-58a85e7c-0f3b-528a-a4d1-c363751df656", + "type": "ipv4", + "value": "142.93.85.227", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_request_source", + "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Requested nsgclient18.deb and nsgser18.deb (Sep 6). Source: Unit42 threat brief.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "af34ca73-9a82-427b-9ddc-f325e6a31aae", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "webshell_request_source" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; webshell_request_source", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-d41442c2-d7b7-5457-a56c-3d8b0d5f47f8", + "type": "ipv4", + "value": "143.198.7.94", + "status": "reference_only", + "source_ids": [ + "beazley", + "ifin-event", + "mandiant", + "poppelgaard" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://labs.beazley.security/advisories/BSL-A1216", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "status": "reference_only", + "description": "Publicly reported infrastructure.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "scanning_and_staging", + "description": "scanning_and_staging", + "confidence": "published", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "scanning_and_staging", + "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", + "confidence": "secondary_reported", + "source_ids": [ + "beazley" + ], + "source_urls": [ + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "beazley", + "published": "2026-09-26", + "retrieved": "2026-10-01T19:36:45.510941+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Scanning and staging infrastructure — Mandiant/GTIG observed during CVE-2026-88772 exploitation campaign. Source: Mandiant blog 2026-09-29.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "38aca0c2-2848-4e72-8721-612ee0cc0ef7", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "beazley", + "ifin-event", + "mandiant", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "reference_indicator", + "scanning_and_staging" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; reference_indicator; scanning_and_staging", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-162d81fe-cd64-58fa-8672-c3970e292c6a", + "type": "ipv4", + "value": "144.172.108.78", + "status": "reference_only", + "source_ids": [ + "esentire", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "observations": [ + { + "status": "reference_only", + "role": "Exploitation source", + "description": "Exploitation source", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "esentire", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Exploitation source" + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploitation source", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-5ddc05e7-b0e3-5ec8-89d0-d2a7b4004dc7", + "type": "ipv4", + "value": "149.104.78.141", + "status": "reference_only", + "source_ids": [ + "beazley", + "esentire", + "greynoise", + "ifin-event", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://labs.beazley.security/advisories/BSL-A1216", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", + "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" + ], + "observations": [ + { + "status": "reference_only", + "role": "Exploitation source", + "description": "Exploitation source", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "exploitation_attempt", + "description": "Sep24 sensor activity; attacker failed to gain a foothold on the observed sensor.", + "confidence": "published", + "source_ids": [ + "greynoise" + ], + "source_urls": [ + "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "greynoise", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:36:45.065290+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "exploitation_attempt", + "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", + "confidence": "secondary_reported", + "source_ids": [ + "beazley" + ], + "source_urls": [ + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "beazley", + "published": "2026-09-26", + "retrieved": "2026-10-01T19:36:45.510941+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Exploitation source — GreyNoise observed CVE-2026-88771 exploitation from this IP on 2026-09-24 07:32:19 UTC, 3+ days before public disclosure. Detected via Project Swarm sensor. Also attempted CitrixBleed 2 (CVE-2025-5777) and generic ${IFS} RCE. Source: GreyNoise blog 2026-09-28.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "6d167a7b-709f-4394-9413-b616df7ede68", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "beazley", + "esentire", + "greynoise", + "ifin-event", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Exploitation source", + "exploitation_attempt" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploitation source; exploitation_attempt", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-e3c53f68-c632-5ac9-b63a-3332c4e53e7e", + "type": "ipv4", + "value": "149.104.78.208", + "status": "reference_only", + "source_ids": [ + "rapid7" + ], + "source_urls": [ + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" + ], + "observations": [ + { + "description": "Exploitation attempt source at 2026-09-20 14:28:43 UTC.", + "role": "Exploitation attempt source at 2026-09-20 14:28:43 UTC.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "rapid7" + ], + "source_urls": [ + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "rapid7", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039385+00:00" + } + ] + } + ], + "source": [ + "rapid7" + ], + "roles": [ + "Exploitation attempt source at 2026-09-20 14:28:43 UTC." + ], + "role": "Exploitation attempt source at 2026-09-20 14:28:43 UTC.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-cca66732-d7da-5495-a39a-3e9812f35db0", + "type": "ipv4", + "value": "149.28.29.221", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Associated exploit source — CVE-2026-88771 NetScaler 0-day exploitation", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "f571e002-ac7f-4e3b-86a2-55cd586cbf35", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-1ad4e7d7-d388-5b18-a21a-a1498eac5db2", + "type": "ipv4", + "value": "149.28.58.71", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c3a95a53-417c-50eb-8367-6613bbb58ed5", + "type": "ipv4", + "value": "153.75.82.220", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "esentire", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "observations": [ + { + "status": "reference_only", + "role": "Exploitation source", + "description": "Exploitation source", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "esentire", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Exploitation source", + "Reported payload, persistence or network artifact." + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploitation source; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-98943c22-5071-5c8d-80af-1499a22bb82b", + "type": "ipv4", + "value": "154.217.251.226", + "status": "reference_only", + "source_ids": [ + "beazley", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "observations": [ + { + "status": "reference_only", + "role": "dtls_scanning", + "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", + "confidence": "secondary_reported", + "source_ids": [ + "beazley" + ], + "source_urls": [ + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "beazley", + "published": "2026-09-26", + "retrieved": "2026-10-01T19:36:45.510941+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "beazley", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "dtls_scanning" + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; dtls_scanning", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-ff6e3066-e7b8-5a6f-8605-c856ce3594e5", + "type": "ipv4", + "value": "157.254.167.12", + "status": "reference_only", + "source_ids": [ + "beazley", + "ifin-event", + "mandiant", + "poppelgaard" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://labs.beazley.security/advisories/BSL-A1216", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "status": "reference_only", + "description": "Publicly reported infrastructure.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "exploitation_and_backdoor_installation", + "description": "exploitation_and_backdoor_installation", + "confidence": "published", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "exploitation_and_backdoor_installation", + "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", + "confidence": "secondary_reported", + "source_ids": [ + "beazley" + ], + "source_urls": [ + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "beazley", + "published": "2026-09-26", + "retrieved": "2026-10-01T19:36:45.510941+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "NetScaler exploitation and installation of basic web shell backdoor — Mandiant/GTIG observed during CVE-2026-88772 campaign. Source: Mandiant blog 2026-09-29.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "a85695f2-df5f-46a6-a55d-0c4e74b3084e", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "beazley", + "ifin-event", + "mandiant", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "exploitation_and_backdoor_installation", + "reference_indicator" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; exploitation_and_backdoor_installation; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-d868065f-7b8f-5967-a28e-999f3374e05e", + "type": "ipv4", + "value": "158.94.209.12", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-30c0c3e4-d183-5519-aba6-1be38489baf9", + "type": "ipv4", + "value": "159.26.103.184", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-4f12e46e-4bf9-53f4-bb19-359adf58ed12", + "type": "ipv4", + "value": "159.65.104.231", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-3ac70540-bc3f-5e22-9543-20b6a3f1f5a3", + "type": "ipv4", + "value": "162.243.36.88", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported source of an exploitation attempt.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Source of NetScaler exploitation attempts", + "description": "Source of NetScaler exploitation attempts", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Source of NetScaler exploitation attempts — CVE-2026-88771. Source: LevelBlue THOR team.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "7eef96c3-96a6-4c54-b313-fff9c2ecc7c1", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Source of NetScaler exploitation attempts", + "reference_indicator" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Source of NetScaler exploitation attempts; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-fe8a84c1-10d4-5f6d-8398-8258d294cbec", + "type": "ipv4", + "value": "162.33.178.9", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "poppelgaard", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_request_source", + "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Requested nsgbuild.deb and nsgsupport.deb from /vpn/scripts/linux/ (Sep 14). Source: Unit42 threat brief.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "380b92e7-24c6-499e-acd6-0d32b1e4aebb", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "poppelgaard", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "webshell_request_source" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; webshell_request_source", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-6157a981-c183-5e32-819e-58da121efccf", + "type": "ipv4", + "value": "165.227.201.112", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-0e94e1b4-f698-5632-93fc-070d0dd6ce91", + "type": "ipv4", + "value": "167.99.111.203", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_request_source", + "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Requested nsgclient18.deb and nsgser18.deb (Sep 5). Source: Unit42 threat brief.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "46e5a6d7-0ab8-498c-95fe-51ccc483e987", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "webshell_request_source" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; webshell_request_source", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-07322dbb-0181-5251-aa32-1845d7735c37", + "type": "ipv4", + "value": "170.64.176.26", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "description": "Associated IR activity, precise role unspecified.", + "role": "Associated IR activity, precise role unspecified.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "sygnia" + ], + "roles": [ + "Associated IR activity, precise role unspecified." + ], + "role": "Associated IR activity, precise role unspecified.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-4f2b7167-4b7f-5f3f-a62f-a7e54565de90", + "type": "ipv4", + "value": "171.106.10.118", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-8b1bf480-3e2c-5048-9b98-88ba4129ae24", + "type": "ipv4", + "value": "172.247.44.85", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-90649d83-c1f6-578d-be53-189c899946cd", + "type": "ipv4", + "value": "173.231.39.244", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-17e10bf5-fbb9-5fc2-a303-ec38fd5f5c5b", + "type": "ipv4", + "value": "173.40.135.209", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported source of an exploitation attempt.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Source of NetScaler exploitation attempts", + "description": "Source of NetScaler exploitation attempts", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Source of NetScaler exploitation attempts — CVE-2026-88771. Source: LevelBlue THOR team.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "5116a55c-775b-4e2b-8838-46ab4818f5bd", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Source of NetScaler exploitation attempts", + "reference_indicator" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Source of NetScaler exploitation attempts; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-267e2670-40b8-51bc-9f83-7827b02a8302", + "type": "ipv4", + "value": "176.65.148.54", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-b3723f40-7003-5461-bc87-f147a3bb9479", + "type": "ipv4", + "value": "177.4.12.11", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Reported payload, persistence or network artifact." + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a9b0db77-074b-50d8-9116-8514f95cceb4", + "type": "ipv4", + "value": "178.218.40.232", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-b1b5375a-1395-586c-8b62-be709809345b", + "type": "ipv4", + "value": "178.66.43.241", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f132a2db-c271-54b1-ab24-9c6d11ac8776", + "type": "ipv4", + "value": "180.242.113.168", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-ac2d267d-5c7f-5039-9290-4e67f064d836", + "type": "ipv4", + "value": "182.101.54.57", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f20ace6b-d4a1-51e4-9f5d-bdb21ef8cf61", + "type": "ipv4", + "value": "185.156.46.162", + "status": "reference_only", + "source_ids": [ + "esentire", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "observations": [ + { + "status": "reference_only", + "role": "Exploitation source", + "description": "Exploitation source", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "esentire", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Exploitation source" + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploitation source", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-66cfbde1-07c1-560f-b967-bcc78846ca0a", + "type": "ipv4", + "value": "185.170.55.89", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-45acd1bd-635f-54c3-b9ff-2262ffa20798", + "type": "ipv4", + "value": "185.209.15.246", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-bdd9a621-f6c1-5802-994b-e2aa2d1b738e", + "type": "ipv4", + "value": "185.243.41.247", + "status": "reference_only", + "source_ids": [ + "esentire", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "observations": [ + { + "status": "reference_only", + "role": "Campaign infrastructure", + "description": "Campaign infrastructure", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "esentire", + "poppelgaard" + ], + "roles": [ + "Campaign infrastructure", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" + ], + "role": "Campaign infrastructure; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-aade0d13-89ea-5606-afc8-55f79ef679fe", + "type": "ipv4", + "value": "191.37.30.194", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-8673a250-0f1b-5b6e-8eb1-7f6a6aee74ff", + "type": "ipv4", + "value": "193.149.176.207", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "poppelgaard", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_request_source", + "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Most active .deb webshell requester — requested nsgbuild.deb daily Sep 15-24. Also sent GetUserName page requests Sep 10-27. Source: Unit42 threat brief.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "591ee741-5efc-4fd0-90c6-8cc45d009e3d", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "poppelgaard", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "webshell_request_source" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; webshell_request_source", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-42b1233a-f1fc-5fe8-9494-91b5ae207095", + "type": "ipv4", + "value": "194.242.130.193", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-9fcb074c-31a3-59a2-b5f2-5ff1b0db5a04", + "type": "ipv4", + "value": "194.26.29.88", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-107a87f4-b8a8-54a9-9a11-6b2057c01bb2", + "type": "ipv4", + "value": "194.28.195.90", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-58d728b8-87d2-5175-a1df-49467cd38262", + "type": "ipv4", + "value": "194.36.37.5", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-2a11ac33-78e9-5681-baad-a8249056008f", + "type": "ipv4", + "value": "197.52.9.138", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f68754cd-53d6-5124-a672-16b8719e6abc", + "type": "ipv4", + "value": "198.13.159.233", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-020335a1-0dfd-521b-a90d-7e85acd1827a", + "type": "ipv4", + "value": "206.232.71.215", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-47605cce-3519-5bef-99ab-72e3470369a4", + "type": "ipv4", + "value": "209.250.236.77", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "description": "Temporal association; attacker role unconfirmed.", + "role": "Temporal association; attacker role unconfirmed.", + "confidence": "medium", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "sygnia" + ], + "roles": [ + "Temporal association; attacker role unconfirmed." + ], + "role": "Temporal association; attacker role unconfirmed.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-1797b953-d34e-57ea-84f5-06686445bee6", + "type": "ipv4", + "value": "216.203.21.233", + "status": "reference_only", + "source_ids": [ + "esentire", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "observations": [ + { + "status": "reference_only", + "role": "Exploitation source", + "description": "Exploitation source", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "esentire", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Exploitation source" + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploitation source", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-eeca8bef-5aa4-524c-b5de-52976350cbcb", + "type": "ipv4", + "value": "216.245.184.164", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "poppelgaard", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "reported_campaign_infrastructure", + "description": "Published network IOC; request alone does not prove successful execution.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Unit42 network indicator — CVE-2026-88771/88772 exploitation activity. Source: Unit42 threat brief 2026-09-30.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "a1961d43-2434-4101-ab9b-f7dae1e6b4f1", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "poppelgaard", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "reported_campaign_infrastructure" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; reported_campaign_infrastructure", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-6e25a2ab-a760-5589-8a66-41106fe9ca78", + "type": "ipv4", + "value": "23.132.164.35", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-1174ab82-cd5e-51fe-99a6-437284c2ce45", + "type": "ipv4", + "value": "23.234.111.22", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c896dcc8-b975-54b6-9084-f8c446f4b0a5", + "type": "ipv4", + "value": "23.234.74.48", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c8358d1e-503f-51d7-81f8-68d88e4f49ee", + "type": "ipv4", + "value": "23.27.143.20", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "esentire", + "ifin-event", + "levelblue", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported payload infrastructure.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Exploit source and payload host", + "description": "Exploit source and payload host", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Payload host", + "description": "Payload host", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Exploit source and payload host — hosted main.py reverse-shell payload at port 9000. Source: LevelBlue THOR team.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "39dd1a7b-a301-4469-b8be-b16e28852ce8", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "esentire", + "ifin-event", + "levelblue", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Exploit source and payload host", + "Payload host", + "Reported payload, persistence or network artifact.", + "reference_indicator" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploit source and payload host; Payload host; Reported payload, persistence or network artifact.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-ea140046-4e0d-5e16-a150-a5a68f69b635", + "type": "ipv4", + "value": "31.13.192.160", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-0ca245ac-8c4a-550c-a481-ce38d4f90ec6", + "type": "ipv4", + "value": "31.56.197.72", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "esentire", + "ifin-event", + "levelblue", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported payload infrastructure.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Payload-hosting infrastructure", + "description": "Payload-hosting infrastructure", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Payload host", + "description": "Payload host", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Payload-hosting infrastructure — hosted 'lula' payload on port 9090. Source: LevelBlue THOR team.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "51b90587-d364-47b1-93bc-3430464f1b89", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "esentire", + "ifin-event", + "levelblue", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Payload host", + "Payload-hosting infrastructure", + "Reported payload, persistence or network artifact.", + "reference_indicator" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Payload host; Payload-hosting infrastructure; Reported payload, persistence or network artifact.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-b107d9fe-dd85-5b1e-97a8-4b18ac44e87a", + "type": "ipv4", + "value": "34.90.151.231", + "status": "reference_only", + "source_ids": [ + "esentire", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "observations": [ + { + "status": "reference_only", + "role": "Reconnaissance + webshell delivery", + "description": "Reconnaissance + webshell delivery", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "esentire", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Reconnaissance + webshell delivery" + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reconnaissance + webshell delivery", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c54202eb-b7f3-5197-90ae-385d2eef2d19", + "type": "ipv4", + "value": "37.19.221.171", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-1c979393-6e8e-523c-b9b0-1f3014c50412", + "type": "ipv4", + "value": "38.60.245.99", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-4a7041f8-d718-5f93-9591-92d3012dffa5", + "type": "ipv4", + "value": "4.246.63.96", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-876a80d0-36c5-5483-b284-9a6a87937905", + "type": "ipv4", + "value": "44.226.128.41", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a7e40372-95a9-5e86-80b0-50c39a7cd74b", + "type": "ipv4", + "value": "44.252.255.141", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-94302100-6f11-53c2-a8e3-e9f7547bacad", + "type": "ipv4", + "value": "45.141.21.130", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "ifin-event", + "levelblue", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported reverse-shell destination on TCP port 443.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Reverse-shell C2 infrastructure", + "description": "Reverse-shell C2 infrastructure", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Reverse-shell C2 infrastructure — customsnmpd (overwritten by main.py) connects to this IP:443 and redirects stdio to socket for interactive /bin/sh. Source: LevelBlue THOR team.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "9d7bbb21-2c8d-45c9-8097-93affe01b2b7", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "ifin-event", + "levelblue", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Reported payload, persistence or network artifact.", + "Reverse-shell C2 infrastructure", + "reference_indicator" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reported payload, persistence or network artifact.; Reverse-shell C2 infrastructure; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-124ac29e-4c30-5018-9cad-5b4112767c69", + "type": "ipv4", + "value": "45.143.167.96", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-73292c42-9c98-5ce7-a8a5-b39ed9c93d18", + "type": "ipv4", + "value": "45.249.89.172", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-622575db-b2df-5cee-aa27-b40711cbcf44", + "type": "ipv4", + "value": "45.61.136.143", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "poppelgaard", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "reported_campaign_infrastructure", + "description": "Published network IOC; request alone does not prove successful execution.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Unit42 network indicator — CVE-2026-88771/88772 exploitation activity. Source: Unit42 threat brief 2026-09-30.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "f42c32d7-623d-47f4-b740-f5eb8f235b5d", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "poppelgaard", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "reported_campaign_infrastructure" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; reported_campaign_infrastructure", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-62a944bc-91a2-55e0-bab3-439c7c6d8ffd", + "type": "ipv4", + "value": "45.76.34.141", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "description": "Present in malicious AAA events.", + "role": "Present in malicious AAA events.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "sygnia" + ], + "roles": [ + "Present in malicious AAA events." + ], + "role": "Present in malicious AAA events.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-0b7b1700-fb00-534d-ae61-6ef9a4b41949", + "type": "ipv4", + "value": "46.150.68.55", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-b11ecb89-cf23-5101-919e-978c52921122", + "type": "ipv4", + "value": "47.230.224.154", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported source of an exploitation attempt.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Source of NetScaler exploitation attempts", + "description": "Source of NetScaler exploitation attempts", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Source of NetScaler exploitation attempts — CVE-2026-88771. Source: LevelBlue THOR team.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "caea63d1-b268-49a4-aaec-4d008a404cc4", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Source of NetScaler exploitation attempts", + "reference_indicator" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Source of NetScaler exploitation attempts; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-d6b9aa88-aa2c-5dd4-82c1-5801baa6dc84", + "type": "ipv4", + "value": "47.239.205.29", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-52f895d6-25f7-520e-9082-4dfdc6667c04", + "type": "ipv4", + "value": "47.243.125.255", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a8a466ff-728a-5dcb-b817-6f3c8b1cc98b", + "type": "ipv4", + "value": "47.76.102.1", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-8272b998-64de-5808-afe8-46b2eda0fb9f", + "type": "ipv4", + "value": "47.76.132.65", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-5c19f867-d3b6-57fa-834c-1f85bf1b26f5", + "type": "ipv4", + "value": "47.76.63.52", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-bd0a1634-8c1d-517d-89c5-b51d6ffb60de", + "type": "ipv4", + "value": "47.76.92.109", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a0fa80e9-ea58-5c88-baef-ddb81abd1edd", + "type": "ipv4", + "value": "49.36.107.103", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-2b52edf3-63e4-5891-99a9-851c701ef966", + "type": "ipv4", + "value": "5.188.206.226", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-336b324e-32fd-5811-bcc9-c2f4583f6037", + "type": "ipv4", + "value": "54.70.59.128", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a2773efd-0847-5503-9e9b-bdc1e749668e", + "type": "ipv4", + "value": "58.187.56.89", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-ad18b0ac-923c-5a92-a2ea-fc4536d4e729", + "type": "ipv4", + "value": "62.133.62.80", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "esentire", + "ifin-event", + "levelblue", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported payload infrastructure.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Payload-hosting infrastructure", + "description": "Payload-hosting infrastructure", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Payload host", + "description": "Payload host", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Payload-hosting infrastructure — hosted payload at /xd7h/x on port 80. Source: LevelBlue THOR team.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "381c3c9c-d634-4787-a2b9-e1875622b3fb", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "esentire", + "ifin-event", + "levelblue", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Payload host", + "Payload-hosting infrastructure", + "Reported payload, persistence or network artifact.", + "reference_indicator" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Payload host; Payload-hosting infrastructure; Reported payload, persistence or network artifact.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-7e5fe335-5960-5d7b-ba98-450e10001601", + "type": "ipv4", + "value": "64.177.93.71", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-63c680c9-b1f1-5aee-a554-5e527f60c2d4", + "type": "ipv4", + "value": "64.225.103.14", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-aea30ba7-16ce-5ad8-8d1b-1bbd510dcb69", + "type": "ipv4", + "value": "64.94.85.67", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "esentire", + "ifin-event", + "levelblue", + "poppelgaard", + "sygnia" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported payload infrastructure.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Exploit, payload, and exfiltration infrastructure", + "description": "Exploit, payload, and exfiltration infrastructure", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Payload host", + "description": "Payload host", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Exploit, payload, and exfiltration infrastructure — hosted update_c08937.pl, received exfiltrated config archive at /update_result_3567cs.tgz. Source: LevelBlue THOR team.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "2ff40621-5f80-4129-a6bf-b8b039107d0f", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "description": "Embedded download destination.", + "role": "Embedded download destination.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "esentire", + "ifin-event", + "levelblue", + "poppelgaard", + "sygnia" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Embedded download destination.", + "Exploit, payload, and exfiltration infrastructure", + "Payload host", + "Reported payload, persistence or network artifact.", + "reference_indicator" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Embedded download destination.; Exploit, payload, and exfiltration infrastructure; Payload host; Reported payload, persistence or network artifact.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-e9bc4d4a-3c55-5a00-bcba-463416b6e201", + "type": "ipv4", + "value": "66.135.19.18", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_request_source", + "description": "Requests to masqueraded .deb paths or GetUserName endpoint observed before disclosure.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Requested nsgclient18.deb and nsgser18.deb from /vpn/scripts/linux/ (Sep 4). Source: Unit42 threat brief.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "a0ff6345-60ed-4e77-b40f-fb8fc416ac76", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "webshell_request_source" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; webshell_request_source", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c2d9f32e-3441-5034-9f20-9810fad7d3d4", + "type": "ipv4", + "value": "66.227.183.84", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "poppelgaard", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "reported_campaign_infrastructure", + "description": "Published network IOC; request alone does not prove successful execution.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Unit42 network indicator — CVE-2026-88771/88772 exploitation activity. Source: Unit42 threat brief 2026-09-30.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "93820aa4-2c25-4602-8c43-9f986184fef6", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "poppelgaard", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "reported_campaign_infrastructure" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; reported_campaign_infrastructure", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-300c029e-36a8-5fbf-bbcc-e2cae3850e63", + "type": "ipv4", + "value": "68.178.160.183", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Reported payload, persistence or network artifact." + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-20d469dc-580b-59c9-9672-b42cff9f681e", + "type": "ipv4", + "value": "68.46.140.222", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-5cc26cb1-9301-5d78-bfad-edef1f5545fa", + "type": "ipv4", + "value": "70.172.58.168", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported source of an exploitation attempt.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Source of NetScaler exploitation attempts", + "description": "Source of NetScaler exploitation attempts", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Source of NetScaler exploitation attempts — CVE-2026-88771. Source: LevelBlue THOR team.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "8fa632b8-98b7-48bd-bca9-38b2ac0c3c16", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Source of NetScaler exploitation attempts", + "reference_indicator" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Source of NetScaler exploitation attempts; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c30a8ea6-1e2b-56d9-8437-75ac25954af4", + "type": "ipv4", + "value": "72.73.231.73", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-06e8ec49-8c49-504e-9b3d-e25ad61bd027", + "type": "ipv4", + "value": "73.43.85.7", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-922dbc10-2b45-5110-8011-cbd7566243d0", + "type": "ipv4", + "value": "77.83.199.39", + "status": "reference_only", + "source_ids": [ + "esentire", + "ifin-event", + "poppelgaard", + "sygnia", + "truesec", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/", + "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" + ], + "observations": [ + { + "status": "reference_only", + "description": "Possible command-and-control address according to the source; determine its role in local evidence separately.", + "source_ids": [ + "truesec" + ], + "source_urls": [ + "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "truesec", + "published": "2026-09-28", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Webshell delivery", + "description": "Webshell delivery", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "reconnaissance", + "description": "Version-fingerprinting requests observed Aug21–22.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "webshell_delivery", + "description": "Three-stage injection activity observed Sep21.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "potential_c2", + "description": "Truesec explicitly calls these potential C2 IPs; uncertainty retained.", + "confidence": "suspected", + "source_ids": [ + "truesec" + ], + "source_urls": [ + "https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "truesec", + "published": "2026-09-28", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Potential exploit source (Truesec) — CVE-2026-88771 NetScaler 0-day exploitation", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "417301e8-4243-4b3f-a425-c059a2cba30d", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Fake-CSS payload request source.", + "role": "Fake-CSS payload request source.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "esentire", + "ifin-event", + "poppelgaard", + "sygnia", + "truesec", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Fake-CSS payload request source.", + "Webshell delivery", + "potential_c2", + "reconnaissance", + "reference_indicator", + "webshell_delivery" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Fake-CSS payload request source.; Webshell delivery; potential_c2; reconnaissance; reference_indicator; webshell_delivery", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-4c267388-41ee-5227-ba11-0d5dc7f04865", + "type": "ipv4", + "value": "78.128.113.10", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-3414dcf4-1e3f-54fb-854a-034fe7d55024", + "type": "ipv4", + "value": "78.135.96.136", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Associated exploit source — CVE-2026-88771 NetScaler 0-day exploitation", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "c2215107-0d28-4383-aa10-fc6d529c83dd", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f3b37063-7d80-5809-95c5-234731b080cb", + "type": "ipv4", + "value": "78.47.24.217", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "reconnaissance", + "description": "Version-fingerprinting requests observed Aug21–22.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "webshell_delivery", + "description": "Three-stage injection activity observed Sep21.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Fingerprinting host (Aug 21-22) — requested /admin_ui/common/css/ns/ui.css across 100+ NetScaler systems alongside 104.248.244.66 and 77.83.199.39. Earliest activity Unit42 identified. Source: Unit42 threat brief.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "599ede4b-f664-429f-b8e2-6943e0d3a73c", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "reconnaissance", + "webshell_delivery" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; reconnaissance; webshell_delivery", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-44fb3383-9982-5e76-bccd-767b3b4424eb", + "type": "ipv4", + "value": "8.210.119.74", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-ee997307-6c49-5643-b348-8da03cbb7b78", + "type": "ipv4", + "value": "8.210.67.91", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-6db74410-e5b2-55f8-9442-9a7aad436b26", + "type": "ipv4", + "value": "8.217.173.25", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-4a7f36a8-64df-55d9-9d4b-5165ee7ddeb8", + "type": "ipv4", + "value": "8.218.219.56", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c0df2848-4379-5db5-a9c2-76979586eb5c", + "type": "ipv4", + "value": "80.240.22.229", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Associated exploit source — CVE-2026-88771 NetScaler 0-day exploitation", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "c3e5352e-25a4-4c42-81ce-d08ac311369b", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-cbe0df89-6929-5353-85ba-4a79328ea7cd", + "type": "ipv4", + "value": "82.167.14.7", + "status": "reference_only", + "source_ids": [ + "beazley", + "esentire", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://labs.beazley.security/advisories/BSL-A1216", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "observations": [ + { + "status": "reference_only", + "role": "Exploitation source", + "description": "Exploitation source", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "execution_test_marker", + "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", + "confidence": "secondary_reported", + "source_ids": [ + "beazley" + ], + "source_urls": [ + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "beazley", + "published": "2026-09-26", + "retrieved": "2026-10-01T19:36:45.510941+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "beazley", + "esentire", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Exploitation source", + "execution_test_marker" + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Exploitation source; execution_test_marker", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-9ec5e7f2-5eef-5915-b9ac-50d426d4ec8f", + "type": "ipv4", + "value": "82.24.212.15", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-69ff3fac-a6fc-5988-bafe-301a29a099f6", + "type": "ipv4", + "value": "84.55.67.133", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-9a75ddc5-7ac4-5ef0-9e50-b01f3a7e4471", + "type": "ipv4", + "value": "85.117.117.248", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-8a2625a4-0504-51b4-a137-121dba73ab19", + "type": "ipv4", + "value": "85.203.46.191", + "status": "reference_only", + "source_ids": [ + "beazley", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "observations": [ + { + "status": "reference_only", + "role": "reconnaissance", + "description": "Secondary consolidation citing GreyNoise, Lupovis or Mandiant; no assertion of local compromise.", + "confidence": "secondary_reported", + "source_ids": [ + "beazley" + ], + "source_urls": [ + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "beazley", + "published": "2026-09-26", + "retrieved": "2026-10-01T19:36:45.510941+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "beazley", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "reconnaissance" + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; reconnaissance", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c080888d-00bf-5cf7-8949-fea4f573dd63", + "type": "ipv4", + "value": "85.221.203.85", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-b4150ad2-76af-5932-a838-359da95b1b48", + "type": "ipv4", + "value": "87.224.84.82", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported source of an exploitation attempt.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Source of configuration-staging attempt", + "description": "Source of configuration-staging attempt", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Source of configuration-staging attempt — CVE-2026-88771 exploitation to copy/archive ns.conf. Source: LevelBlue THOR team.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "4d0a8a52-57b4-474a-afae-8eac272eaca6", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "Source of configuration-staging attempt", + "reference_indicator" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise; Source of configuration-staging attempt; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-9e92512b-49c6-576e-b491-9eadb7d13866", + "type": "ipv4", + "value": "88.119.169.150", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-7b789a76-cc5a-5833-8f42-13256ec561d8", + "type": "ipv4", + "value": "88.180.103.22", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-7cb798a0-7236-5dea-bc9f-ab06e9efacf2", + "type": "ipv4", + "value": "89.36.231.206", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Associated exploit source — CVE-2026-88771 NetScaler 0-day exploitation", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "febf08c9-738a-4fde-a351-e1a422b60071", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-41a963f1-9acb-5a20-bf71-cb40cce2f9c1", + "type": "ipv4", + "value": "89.44.80.7", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Reported payload, persistence or network artifact." + ], + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-be1e1a69-053d-5f29-8142-f3d907a7fb50", + "type": "ipv4", + "value": "91.107.190.236", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-8b6e9988-288e-5f68-9c68-bcc62ed7acc3", + "type": "ipv4", + "value": "91.195.240.123", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Associated exploit source — CVE-2026-88771 NetScaler 0-day exploitation", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "3ede1c06-834b-468b-8213-a9027617af09", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-3b43d01c-e3ff-5dff-9d31-9a3dfa2fee78", + "type": "ipv4", + "value": "92.118.204.229", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported source of an exploitation attempt.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Source of command-execution testing", + "description": "Source of command-execution testing", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Source of command-execution testing — CVE-2026-88771 whoami probe. Source: LevelBlue THOR team.", + "misp_type": "ip-dst", + "misp_to_ids": true, + "attribute_uuid": "853f84e1-855f-4ad3-a21e-ae37d0c3ac3c", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "confidence": "low", + "description": "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue", + "poppelgaard" + ], + "roles": [ + "Comment reports source activity despite ip-dst field; direction conflict retained.", + "Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations", + "Source of command-execution testing", + "reference_indicator" + ], + "role": "Comment reports source activity despite ip-dst field; direction conflict retained.; Community-aggregated exploitation, delivery or callback infrastructure; consult individual first-party observations; Source of command-execution testing; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-b9506317-73f8-5d26-81e2-3e3ae03e24f4", + "type": "ipv4", + "value": "93.177.60.233", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c538409c-b054-51a1-ab89-f8891525914a", + "type": "ipv4", + "value": "94.190.77.195", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-1c09e2e0-9033-596e-a603-e11472506a5d", + "type": "ipv4", + "value": "95.229.84.239", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-b05a2dce-c9f6-583c-878e-96f21ca94fc4", + "type": "ipv4", + "value": "95.63.246.50", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "confidence": "low", + "description": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "observation_category": "scanner", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise" + ], + "role": "Opportunistic scanner reported through secondary aggregation; hunting lead, not confirmed compromise", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-41d198a3-3a03-5082-b7fb-8181df570fee", + "type": "literal", + "value": "/var/tmp/sh", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-49f8d35d-6564-592a-b57b-6355d475beab", + "type": "literal", + "value": "7489a0f93c67fa5cdaeb4b921d90594d", + "status": "reference_only", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "implant_configuration", + "description": "RC4 key derived from passphrase; NOT a malware-file MD5", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + } + ], + "source": [ + "unit42" + ], + "roles": [ + "implant_configuration" + ], + "role": "implant_configuration", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-64a8e232-9e8a-5d2f-a526-019d24333de5", + "type": "literal", + "value": "AddHandler application/x-httpd-php .deb", + "status": "reference_only", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Persistence Method A — httpd.conf modification treating .deb files as PHP scripts. Allows web shells with .deb extensions in /netscaler/gui/vpn/scripts/linux. Check /etc/httpd.conf. Source: Mandiant/GTIG.", + "misp_type": "other", + "misp_to_ids": true, + "attribute_uuid": "dab5c8b4-4e66-48cf-b742-8b486e51ddb2", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event" + ], + "roles": [ + "Secondary-source artifact; validate cited original report." + ], + "role": "Secondary-source artifact; validate cited original report.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-29321922-0dae-5e42-84a3-7c890a994b6b", + "type": "literal", + "value": "AddHandler application/x-httpd-php .sig", + "status": "reference_only", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Persistence Method B — httpd.conf modification treating .sig files as PHP scripts. Enables .sig web shells routed via AliasMatch from .ico requests. Check /etc/httpd.conf. Source: Mandiant/GTIG.", + "misp_type": "other", + "misp_to_ids": true, + "attribute_uuid": "3ff4f3b2-c610-4dab-a4b5-579c9e9b75cd", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event" + ], + "roles": [ + "Secondary-source artifact; validate cited original report." + ], + "role": "Secondary-source artifact; validate cited original report.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-dd8e0595-a5aa-5d86-aaf8-1afab388d2c2", + "type": "literal", + "value": "AliasMatch ^/vpn/media/(.+).ico$ /var/netscaler/gui/vpn/scripts/linux/$1.sig", + "status": "reference_only", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Persistence Method B — Apache AliasMatch routing .ico image requests to .sig web shells in script directory. Maps /vpn/media/*.ico to /var/netscaler/gui/vpn/scripts/linux/*.sig. Check /etc/httpd.conf. Source: Mandiant/GTIG.", + "misp_type": "other", + "misp_to_ids": true, + "attribute_uuid": "43cbb59c-f805-4b42-aebe-8d27b5903125", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event" + ], + "roles": [ + "Secondary-source artifact; validate cited original report." + ], + "role": "Secondary-source artifact; validate cited original report.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-0e4c1e75-090e-57f2-b359-ee17374180c3", + "type": "literal", + "value": "HTTP_NSC_CLIENTTYPE", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported header indicator.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "C2 HTTP header used by e6ee7c85.sig web shells — Base64-encoded payload execution via eval(). Native NetScaler SetEnvIf header abused for C2 channel. Source: Mandiant/GTIG.", + "misp_type": "other", + "misp_to_ids": true, + "attribute_uuid": "4c523e4d-f09a-44d7-8cff-a233861a0c18", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "mandiant" + ], + "roles": [ + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-b88caa4a-407c-50cc-b8b0-2660661c7801", + "type": "literal", + "value": "HTTP_NSC_LDAP", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported header indicator.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "C2 HTTP header used by nsginstaller.deb web shells — Base64-encoded command execution via shell_exec(). Native NetScaler SetEnvIf header abused for C2 channel. Source: Mandiant/GTIG.", + "misp_type": "other", + "misp_to_ids": true, + "attribute_uuid": "25ed0ba9-a5b3-4079-bb9b-b2c0a2b2c9d6", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "mandiant" + ], + "roles": [ + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-3e4d7419-2f2e-5cc4-a5de-e1a2ffee2726", + "type": "literal", + "value": "HTTP_X_UX", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported header indicator.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "WHIPSHOT chunked C2 transport header — concatenates HTTP_X_UX_0 through HTTP_X_UX_95 (and HTTP_X_UX), Base64-decodes the stream, forwards to SLAPSHOT proxy via loopback socket. Source: Mandiant/GTIG.", + "misp_type": "other", + "misp_to_ids": true, + "attribute_uuid": "fbe1145c-f86a-458e-aed6-77a17bec89dd", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "mandiant" + ], + "roles": [ + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a17876e4-60d5-53e8-b9e0-038e6049d74e", + "type": "literal", + "value": "NX-CVE-OK", + "status": "reference_only", + "source_ids": [ + "beazley", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "observations": [ + { + "status": "context_only", + "role": "scanner_or_poc_marker", + "description": "Research/testing marker; does not identify an attacker or prove compromise.", + "confidence": "secondary_reported", + "source_ids": [ + "beazley" + ], + "source_urls": [ + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "original_status": "context_only", + "source_dates": [ + { + "id": "beazley", + "published": "2026-09-26", + "retrieved": "2026-10-01T19:36:45.510941+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "confidence": "low", + "description": "Public scanner/PoC or command-output marker; not a malware verdict", + "observation_category": "poc_marker", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "beazley", + "poppelgaard" + ], + "roles": [ + "Public scanner/PoC or command-output marker; not a malware verdict", + "scanner_or_poc_marker" + ], + "role": "Public scanner/PoC or command-output marker; not a malware verdict; scanner_or_poc_marker", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": true + }, + { + "id": "ioc-5584f65a-17db-519c-b766-9887c285674a", + "type": "literal", + "value": "PoCbit", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "confidence": "low", + "description": "Public scanner/PoC or command-output marker; not a malware verdict", + "observation_category": "poc_marker", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Public scanner/PoC or command-output marker; not a malware verdict" + ], + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f5d8fb8e-0bc3-51b5-8468-ca81e4bcd2af", + "type": "literal", + "value": "Rhfajaf1H992", + "status": "reference_only", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "implant_configuration", + "description": "nsg64.deb authentication passphrase", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + } + ], + "source": [ + "unit42" + ], + "roles": [ + "implant_configuration" + ], + "role": "implant_configuration", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c620f066-7706-5c69-b5a6-b26ebdc502ae", + "type": "literal", + "value": "c88771.json", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "confidence": "low", + "description": "Public scanner/PoC or command-output marker; not a malware verdict", + "observation_category": "poc_marker", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Public scanner/PoC or command-output marker; not a malware verdict" + ], + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a71cff59-53a9-55a7-8c3e-ae19f9072b18", + "type": "literal", + "value": "e6ee7c85.sig", + "status": "reference_only", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_filename", + "description": "Mandiant published example; filenames vary between victims.", + "confidence": "published", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "mandiant" + ], + "roles": [ + "webshell_filename" + ], + "role": "webshell_filename", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-788900e2-b766-5d79-9e16-0ec3b808865f", + "type": "literal", + "value": "e826d7ddf3c85920", + "status": "reference_only", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "implant_configuration", + "description": "Specific implant CsrfToken password; variants may differ.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + } + ], + "source": [ + "unit42" + ], + "roles": [ + "implant_configuration" + ], + "role": "implant_configuration", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a2eab928-f892-5dbb-8864-79169e5c3e25", + "type": "literal", + "value": "exec-ok", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "confidence": "low", + "description": "Public scanner/PoC or command-output marker; not a malware verdict", + "observation_category": "poc_marker", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Public scanner/PoC or command-output marker; not a malware verdict" + ], + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a0f0fa36-4a34-543f-b932-a2b09d3a9598", + "type": "literal", + "value": "fnoc.dptth", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-6b7771cb-6d28-5f49-b1ec-024e1412076e", + "type": "literal", + "value": "galf_php", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f297377d-3c83-5e8a-9ed3-c73815436fe0", + "type": "literal", + "value": "gifnocsn", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-88e6d8ed-e9ee-5080-9df6-20744cd131cd", + "type": "literal", + "value": "hctaMselif", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-781c7a15-9413-5958-9cb2-128a16e18fab", + "type": "literal", + "value": "hs/pmt/rav/", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-ef2d4d25-3815-58bb-8527-8e7a4295eb15", + "type": "literal", + "value": "httpworkbench", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "confidence": "low", + "description": "Public scanner/PoC or command-output marker; not a malware verdict", + "observation_category": "poc_marker", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Public scanner/PoC or command-output marker; not a malware verdict" + ], + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-406a5932-92ac-501f-afa2-b6c866702938", + "type": "literal", + "value": "logon/LogonPoint/LogonUI.php", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-27fb7299-cf82-5839-a8d3-027ba6fe9bbf", + "type": "literal", + "value": "logon/LogonPoint/index.php", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-36638420-6816-5109-8048-31d3256b6882", + "type": "literal", + "value": "logon/LogonPoint/plugin_index.php", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c3dc5cf6-51d6-5421-a096-cb5418f99d6f", + "type": "literal", + "value": "logon/LogonPoint/tmindex.php", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-d660fdf4-7eaa-5b94-a6e3-c5289f69ce4f", + "type": "literal", + "value": "ltcehcapa", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-6d38ccdd-5436-5a80-9f61-e207fce26301", + "type": "literal", + "value": "lufecarg", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-976a698b-20b0-5c06-b8a8-13a87a34ba21", + "type": "literal", + "value": "ns-88771-poc", + "status": "reference_only", + "source_ids": [ + "beazley", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "observations": [ + { + "status": "context_only", + "role": "scanner_or_poc_marker", + "description": "Research/testing marker; does not identify an attacker or prove compromise.", + "confidence": "secondary_reported", + "source_ids": [ + "beazley" + ], + "source_urls": [ + "https://labs.beazley.security/advisories/BSL-A1216" + ], + "original_status": "context_only", + "source_dates": [ + { + "id": "beazley", + "published": "2026-09-26", + "retrieved": "2026-10-01T19:36:45.510941+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "confidence": "low", + "description": "Public scanner/PoC or command-output marker; not a malware verdict", + "observation_category": "poc_marker", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "beazley", + "poppelgaard" + ], + "roles": [ + "Public scanner/PoC or command-output marker; not a malware verdict", + "scanner_or_poc_marker" + ], + "role": "Public scanner/PoC or command-output marker; not a malware verdict; scanner_or_poc_marker", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": true + }, + { + "id": "ioc-faf2d782-88a4-5c2d-9790-c1a75200decf", + "type": "literal", + "value": "nsgbuild.deb", + "status": "reference_only", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_request_filename", + "description": "Observed request filename; validate file content because directory normally contains legitimate packages.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + } + ], + "source": [ + "unit42" + ], + "roles": [ + "webshell_request_filename" + ], + "role": "webshell_request_filename", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-e38612e8-8199-5afb-9615-1733293a94d1", + "type": "literal", + "value": "nsgclient.sig", + "status": "reference_only", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_filename", + "description": "Mandiant published example; filenames vary between victims.", + "confidence": "published", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "mandiant" + ], + "roles": [ + "webshell_filename" + ], + "role": "webshell_filename", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-e16b4205-4942-5cb7-a6b4-d218dcd3f2f5", + "type": "literal", + "value": "nsginstaller.deb", + "status": "reference_only", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "status": "reference_only", + "role": "installer_filename", + "description": "Mandiant published example; filenames vary between victims.", + "confidence": "published", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "mandiant" + ], + "roles": [ + "installer_filename" + ], + "role": "installer_filename", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-49c42b1b-3068-5421-b851-a3454ed226d2", + "type": "literal", + "value": "nsgpackage64.deb", + "status": "reference_only", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_request_filename", + "description": "Observed request filename; validate file content because directory normally contains legitimate packages.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + } + ], + "source": [ + "unit42" + ], + "roles": [ + "webshell_request_filename" + ], + "role": "webshell_request_filename", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-505ea29d-cadf-5be7-8b9b-80b4f4f80edc", + "type": "literal", + "value": "nsgser18.deb", + "status": "reference_only", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_request_filename", + "description": "Observed request filename; validate file content because directory normally contains legitimate packages.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + } + ], + "source": [ + "unit42" + ], + "roles": [ + "webshell_request_filename" + ], + "role": "webshell_request_filename", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-4b5a2e5c-067d-5f1b-a035-b7e5f711b9c0", + "type": "literal", + "value": "nsgsupport.deb", + "status": "reference_only", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_request_filename", + "description": "Observed request filename; validate file content because directory normally contains legitimate packages.", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + } + ], + "source": [ + "unit42" + ], + "roles": [ + "webshell_request_filename" + ], + "role": "webshell_request_filename", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-d5aa72b1-1997-5f33-bbe1-7184bec9996b", + "type": "literal", + "value": "nx_verify.html", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "confidence": "low", + "description": "Public scanner/PoC or command-output marker; not a malware verdict", + "observation_category": "poc_marker", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Public scanner/PoC or command-output marker; not a malware verdict" + ], + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-30475a4b-1a2a-5daa-99c3-c9ca447058fb", + "type": "literal", + "value": "php.IUnogoL", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-42937439-f9b2-5eea-b619-347c7d04988b", + "type": "literal", + "value": "php.xednimt", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-8554391a-cad4-5561-a54b-48fd507995e2", + "type": "literal", + "value": "relacsten.cr/gifnocsn", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-6a9e81f7-5ac3-59b6-ae5d-0f0bff55e5fe", + "type": "literal", + "value": "scanner-probe", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "confidence": "low", + "description": "Public scanner/PoC or command-output marker; not a malware verdict", + "observation_category": "poc_marker", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Public scanner/PoC or command-output marker; not a malware verdict" + ], + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a4ab0f40-9fa5-5d27-a5c7-ac97e740c74d", + "type": "literal", + "value": "sec_monitor", + "status": "reference_only", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Reported account name.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Privileged account created by payload", + "description": "Privileged account created by payload", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "levelblue" + ], + "roles": [ + "Privileged account created by payload", + "reference_indicator" + ], + "role": "Privileged account created by payload; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-fafd0e8b-53b2-52bf-a57c-5e6601f02137", + "type": "literal", + "value": "tnioPnogoL", + "status": "reference_only", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "observations": [ + { + "status": "reference_only", + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "confidence": "medium", + "description": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "campaign": "2025", + "source_ids": [ + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ncsc-nl-2025", + "published": "2025-08-06", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "ncsc-nl-2025" + ], + "roles": [ + "Historical 2025 forensic string indicator; no 2026 attribution implied" + ], + "role": "Historical 2025 forensic string indicator; no 2026 attribution implied", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-51fd15cc-c5f6-5249-9f80-7bc44fadc7fd", + "type": "literal", + "value": "vp_probe_nonexist", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "confidence": "low", + "description": "Public scanner/PoC or command-output marker; not a malware verdict", + "observation_category": "poc_marker", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Public scanner/PoC or command-output marker; not a malware verdict" + ], + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-b4f5b41c-47aa-5288-89d0-bae6a3f29b3c", + "type": "literal", + "value": "wtw888", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "confidence": "low", + "description": "Public scanner/PoC or command-output marker; not a malware verdict", + "observation_category": "poc_marker", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Public scanner/PoC or command-output marker; not a malware verdict" + ], + "role": "Public scanner/PoC or command-output marker; not a malware verdict", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-ce847b0d-eaed-551d-9361-6c2ab92f66db", + "type": "path", + "value": "/.x", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context" + ], + "role": "Community-reported payload, persistence or staging path; verify context", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-307fbb23-f927-5c30-9aff-b629abea7ab0", + "type": "path", + "value": "/logon/LogonPoint/custom/receiver.min..css", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "description": "Investigation-derived artifact or routing path.", + "role": "Investigation-derived artifact or routing path.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "sygnia" + ], + "roles": [ + "Investigation-derived artifact or routing path." + ], + "role": "Investigation-derived artifact or routing path.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-3cd0457e-f3b8-55bf-940c-98b77a6da663", + "type": "path", + "value": "/logon/LogonPoint/custom/receiver.min.css", + "status": "reference_only", + "source_ids": [ + "greynoise" + ], + "source_urls": [ + "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_alias", + "description": "webshell_alias", + "confidence": "published", + "source_ids": [ + "greynoise" + ], + "source_urls": [ + "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "greynoise", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:36:45.065290+00:00" + } + ] + } + ], + "source": [ + "greynoise" + ], + "roles": [ + "webshell_alias" + ], + "role": "webshell_alias", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-29cf0672-a8c2-588e-b51e-bcd965b9aecb", + "type": "path", + "value": "/netscaler/ns_gui/admin_ui/e.txt", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context" + ], + "role": "Community-reported payload, persistence or staging path; verify context", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-41e3003d-d7c1-5fd6-b593-2c0f46a09220", + "type": "path", + "value": "/netscaler/ns_gui/admin_ui/log.txt", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context" + ], + "role": "Community-reported payload, persistence or staging path; verify context", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-76175645-cd94-5b71-839a-3f8735a279d9", + "type": "path", + "value": "/netscaler/ns_gui/vpn/c88771.json", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "description": "Investigation-derived artifact or routing path.", + "role": "Investigation-derived artifact or routing path.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "sygnia" + ], + "roles": [ + "Investigation-derived artifact or routing path." + ], + "role": "Investigation-derived artifact or routing path.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c8992c16-710d-584d-863e-4d154f19beb5", + "type": "path", + "value": "/tmp/.uxdlock", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "status": "reference_only", + "description": "Hunting reference, not a local finding.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "published_artifact", + "description": "published_artifact", + "confidence": "published", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "SLAPSHOT process lock artifact — fcntl.flock exclusive lock file. Presence indicates active/recent SLAPSHOT proxy daemon execution. Source: Mandiant/GTIG.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "28eef7f3-dacc-4516-9dae-14f3764dfd96", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "mandiant" + ], + "roles": [ + "Secondary-source artifact; validate cited original report.", + "published_artifact", + "reference_indicator" + ], + "role": "Secondary-source artifact; validate cited original report.; published_artifact; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-2cf64745-120f-53f7-9eca-d474b481b99f", + "type": "path", + "value": "/tmp/.uxdport", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "status": "reference_only", + "description": "Hunting reference, not a local finding.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "published_artifact", + "description": "published_artifact", + "confidence": "published", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "SLAPSHOT active port artifact — Python proxy daemon (WHIPSHOT companion) writes ephemeral loopback port number here. Check `ls -la /tmp/.uxdport*`. Presence indicates active/recent SLAPSHOT execution. Source: Mandiant/GTIG.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "1249987a-22ad-4ae7-b776-588e9040d930", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "mandiant" + ], + "roles": [ + "Secondary-source artifact; validate cited original report.", + "published_artifact", + "reference_indicator" + ], + "role": "Secondary-source artifact; validate cited original report.; published_artifact; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-28e03118-efc5-54d6-83d4-a346b9448cfb", + "type": "path", + "value": "/tmp/lula", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context" + ], + "role": "Community-reported payload, persistence or staging path; verify context", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-18759636-db24-5aa3-ac75-3fd7e5fd5eb0", + "type": "path", + "value": "/tmp/update_result_3567cs.tgz", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Artifact path; a textual reference does not prove that the file exists.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Staged NetScaler configuration archive", + "description": "Staged NetScaler configuration archive", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Staged NetScaler configuration archive — /flash/nsconfig tarball created by update_c08937.pl for exfiltration. Payload deletes this after upload attempt; absence does not indicate no execution. Source: LevelBlue THOR team.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "d784b8e2-038b-42a0-a340-bbc3856c17d9", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue" + ], + "roles": [ + "Secondary-source artifact; validate cited original report.", + "Staged NetScaler configuration archive", + "reference_indicator" + ], + "role": "Secondary-source artifact; validate cited original report.; Staged NetScaler configuration archive; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f2f08d48-92f4-5bf6-b51f-0fdfacc854de", + "type": "path", + "value": "/tmp/watchTowr", + "status": "reference_only", + "source_ids": [ + "watchtowr-repo" + ], + "source_urls": [ + "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771" + ], + "observations": [ + { + "status": "reference_only", + "role": "PoC/example output marker; attribution and execution require corroboration", + "confidence": "low", + "description": "PoC/example output marker; attribution and execution require corroboration", + "observation_category": "poc_marker", + "source_ids": [ + "watchtowr-repo" + ], + "source_urls": [ + "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "watchtowr-repo", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "watchtowr-repo" + ], + "roles": [ + "PoC/example output marker; attribution and execution require corroboration" + ], + "role": "PoC/example output marker; attribution and execution require corroboration", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c2c23478-b170-5e0b-ab17-a37515ca3386", + "type": "path", + "value": "/var/1.py", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context", + "Reported payload, persistence or network artifact." + ], + "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-3b13e849-8762-5d90-b0f5-6e0f9bfa6da3", + "type": "path", + "value": "/var/netscaler/gui/admin_ui/e.txt", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context" + ], + "role": "Community-reported payload, persistence or staging path; verify context", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-74e8790e-27ee-5c3e-9788-8e0e950ed02e", + "type": "path", + "value": "/var/netscaler/gui/admin_ui/log.txt", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context" + ], + "role": "Community-reported payload, persistence or staging path; verify context", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f425d9f6-7fae-5179-9a3f-55d8b573ffc8", + "type": "path", + "value": "/var/netscaler/gui/vpn/c", + "status": "reference_only", + "source_ids": [ + "rapid7" + ], + "source_urls": [ + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" + ], + "observations": [ + { + "description": "Configuration archive staging destination.", + "role": "Configuration archive staging destination.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "rapid7" + ], + "source_urls": [ + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "rapid7", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039385+00:00" + } + ] + } + ], + "source": [ + "rapid7" + ], + "roles": [ + "Configuration archive staging destination." + ], + "role": "Configuration archive staging destination.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-13d74ad3-6b70-529b-9e67-89cdc4459ae7", + "type": "path", + "value": "/var/netscaler/gui/vpn/scripts/linux/1bd8a664.sig", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "description": "Investigation-derived artifact or routing path.", + "role": "Investigation-derived artifact or routing path.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "sygnia" + ], + "roles": [ + "Investigation-derived artifact or routing path." + ], + "role": "Investigation-derived artifact or routing path.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a44e9690-5d11-5243-949f-466159b1d305", + "type": "path", + "value": "/var/netscaler/logon/LogonPoint/.local_journal", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Artifact path; a textual reference does not prove that the file exists.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "PHP web shell", + "description": "PHP web shell", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "PHP webshell deployed by update_c08937.pl — dotfile in LogonPoint. Mapped via httpd.conf AliasMatch to CSS-like URLs (LogonUISimple.html.style.min.css and randomized hex variants). Provides remote command execution + file upload/download. Source: LevelBlue THOR team.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "c17b7bd1-b183-4164-9c91-eb81e4d0ab50", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue" + ], + "roles": [ + "PHP web shell", + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "PHP web shell; Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-5b8adaa7-17f7-551b-8e2a-9fd4e9e1f4fd", + "type": "path", + "value": "/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver", + "status": "reference_only", + "source_ids": [ + "greynoise", + "ifin-event", + "rapid7", + "sygnia", + "technion", + "unit42" + ], + "source_urls": [ + "https://github.com/technion/netscaler_scanner", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", + "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/", + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_artifact", + "description": "webshell_artifact", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "webshell_artifact", + "description": "webshell_artifact", + "confidence": "published", + "source_ids": [ + "greynoise" + ], + "source_urls": [ + "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "greynoise", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:36:45.065290+00:00" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "PHP webshell path on NetScaler — dotfile in LogonPoint/custom directory. Survives reboot and upgrade to 73.37. Created 2026-09-24 06:52:51 UTC on primary node, synced to secondary via HA. Check httperror.log for SIGHUP restarts at same timestamp.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "80a7c380-969a-4787-ba79-d88192f470d9", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Hidden PHP webshell.", + "role": "Hidden PHP webshell.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "rapid7" + ], + "source_urls": [ + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "rapid7", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039385+00:00" + } + ] + }, + { + "description": "Investigation-derived artifact or routing path.", + "role": "Investigation-derived artifact or routing path.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Author-reported webshell path; text reference does not establish file existence", + "confidence": "medium", + "description": "Author-reported webshell path; text reference does not establish file existence", + "source_ids": [ + "technion" + ], + "source_urls": [ + "https://github.com/technion/netscaler_scanner" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "technion", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "greynoise", + "ifin-event", + "rapid7", + "sygnia", + "technion", + "unit42" + ], + "roles": [ + "Author-reported webshell path; text reference does not establish file existence", + "Hidden PHP webshell.", + "Investigation-derived artifact or routing path.", + "Secondary-source artifact; validate cited original report.", + "webshell_artifact" + ], + "role": "Author-reported webshell path; text reference does not establish file existence; Hidden PHP webshell.; Investigation-derived artifact or routing path.; Secondary-source artifact; validate cited original report.; webshell_artifact", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-0296bd8b-9ab2-5a1b-9c6b-c45800b7d785", + "type": "path", + "value": "/var/netscaler/logon/LogonPoint/xua.html", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Artifact path; a textual reference does not prove that the file exists.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Staged configuration archive", + "description": "Staged configuration archive", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Staged configuration archive — /flash/nsconfig tarball placed in LogonPoint directory for web-accessible retrieval. Created via `tar${IFS}czf${IFS}/var/netscaler/logon/LogonPoint/xua.html${IFS}/flash/nsconfig`. Source: LevelBlue THOR team.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "b8cd56d6-3e76-410a-b3ca-89082557d880", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue" + ], + "roles": [ + "Secondary-source artifact; validate cited original report.", + "Staged configuration archive", + "reference_indicator" + ], + "role": "Secondary-source artifact; validate cited original report.; Staged configuration archive; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-9950a2fc-13e0-5b63-babc-17ca8da89680", + "type": "path", + "value": "/var/netscaler/logon/insight-new.js", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue", + "sygnia" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "status": "reference_only", + "description": "Artifact path; a textual reference does not prove that the file exists.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Staged NetScaler configuration", + "description": "Staged NetScaler configuration", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Staged NetScaler configuration — ns.conf copied to web-accessible logon directory for retrieval. Created via `cat /flash/nsconfig/ns.conf>/var/netscaler/logon/insight-new.js`. Source: LevelBlue THOR team.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "2a223be1-7a2a-4829-b003-7d085fdd0ddd", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Investigation-derived artifact or routing path.", + "role": "Investigation-derived artifact or routing path.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue", + "sygnia" + ], + "roles": [ + "Investigation-derived artifact or routing path.", + "Secondary-source artifact; validate cited original report.", + "Staged NetScaler configuration", + "reference_indicator" + ], + "role": "Investigation-derived artifact or routing path.; Secondary-source artifact; validate cited original report.; Staged NetScaler configuration; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-9403c81b-60f9-5a30-ac36-990b112a43e6", + "type": "path", + "value": "/var/python/bin/customsnmpd", + "status": "reference_only", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Artifact path; a textual reference does not prove that the file exists.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "context_only", + "role": "modified_legitimate_component", + "description": "Context only: legitimate appliance path becomes relevant when overwritten by reverse-shell code.", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "context_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "levelblue" + ], + "roles": [ + "modified_legitimate_component", + "reference_indicator" + ], + "role": "modified_legitimate_component; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": true + }, + { + "id": "ioc-791d9376-2278-579f-b65b-e2f1603eb86c", + "type": "path", + "value": "/var/tmp/.nsmon/.cfg", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context", + "Reported payload, persistence or network artifact." + ], + "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-33152f79-ced9-5032-b8c5-5cdd2bd25022", + "type": "path", + "value": "/var/tmp/.nsmon/.state", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context", + "Reported payload, persistence or network artifact." + ], + "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-262b6f76-9739-549a-b409-588867871d8d", + "type": "path", + "value": "/var/tmp/.nsmon/nsmon.pl", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context", + "Reported payload, persistence or network artifact." + ], + "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a177a90a-0a05-5dcf-a623-257a8268b012", + "type": "path", + "value": "/var/tmp/.s", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context", + "Reported payload, persistence or network artifact." + ], + "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-aacbb570-45a0-557c-a81e-a3a34ae45b95", + "type": "path", + "value": "/var/tmp/boom", + "status": "reference_only", + "source_ids": [ + "watchtowr-repo" + ], + "source_urls": [ + "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771" + ], + "observations": [ + { + "status": "reference_only", + "role": "PoC/example output marker; attribution and execution require corroboration", + "confidence": "low", + "description": "PoC/example output marker; attribution and execution require corroboration", + "observation_category": "poc_marker", + "source_ids": [ + "watchtowr-repo" + ], + "source_urls": [ + "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "watchtowr-repo", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "watchtowr-repo" + ], + "roles": [ + "PoC/example output marker; attribution and execution require corroboration" + ], + "role": "PoC/example output marker; attribution and execution require corroboration", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-d249a2a1-2961-51e6-bded-02f39ec7cd9b", + "type": "path", + "value": "/var/tmp/lula", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context" + ], + "role": "Community-reported payload, persistence or staging path; verify context", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-766da79a-4f98-5d5c-a12d-68de5383a0a9", + "type": "path", + "value": "/var/vpn/theme/x.php", + "status": "reference_only", + "source_ids": [ + "technion" + ], + "source_urls": [ + "https://github.com/technion/netscaler_scanner" + ], + "observations": [ + { + "status": "reference_only", + "role": "Author-reported webshell path; text reference does not establish file existence", + "confidence": "medium", + "description": "Author-reported webshell path; text reference does not establish file existence", + "source_ids": [ + "technion" + ], + "source_urls": [ + "https://github.com/technion/netscaler_scanner" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "technion", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "technion" + ], + "roles": [ + "Author-reported webshell path; text reference does not establish file existence" + ], + "role": "Author-reported webshell path; text reference does not establish file existence", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-b6be1d96-6a37-5350-bade-d162ede2dae5", + "type": "path", + "value": "/var/vpn/themes/logon.php", + "status": "reference_only", + "source_ids": [ + "technion" + ], + "source_urls": [ + "https://github.com/technion/netscaler_scanner" + ], + "observations": [ + { + "status": "reference_only", + "role": "Author-reported webshell path; text reference does not establish file existence", + "confidence": "medium", + "description": "Author-reported webshell path; text reference does not establish file existence", + "source_ids": [ + "technion" + ], + "source_urls": [ + "https://github.com/technion/netscaler_scanner" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "technion", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "technion" + ], + "roles": [ + "Author-reported webshell path; text reference does not establish file existence" + ], + "role": "Author-reported webshell path; text reference does not establish file existence", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a9d659c4-0eed-53d7-b042-d9ca9dcf21e7", + "type": "path", + "value": "/vpn/media/e6ee7c85.ico", + "status": "reference_only", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_request", + "description": "Mandiant published example; filenames vary between victims.", + "confidence": "published", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "mandiant" + ], + "roles": [ + "webshell_request" + ], + "role": "webshell_request", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-dc82bcbc-de78-570e-bbae-ab486a372e8e", + "type": "path", + "value": "/vpn/media/nsgclient.ico", + "status": "reference_only", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "status": "reference_only", + "description": "Hunting reference, not a local finding.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "published_artifact", + "description": "published_artifact", + "confidence": "published", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "mandiant" + ], + "roles": [ + "published_artifact", + "reference_indicator" + ], + "role": "published_artifact; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-3d510830-d3b1-5e44-a242-b699980c2a6e", + "type": "path", + "value": "/vpn/scripts/linux/nsg64.deb", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_artifact", + "description": "webshell_artifact", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": ".deb PHP webshell — RC4-encrypted C2 using key 7489a0f93c67fa5cdaeb4b921d90594d (MD5 of passphrase Rhfajaf1H992). Commands via HTTP headers, cookies, GET/POST params. Supports cmd/size/dl/up/info commands. Uses /var/netscaler/.ns_suidcmd for privilege escalation. Source: Unit42 threat brief.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "287f7064-4981-41dc-977b-3d6801448747", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Secondary-source artifact; validate cited original report.", + "webshell_artifact" + ], + "role": "Secondary-source artifact; validate cited original report.; webshell_artifact", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-4f7d5878-969d-5828-be5d-b5862d29c92e", + "type": "path", + "value": "/vpn/scripts/linux/nsgclient18.deb", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_artifact", + "description": "webshell_artifact", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": ".deb webshell in VPN client scripts directory — .deb extension masquerading as PHP script via AddHandler in httpd.conf. Requested by multiple attacker IPs Sep 4-24 with daily VPS rotation. Source: Unit42 threat brief.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "31528ea2-29c1-4d3c-ac7b-ef2e5a4c753c", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Secondary-source artifact; validate cited original report.", + "webshell_artifact" + ], + "role": "Secondary-source artifact; validate cited original report.; webshell_artifact", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f76deaef-883d-5aae-b0b1-7ded0aeebd6e", + "type": "path", + "value": "80974ca9.sig", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "description": "Investigation-derived artifact or routing path.", + "role": "Investigation-derived artifact or routing path.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "sygnia" + ], + "roles": [ + "Investigation-derived artifact or routing path." + ], + "role": "Investigation-derived artifact or routing path.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-00ff8419-6ddb-5974-8a48-0cc1ab2f54ee", + "type": "path", + "value": "LoginIcon.sig", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "description": "Investigation-derived artifact or routing path.", + "role": "Investigation-derived artifact or routing path.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "sygnia" + ], + "roles": [ + "Investigation-derived artifact or routing path." + ], + "role": "Investigation-derived artifact or routing path.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-3363ed4f-2283-54d6-9d4f-5da305fdbc66", + "type": "path", + "value": "e6ee7c85.sig", + "status": "reference_only", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "WHIPSHOT web shell variant — .sig extension masquerading as PHP script via AddHandler in httpd.conf. Extracts Base64 payloads from HTTP_NSC_CLIENTTYPE header, executes via eval(). Routes via AliasMatch from /vpn/media/e6ee7c85.ico. Source: Mandiant/GTIG.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "619c3c8a-e3b9-44e1-afd0-fec0abd60097", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event" + ], + "roles": [ + "Secondary-source artifact; validate cited original report." + ], + "role": "Secondary-source artifact; validate cited original report.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-7c21e715-4cdc-58cd-9a78-2acaec7ea3dd", + "type": "path", + "value": "nsginstaller.deb", + "status": "reference_only", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Lightweight PHP installer web shell — .deb extension masquerading as PHP script via AddHandler in httpd.conf. Extracts Base64 commands from HTTP_NSC_LDAP header, executes via shell_exec(). Modifies httpd.conf, sets SUID on /bin/sh, scrubs /etc/crontab, reboots via /netscaler/nsshutdown -R. Filenames vary (nginstaller, nginstaller2, etc.). Source: Mandiant/GTIG.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "e398d998-726f-46e0-8701-a4c514c5351e", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event" + ], + "roles": [ + "Secondary-source artifact; validate cited original report." + ], + "role": "Secondary-source artifact; validate cited original report.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-7ba7dbfd-64f8-5dd5-9e02-6ab5ca52ef98", + "type": "path", + "value": "receiver.min.css", + "status": "reference_only", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Webshell Apache Alias — attacker configures httpd.conf to route requests for non-existent receiver.min.css to .ctxs.receiver webshell. Check httpd.conf for 'Alias /logon/LogonPoint/custom/receiver.min.css'. Source: GreyNoise blog 2026-09-28.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "7f2b241e-5fa2-4ec9-a949-d95a28dec58a", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event" + ], + "roles": [ + "Secondary-source artifact; validate cited original report." + ], + "role": "Secondary-source artifact; validate cited original report.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-e5d46efc-25d8-5489-8f0a-5c4b335c44a6", + "type": "path", + "value": "update_c08937.pl", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "description": "Investigation-derived artifact or routing path.", + "role": "Investigation-derived artifact or routing path.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "sygnia" + ], + "roles": [ + "Investigation-derived artifact or routing path." + ], + "role": "Investigation-derived artifact or routing path.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-9fffc883-a4a3-50aa-a44b-c0a10fb3c99c", + "type": "sha256", + "value": "1bd314b661396c7086f6367fbbb48025e03ca2de69c073d53a8b0a38aa5fbb7d", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "payload_hash", + "description": "Base64 payload text", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "SHA-256 of Base64 payload from 3-stage CVE-2026-88771 exploit chain. Stage 1: dropper command in User-Agent → logged to httpaccess-vpn.log. Stage 2: login request poisons ns.log with 'pitboss PPE missed too many heartbeatsNSPPE;'. Stage 3: /netscaler/ns_monuploadd_err.pl processes poisoned log, extracts and executes command. Source: Unit42 threat brief.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "cc4e48ab-6198-4c1d-a4b0-e670a3e28c1a", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "unit42" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Published community webshell/payload hash aggregation", + "Secondary-source artifact; validate cited original report.", + "payload_hash" + ], + "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; payload_hash", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-afd36d04-8867-5378-888a-35110f025138", + "type": "sha256", + "value": "57f9f30c50240fd48d761de7961a430cdebf2c084a36bc76d376a1ce8e6dfa9d", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ", + "role": "Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ", + "Published community webshell/payload hash aggregation" + ], + "role": "Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ; Published community webshell/payload hash aggregation", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-92fc2c99-4cf5-58aa-a5d7-008d3155c8cd", + "type": "sha256", + "value": "5ea5ea61e9062822bee3f66ef5ff47c217178d9e31936ad6daf10c5dfae44d12", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "esentire", + "poppelgaard", + "sygnia" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "status": "reference_only", + "role": "SHA256 hash of webshell (.ico variant)", + "description": "SHA256 hash of webshell (.ico variant)", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "description": "Suspicious investigation artifact hash.", + "role": "Suspicious investigation artifact hash.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "esentire", + "poppelgaard", + "sygnia" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Published community webshell/payload hash aggregation", + "SHA256 hash of webshell (.ico variant)", + "Suspicious investigation artifact hash." + ], + "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; SHA256 hash of webshell (.ico variant); Suspicious investigation artifact hash.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-56976039-ce98-5925-9da5-42f80fe3d742", + "type": "sha256", + "value": "6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "greynoise", + "ifin-event", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_hash", + "description": "webshell_hash", + "confidence": "published", + "source_ids": [ + "greynoise" + ], + "source_urls": [ + "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "greynoise", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:36:45.065290+00:00" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Webshell SHA-256 — GreyNoise-observed variant of .ctxs.receiver webshell. Different hash from Reddit-sourced sample (ed082f74...). Token redacted in GreyNoise post. Attacker playbook: chmod 6555 /bin/sh, install webshell, modify httpd.conf (Alias + AliasMatch + php_flag engine on), kill -HUP httpd. Source: GreyNoise blog 2026-09-28.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "b8870657-980e-4e2f-bd14-2d3d2ec0300e", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "greynoise", + "ifin-event", + "poppelgaard" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Published community webshell/payload hash aggregation", + "Secondary-source artifact; validate cited original report.", + "webshell_hash" + ], + "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; webshell_hash", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-b2c779cd-c0a6-56ee-bd4d-1a8fe9b08018", + "type": "sha256", + "value": "73b74309f4728d169cc9edfb2767c5aadd75d39b62de93c935a86c777d2646bc", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "First payload returned from /xd7h/x. ", + "role": "First payload returned from /xd7h/x. ", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "First payload returned from /xd7h/x. ", + "Published community webshell/payload hash aggregation" + ], + "role": "First payload returned from /xd7h/x. ; Published community webshell/payload hash aggregation", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-6aadf255-b9d5-5708-a4cb-39814fa86cc9", + "type": "sha256", + "value": "79c65fa04541032e251fa4796b97800374b63c7982593dd1a2e0db605d429186", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "payload_hash", + "description": "Decoded shell script", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "SHA-256 of decoded shell script from 3-stage chain — deploys .ctxs.receiver webshell, patches httpd.conf (Alias/AliasMatch for receiver.min.css + hex variants), enables PHP engine, kill -HUP httpd. Source: Unit42 threat brief.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "709f0879-af79-4d79-a1d0-dccd855eac3d", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "unit42" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Published community webshell/payload hash aggregation", + "Secondary-source artifact; validate cited original report.", + "payload_hash" + ], + "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; payload_hash", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f5816171-a941-52ac-bb19-94d0648bc8e8", + "type": "sha256", + "value": "7add390ceee4a1373211b3e340451b34f08965fc4d805f94c9b8cebdc0775774", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "esentire", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "observations": [ + { + "status": "reference_only", + "role": "SHA256 hash of webshell (.deb variant)", + "description": "SHA256 hash of webshell (.deb variant)", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "esentire", + "poppelgaard" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Published community webshell/payload hash aggregation", + "SHA256 hash of webshell (.deb variant)" + ], + "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; SHA256 hash of webshell (.deb variant)", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-9612b66f-4245-59ae-9405-057c997c80a0", + "type": "sha256", + "value": "927c7fbef2e620c1ce482c3ed67ebf53da97693c1d6c7552c77aec84ba982cf8", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Platypus agent (shell script) retrieved from entretiensol[.]com", + "role": "Platypus agent (shell script) retrieved from entretiensol[.]com", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Platypus agent (shell script) retrieved from entretiensol[.]com", + "Published community webshell/payload hash aggregation" + ], + "role": "Platypus agent (shell script) retrieved from entretiensol[.]com; Published community webshell/payload hash aggregation", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-d33d9d79-6b65-5e52-902a-b1c4b3e17959", + "type": "sha256", + "value": "974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "ifin-event", + "levelblue", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published hash for update_c08937.pl; no independently acquired sample.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "update_c08937.pl", + "description": "update_c08937.pl", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "SHA-256 of update_c08937.pl — Perl post-exploitation payload. Creates local account sec_monitor with superuser role in ns.conf, archives /flash/nsconfig to /tmp/update_result_3567cs.tgz, uploads to 64.94.85.67:443, chmod 6555 /bin/sh, deploys PHP webshell at /var/netscaler/logon/LogonPoint/.local_journal with httpd.conf AliasMatch to CSS-like URLs (LogonUISimple.html.style.min.css and hex variants). Self-deletes after execution. Source: LevelBlue THOR team.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "7959b6fc-84f3-40e2-af66-790edcc1fe97", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Perl script update_c08937.pl ", + "role": "Perl script update_c08937.pl ", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "ifin-event", + "levelblue", + "poppelgaard" + ], + "roles": [ + "Perl script update_c08937.pl ", + "Published community webshell/payload hash aggregation", + "Secondary-source artifact; validate cited original report.", + "reference_indicator", + "update_c08937.pl" + ], + "role": "Perl script update_c08937.pl ; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; reference_indicator; update_c08937.pl", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-965e969a-aa75-541b-9191-d544bf92ca6e", + "type": "sha256", + "value": "9c7bf01d2c2cb31a3609d27c1bc9abc60d86e37b7f9908547e0c75fb18b99aab", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Perl script returned from /xd7h/nsmon.pl. ", + "role": "Perl script returned from /xd7h/nsmon.pl. ", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Perl script returned from /xd7h/nsmon.pl. ", + "Published community webshell/payload hash aggregation" + ], + "role": "Perl script returned from /xd7h/nsmon.pl. ; Published community webshell/payload hash aggregation", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c7329309-8c04-5ce5-8303-92e89a112f48", + "type": "sha256", + "value": "ae22ef2517b5c0fb47f78745b9cb5260acee0e751b89bcd354640ff8bc8d29ec", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "payload_hash", + "description": "nsg64.deb PHP webshell", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "SHA-256 of nsg64.deb — .deb PHP webshell with RC4 C2. Key: 7489a0f93c67fa5cdaeb4b921d90594d (MD5 of passphrase Rhfajaf1H992). Commands: cmd (shell_exec), size (wc -c), dl (file exfil), up (file write), info (PHP version). Uses /var/netscaler/.ns_suidcmd for privesc. Source: Unit42 threat brief.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "8dafb7e1-c580-41a2-b52a-0a685eec02ae", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "unit42" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Published community webshell/payload hash aggregation", + "Secondary-source artifact; validate cited original report.", + "payload_hash" + ], + "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; payload_hash", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-cd3ee9e8-d0e7-5eec-886c-fef590f7be79", + "type": "sha256", + "value": "e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published hash for main.py; no independently acquired sample.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "main.py", + "description": "main.py", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "SHA-256 of main.py — Python reverse-shell payload. Overwrites /var/python/bin/customsnmpd with code that connects to 45.141.21.130:443, redirects stdin/stdout/stderr to socket, launches /bin/sh. Also kills existing customsnmpd processes. Source: LevelBlue THOR team.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "eac3991b-e3a0-4335-8180-a32bddf999e7", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue" + ], + "roles": [ + "Secondary-source artifact; validate cited original report.", + "main.py", + "reference_indicator" + ], + "role": "Secondary-source artifact; validate cited original report.; main.py; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-161bf202-a189-53a3-9a30-5f9ffcca29b2", + "type": "sha256", + "value": "ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "rapid7" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" + ], + "observations": [ + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "PHP webshell .ctxs.receiver — backdoor on NetScaler LogonPoint. passthru(urldecode($_COOKIE[\"NSC_TASS\"])) triggered by CsrfToken cookie match. 237 bytes. Token likely varies per victim — grep for content pattern, not just hash. Source: Reddit user K7Fy6fWmTv76D3qAPn via Discourse post #6.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "7d28869f-a134-4b95-9ed2-735c7866a52f", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Hidden PHP webshell hash.", + "role": "Hidden PHP webshell hash.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "rapid7" + ], + "source_urls": [ + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "rapid7", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039385+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "rapid7" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Hidden PHP webshell hash.", + "Published community webshell/payload hash aggregation", + "Secondary-source artifact; validate cited original report." + ], + "role": "Community-repeated published webshell or payload hash; Hidden PHP webshell hash.; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-ed202314-1f91-5a66-8c36-502623bdbfd3", + "type": "url", + "value": "http://134.175.71.50:4123/1", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://134.175.71[.]50:4123/1", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-49be21fd-6b54-51f3-8ab5-6c4b65bcd3a6", + "type": "url", + "value": "http://153.75.82.220/download/x.sh", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://153.75.82[.]220/download/x.sh", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-48342f6c-9687-5227-9482-717ab428c77c", + "type": "url", + "value": "http://177.4.12.11:8080/s?t=a", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://177.4.12[.]11:8080/s?t=a", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-59dd2664-9887-539e-bc3a-b8972625933a", + "type": "url", + "value": "http://177.4.12.11:8080/s?t=b", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://177.4.12[.]11:8080/s?t=b", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f3832e49-bc15-5a17-a33a-d18bcebaf835", + "type": "url", + "value": "http://177.4.12.11:8080/s?t=c", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://177.4.12[.]11:8080/s?t=c", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-4624107f-3f54-58f3-8634-aa9218c919d2", + "type": "url", + "value": "http://23.27.143.20:9000/main.py", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published endpoint; do not contact it.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Python reverse-shell payload", + "description": "Python reverse-shell payload", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Python reverse-shell payload — overwrites /var/python/bin/customsnmpd with code connecting to 45.141.21.130:443. Source: LevelBlue THOR team.", + "misp_type": "url", + "misp_to_ids": true, + "attribute_uuid": "daacdefc-6b6a-483e-885d-002f64346944", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "medium", + "status": "reference_only", + "original_value": "hxxp:/23.27.143[.]20:9000/main.py", + "normalization_inferred": true, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "roles": [ + "Payload retrieval or execution-check resource.", + "Python reverse-shell payload", + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "Payload retrieval or execution-check resource.; Python reverse-shell payload; Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-fb0b6f32-e20b-516a-951b-69158d6910a7", + "type": "url", + "value": "http://31.56.197.72/kk", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://31.56.197[.]72/kk", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-01772fb3-a35a-5447-8d2c-7a4665bcea56", + "type": "url", + "value": "http://31.56.197.72/lula", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://31.56.197[.]72/lula", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-aa684f87-82f4-590c-83ba-1d285df74fb8", + "type": "url", + "value": "http://31.56.197.72:9090/lula", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published endpoint; do not contact it.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Payload download URL", + "description": "Payload download URL", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Payload download URL — retrieved via curl/wget during CVE-2026-88771 exploitation. Source: LevelBlue THOR team.", + "misp_type": "url", + "misp_to_ids": true, + "attribute_uuid": "510806c9-df51-4b1f-b985-d2b469471b7c", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://31.56.197[.]72:9090/lula", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "roles": [ + "Payload download URL", + "Payload retrieval or execution-check resource.", + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "Payload download URL; Payload retrieval or execution-check resource.; Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-3c8206c9-a9db-5cdc-9a56-2b845387e628", + "type": "url", + "value": "http://62.133.62.80:80/xd7h/nsmon.pl", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://62.133.62[.]80:80/xd7h/nsmon.pl", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-daac9d9a-2c5d-56e4-aa37-20aea1d31b0f", + "type": "url", + "value": "http://62.133.62.80:80/xd7h/x", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published endpoint; do not contact it.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Payload download URL", + "description": "Payload download URL", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Payload download URL — retrieved via curl/wget during CVE-2026-88771 exploitation. Source: LevelBlue THOR team.", + "misp_type": "url", + "misp_to_ids": true, + "attribute_uuid": "b81cc60d-d93f-4c6d-8fb7-fb32a71a2fff", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://62.133.62[.]80:80/xd7h/x", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "roles": [ + "Payload download URL", + "Payload retrieval or execution-check resource.", + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "Payload download URL; Payload retrieval or execution-check resource.; Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-fbf3d4d7-beec-524f-83a0-e51a211662b3", + "type": "url", + "value": "http://64.94.85.67:443/update_c08937.pl", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published endpoint; do not contact it.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Perl post-exploitation payload", + "description": "Perl post-exploitation payload", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Perl post-exploitation payload — creates sec_monitor account with superuser role, chmod 6555 /bin/sh, deploys .local_journal webshell, exfiltrates /flash/nsconfig. Piped directly to perl. Source: LevelBlue THOR team.", + "misp_type": "url", + "misp_to_ids": true, + "attribute_uuid": "d56c3308-357e-4afc-9a60-bb3159c70497", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://64.94.85[.]67:443/update_c08937.pl", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "roles": [ + "Payload retrieval or execution-check resource.", + "Perl post-exploitation payload", + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "Payload retrieval or execution-check resource.; Perl post-exploitation payload; Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-6b2c5f46-4b51-542a-ac4a-22a82ca18d34", + "type": "url", + "value": "http://64.94.85.67:443/update_result_3567cs.tgz", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published endpoint; do not contact it.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Configuration exfiltration endpoint", + "description": "Configuration exfiltration endpoint", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Configuration exfiltration endpoint — upload target for archived /flash/nsconfig data. Source: LevelBlue THOR team.", + "misp_type": "url", + "misp_to_ids": true, + "attribute_uuid": "2626a32d-8681-41ba-9c7c-92b04c345976", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue" + ], + "roles": [ + "Configuration exfiltration endpoint", + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "Configuration exfiltration endpoint; Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f641d7d2-2d09-5490-8a90-d24e12541532", + "type": "url", + "value": "http://68.178.160.183:8888/test", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://68.178.160[.]183:8888/test", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a72639b6-e8bd-5954-bc27-e56981f25122", + "type": "url", + "value": "http://68.178.160.183:8899/test111", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://68.178.160[.]183:8899/test111", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-e1cab8ac-c435-58ec-a680-0b71d0f945dd", + "type": "url", + "value": "http://89.44.80.7:65456/exec-ok", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://89.44.80[.]7:65456/exec-ok", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + } + ], + "patterns": [ + { + "id": "log_poisoning", + "sigma_rule_id": "db5aa260-5141-5e4b-91a4-a7883d81a9a4", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)pitboss.*(?:NSPPE|PPE).*(?:unexpectedly died|missed too many heartbeats).*?(?:[;`|]|\\$\\{)", + "description": "Process-monitor text contains shell metacharacters; inspect for log poisoning or injected command text. This does not prove execution.", + "source": [], + "source_ids": [], + "source_urls": [], + "observations": [] + }, + { + "id": "engine_crash", + "sigma_rule_id": "0390ae7b-c88e-5b57-afa4-dc2575ee1d66", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)(?:^|\\s)pitboss(?:\\[\\d+\\])?:.*(?:NOT restarting|core dumped|unexpectedly died)|qat\\d+:.*orphan rings", + "description": "A process or accelerator failure is logged. Correlate with requests and restart records; a crash alone does not establish exploitation.", + "source": [], + "source_ids": [], + "source_urls": [], + "observations": [] + }, + { + "id": "dtls_error", + "sigma_rule_id": "5cb2d3c3-bb26-581e-be5a-3594b3aec4f7", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)DTLSv1\\.0.*handshake failure.internal error", + "description": "A DTLS handshake internal error is present. This is a diagnostic signal, not proof of a successful attack.", + "source": [], + "source_ids": [], + "source_urls": [], + "observations": [] + }, + { + "id": "command_injection", + "sigma_rule_id": "2f64329b-edfa-5d35-9711-186f4860e6ef", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)(?:curl|wget)\\s.*(?:https?://|\\$\\{IFS\\})|b64decode|\\$\\{IFS\\}|(?:;|`)(?:id|hostname|sleep)\\b|/(?:vpn|logon)/[^\\s?\"<>]*\\.php\\?(?:0|x|cmd|exec|command)=(?:echo[ \\t]+[^\\r\\n&;|<>]{1,128}|id|date)(?:[ \\t]*&&[ \\t]*(?:date|id))*(?:[ \\t]*$|[ \\t]*[)\"<>]|[ \\t]+HTTP/)", + "description": "Command-download or injection syntax, including diagnostic command probes against PHP routes under /vpn/ or /logon/. Requests, blocked probes and authorized testing are not evidence of execution.", + "source": [], + "source_ids": [], + "source_urls": [], + "observations": [], + "implementation_note": "Local detector refinement: contextual command probes and narrower handler-extension matching; source observations remain unchanged." + }, + { + "id": "php_execution", + "sigma_rule_id": "85769f76-e95b-5b33-bb3f-295709f4eaf3", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)<\\?php|(?:passthru|shell_exec|base64_decode)\\s*\\(", + "description": "PHP source or execution/decoding functions appear in the text. Inspect the complete payload and file evidence; a text match does not establish server-side execution.", + "source": [], + "source_ids": [], + "source_urls": [], + "observations": [] + }, + { + "id": "privilege_persistence", + "sigma_rule_id": "9d719506-517e-50fb-9675-48d2907c8733", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)chmod\\s+(?:[467][0-7]{3}|u\\+s).*?/bin/sh|AddHandler.*php|AliasMatch|authorized_keys|add system user", + "description": "The text references permission changes, executable web handlers, SSH keys, or account creation. Verify authorization and actual state changes before attributing persistence.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_suid_shell", + "description": "Sets privileged shell permissions.", + "caveat": "Actual execution/filesystem state is stronger than command appearing in an injected username.", + "correlation": null, + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_suid_shell" + } + ] + }, + { + "id": "traversal", + "sigma_rule_id": "e39745df-f20d-5ecb-831a-1c848b265a4d", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)/(?:vpn|vpns)/\\.\\./|/etc/passwd|/\\.git/|/\\.env(?:\\s|\\?)|Path traversal detected[ \\t]*\\|/|/cgi-bin/(?:\\.\\./)+", + "description": "The text references traversal syntax or commonly probed sensitive paths. Check response content and related events; the request alone does not prove disclosure.", + "source": [], + "source_ids": [], + "source_urls": [], + "observations": [] + }, + { + "id": "encoded_user_agent", + "sigma_rule_id": "d90f1337-428b-5156-adaf-3cba3906c11c", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)(?:\"(?:INDEX|[A-Za-z0-9]{1,12}):[A-Za-z0-9+/]{32,}={0,2}\"|User-Agent[^\\r\\n]*(?:INDEX|C2|3P|4B):?[A-Za-z0-9+/]{40,})", + "description": "A quoted marker and Base64-shaped value were found. Review bounded decoding results; this pattern alone does not establish a malicious payload.", + "source": [ + "cert-eu", + "unit42" + ], + "source_ids": [ + "cert-eu", + "unit42" + ], + "source_urls": [ + "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "id": "cert_staged_index", + "description": "Base64 staging marker in HTTP User-Agent.", + "caveat": "Decode offline; marker alone is staging, not execution.", + "correlation": null, + "source_ids": [ + "cert-eu" + ], + "source_urls": [ + "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771" + ], + "matching": "pattern", + "mapped_from": "cert_staged_index" + }, + { + "id": "unit42_variable_stage_marker", + "description": "Observed short staging prefixes vary; candidate must occur in User-Agent and decode to code.", + "caveat": "Low-specificity without HTTP field context; do not match arbitrary text alone.", + "correlation": null, + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "matching": "pattern", + "mapped_from": "unit42_variable_stage_marker" + } + ] + }, + { + "id": "ti_dtls_internal_error", + "sigma_rule_id": "f2b2bc2b-d781-56e6-a464-5731efb85c10", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)SSL_HANDSHAKE_FAILURE.*DTLSv1\\.0.*Handshake failure-Internal Error", + "description": "DTLS error; insufficient on its own to establish code execution.", + "source": [ + "CERTFR-2026-ALE-011", + "mandiant" + ], + "source_ids": [ + "CERTFR-2026-ALE-011", + "mandiant" + ], + "source_urls": [ + "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_dtls_crash", + "description": "DTLS failure associated with observed exploitation.", + "caveat": "An isolated handshake failure is not conclusive.", + "correlation": "Correlate qat orphan rings and NSPPE pitboss termination on same appliance in a short interval.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_dtls_crash" + }, + { + "id": "certfr_dtls_handshake", + "description": "Joint DTLS/cipher/internal-error log pattern; contextual lead, not standalone success verdict.", + "status": "reference_only", + "published": "2026-09-30", + "retrieved": "2026-10-01", + "use_or_omission_reason": "Map to existing Google-derived detection; add secondary provenance rather than duplicate a rule. No ANSSI independent qualification.", + "source_ids": [ + "CERTFR-2026-ALE-011" + ], + "source_urls": [ + "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/" + ], + "matching": "pattern", + "mapped_from": "certfr_dtls_handshake" + } + ] + }, + { + "id": "ti_nsppe_orphan", + "sigma_rule_id": "5aef80fe-3a2a-5f9e-b109-7d768d0a8f23", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)NSPPE-\\d+.*exit with orphan rings", + "description": "Process termination indicator.", + "source": [ + "CERTFR-2026-ALE-011", + "mandiant" + ], + "source_ids": [ + "CERTFR-2026-ALE-011", + "mandiant" + ], + "source_urls": [ + "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_qat_orphans", + "description": "NSPPE abnormal exit signal paired with DTLS failure.", + "caveat": "Crashes have benign causes.", + "correlation": null, + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_qat_orphans" + }, + { + "id": "certfr_nsppe_orphan", + "description": "Packet-engine orphan-ring message; correlate with nearby restart suppression and other evidence.", + "status": "reference_only", + "published": "2026-09-30", + "retrieved": "2026-10-01", + "use_or_omission_reason": "Map to existing Google-derived detection; add secondary provenance rather than duplicate a rule. No ANSSI independent qualification.", + "source_ids": [ + "CERTFR-2026-ALE-011" + ], + "source_urls": [ + "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/" + ], + "matching": "pattern", + "mapped_from": "certfr_nsppe_orphan" + } + ] + }, + { + "id": "ti_nsppe_not_restart", + "sigma_rule_id": "35bc541e-25f4-5d4b-80e4-b22f2e9ff801", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)pitboss.*NOT restarting NSPPE", + "description": "Indicator that a process was not restarted.", + "source": [ + "CERTFR-2026-ALE-011", + "mandiant" + ], + "source_ids": [ + "CERTFR-2026-ALE-011", + "mandiant" + ], + "source_urls": [ + "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "certfr_pitboss_restart", + "description": "Restart suppression message; preserve PID/device/time and correlate, allowing benign crash context.", + "status": "reference_only", + "published": "2026-09-30", + "retrieved": "2026-10-01", + "use_or_omission_reason": "Map to existing Google-derived detection; add secondary provenance rather than duplicate a rule. No ANSSI independent qualification.", + "source_ids": [ + "CERTFR-2026-ALE-011" + ], + "source_urls": [ + "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/" + ], + "matching": "pattern", + "mapped_from": "certfr_pitboss_restart" + } + ] + }, + { + "id": "ti_shell_headers", + "sigma_rule_id": "f2336666-9fca-5688-93b7-bf4fa85e082e", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)(?:HTTP_)?(?:NSC[-_]LDAP|NSC[-_]CLIENTTYPE|X[-_]UX(?:[-_]\\d+)?)", + "description": "Header hunting pattern.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_header_transport", + "description": "Header channels used by reported PHP implants.", + "caveat": "Header name is contextual; require encoded payload, suspicious route or implant evidence.", + "correlation": null, + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_header_transport" + } + ] + }, + { + "id": "ti_php_handler", + "sigma_rule_id": "2fe32158-28e3-5512-8640-f713c7f6d2c0", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)Add(?:Handler|Type)\\s+[^\\r\\n]*application/x-httpd-php(?:-source)?\\s+(?:\\.[A-Za-z0-9]+[ \\t]+)*\\.(?:deb|sig|ico|css|js|png|gif|jpg)\\b", + "description": "PHP handler mapped to a non-PHP artifact extension such as .deb or .sig. Ordinary .php/.phps mappings alone do not match; verify whether this is a requested change or an actual configuration change.", + "source": [ + "mandiant", + "sygnia" + ], + "source_ids": [ + "mandiant", + "sygnia" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "id": "mandiant_nonphp_handler", + "description": "PHP handler registration for non-PHP extension.", + "caveat": "Validate appliance configuration baseline.", + "correlation": null, + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_nonphp_handler" + }, + { + "id": "sygnia-php-handlers", + "description": "PHP handler mapping for disguised file extensions.", + "status": "experimental", + "confidence": "medium", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "matching": "pattern", + "mapped_from": "sygnia-php-handlers" + } + ], + "implementation_note": "Local detector refinement: contextual command probes and narrower handler-extension matching; source observations remain unchanged." + }, + { + "id": "ti_staged_webshell", + "sigma_rule_id": "3aa3db2c-e2c7-583d-9203-e96833e5b5c2", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)/vpn/scripts/linux/(?:nsginstaller[^\\s/?]*\\.deb|nsgclient[^\\s/?]*\\.(?:deb|sig)|[^\\s/?]+\\.php)", + "description": "Path pattern for webshell hunting.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_staging_paths", + "description": "Published staging path patterns; .deb directory also contains legitimate packages.", + "caveat": "Review context and actual execution separately.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_staging_paths" + } + ] + }, + { + "id": "ti_log_poisoning", + "sigma_rule_id": "3ec17436-eb51-5768-9b72-aece3b7d907a", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)pitboss[^\\r\\n]*(?:NSPPE|PPE)[^\\r\\n]*(?:;|`|\\$\\{?IFS\\}?|%3b|%60|%24%28)", + "description": "Potentially manipulated text; establish subsequent processing independently.", + "source": [ + "cert-eu", + "sygnia", + "watchtowr", + "watchtowr-repo" + ], + "source_ids": [ + "cert-eu", + "sygnia", + "watchtowr", + "watchtowr-repo" + ], + "source_urls": [ + "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", + "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", + "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "id": "cert_log_poisoning", + "description": "Authentication data imitates a crash line and appends commands.", + "caveat": "Failed authentication does not rule out later execution.", + "correlation": "Same appliance: staged access-log marker, poisoned auth event, ns_monuploadd_err.pl invocation, then side effects.", + "source_ids": [ + "cert-eu" + ], + "source_urls": [ + "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771" + ], + "matching": "pattern", + "mapped_from": "cert_log_poisoning" + }, + { + "id": "sygnia-pitboss-command", + "description": "Crash-like authentication text with command delimiter; injection attempt, not proof of execution.", + "status": "experimental", + "confidence": "medium", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "matching": "pattern", + "mapped_from": "sygnia-pitboss-command" + }, + { + "id": "watchtowr_crash_injection", + "description": "Crash-like text followed by command syntax, including the public artifact-generator form.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "watchtowr", + "watchtowr-repo" + ], + "source_urls": [ + "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", + "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/" + ], + "matching": "pattern", + "mapped_from": "watchtowr_crash_injection" + } + ] + }, + { + "id": "ti_delayed_processor", + "sigma_rule_id": "324d542c-d00d-5ee9-be43-7f6e44d30afa", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)ns_monuploadd_err\\.pl", + "description": "Indicator of possible subsequent processing.", + "source": [ + "watchtowr" + ], + "source_ids": [ + "watchtowr" + ], + "source_urls": [ + "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/" + ], + "observations": [] + }, + { + "id": "ti_css_journal", + "sigma_rule_id": "db27552c-3c30-5a99-9e82-7ec76c7ba3cd", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)LogonUISimple\\.html\\.style(?:\\.[a-f0-9]+)?\\.min\\.css|\\.local_journal", + "description": "CSS disguise and journal artifact pattern.", + "source": [ + "levelblue" + ], + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "id": "levelblue_local_journal_alias", + "description": "Reported .local_journal masquerading route.", + "caveat": "CSS names may overlap legitimate assets; require PHP alias/content corroboration.", + "correlation": null, + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "matching": "pattern", + "mapped_from": "levelblue_local_journal_alias" + } + ] + }, + { + "id": "unit42_cookie_execution", + "sigma_rule_id": "623305d2-16b6-5710-adc8-b762522af1be", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?is)(?:CsrfToken.*NSC_TASS|NSC_TASS.*CsrfToken)", + "description": "Paired implant cookies; NSC_TASS carries URL-encoded command.", + "source": [ + "unit42" + ], + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "id": "unit42_cookie_execution", + "description": "Paired implant cookies; NSC_TASS carries URL-encoded command.", + "caveat": "Legitimate cookie names alone are insufficient; decode value and examine destination/response.", + "correlation": null, + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "matching": "pattern", + "mapped_from": "unit42_cookie_execution" + } + ] + }, + { + "id": "unit42_receiver_alias", + "sigma_rule_id": "48774954-8559-562c-902a-2ba8a75f2e2c", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)/logon/LogonPoint/custom/receiver\\.min(?:\\.[0-9a-f]+)?\\.css", + "description": "CSS-disguised webshell route.", + "source": [ + "ifin-event", + "unit42" + ], + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "id": "unit42_receiver_alias", + "description": "CSS-disguised webshell route.", + "caveat": "Confirm alias or shell content; request alone does not prove execution.", + "correlation": null, + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "matching": "pattern", + "mapped_from": "unit42_receiver_alias" + }, + { + "id": "ifin-css-hex-alias", + "description": "Community-reported alias pattern; verify context.", + "status": "experimental", + "confidence": "medium", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "matching": "pattern", + "mapped_from": "ifin-css-hex-alias" + } + ] + }, + { + "id": "unit42_anomalous_getusername", + "sigma_rule_id": "31940357-e53f-57f8-b908-9599b0913fd2", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "/logon/LogonPoint/Authentication/GetUserName", + "description": "Repeated pre-disclosure activity to anomalous endpoint.", + "source": [ + "unit42" + ], + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "id": "unit42_anomalous_getusername", + "description": "Repeated pre-disclosure activity to anomalous endpoint.", + "caveat": "Investigative signal; no standalone exploitation conclusion.", + "correlation": null, + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "matching": "pattern", + "mapped_from": "unit42_anomalous_getusername" + } + ] + }, + { + "id": "mandiant_slapshot_launch", + "sigma_rule_id": "86c468d2-0afc-5eb2-9070-62a4d0f0ba42", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?is)nohup\\s+python.*base64.*\\.uxdport.*\\.uxdlock", + "description": "Detached encoded Python tunneler launch with hidden IPC files.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_slapshot_launch", + "description": "Detached encoded Python tunneler launch with hidden IPC files.", + "caveat": "Do not execute the decoded code.", + "correlation": null, + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_slapshot_launch" + } + ] + }, + { + "id": "mandiant_fato_webshell", + "sigma_rule_id": "5614e015-a1e0-5c80-bce4-f20f3e689a50", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?is).*", + "description": "PHP implant framing markers.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_fato_webshell", + "description": "PHP implant framing markers.", + "caveat": "Combine with NSC header parsing and dynamic execution; markup alone insufficient.", + "correlation": null, + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_fato_webshell" + } + ] + }, + { + "id": "esentire_php_useragent", + "sigma_rule_id": "a5f6d8e8-e170-5aae-a7a2-710beac8ee28", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)/vpn/media/[^\\s\"?]+\\.ico.*PD9[A-Za-z0-9+/]{20,}", + "description": "Icon request followed by encoded PHP staging in User-Agent.", + "source": [ + "esentire" + ], + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "observations": [ + { + "id": "esentire_php_useragent", + "description": "Icon request followed by encoded PHP staging in User-Agent.", + "caveat": "HTTP404 is expected for both unsuccessful staging and active stealth webshell responses.", + "correlation": "Correlate poisoned auth event, script invocation, changed handlers/files and outbound/lateral traffic.", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "matching": "pattern", + "mapped_from": "esentire_php_useragent" + } + ] + }, + { + "id": "levelblue_backtick_poisoning", + "sigma_rule_id": "11c3813f-894b-51f6-80fb-d7dab0c0e8dd", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)pitboss.*NSPPE.*`.*(?:tar|curl|wget|cat).*`.*unexpectedly died", + "description": "Backtick substitution variant can avoid semicolon-only detections.", + "source": [ + "levelblue" + ], + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "id": "levelblue_backtick_poisoning", + "description": "Backtick substitution variant can avoid semicolon-only detections.", + "caveat": "", + "correlation": null, + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "matching": "pattern", + "mapped_from": "levelblue_backtick_poisoning" + } + ] + }, + { + "id": "levelblue_config_staging", + "sigma_rule_id": "5907a6d1-0c74-5eae-9e9b-588c0bab859d", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?is)(?:cat|cp|tar).*?/flash/nsconfig.*(?:>|/var/netscaler/logon)|(?:tar|cat).*?/var/netscaler/logon.*?/flash/nsconfig", + "description": "Copies or archives configuration into web-accessible files.", + "source": [ + "levelblue" + ], + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "id": "levelblue_config_staging", + "description": "Copies or archives configuration into web-accessible files.", + "caveat": "Validate command execution and HTTP retrieval or network exfiltration.", + "correlation": null, + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "matching": "pattern", + "mapped_from": "levelblue_config_staging" + } + ] + }, + { + "id": "mandiant_icon_route", + "sigma_rule_id": "052a9870-fe4b-5b43-8261-5e523636590b", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)AliasMatch.*?/vpn/media/.*?/var/netscaler/gui/vpn/scripts/linux/.*?\\.sig", + "description": "Icon-to-signature PHP routing persistence.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_icon_route", + "description": "Icon-to-signature PHP routing persistence.", + "caveat": "Review context and actual execution separately.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_icon_route" + } + ] + }, + { + "id": "mandiant_php_execution", + "sigma_rule_id": "79c6ea05-8efd-51b4-8fd2-79613054863d", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?is)(?:HTTP_)?NSC_(?:LDAP|CLIENTTYPE|USER|NONCE|FT_HIDE).*?(?:eval|shell_exec|passthru|system).*?base64_decode", + "description": "Header parsing combined with encoded dynamic PHP execution; inspect full file when statements occur across lines.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_php_execution", + "description": "Header parsing combined with encoded dynamic PHP execution; inspect full file when statements occur across lines.", + "caveat": "Review context and actual execution separately.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_php_execution" + } + ] + }, + { + "id": "aw-resource-prefix-1", + "sigma_rule_id": "985490ff-cbe4-50e7-b4a9-f962543255af", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "http://89\\.44\\.80\\.7:65456/", + "description": "Incomplete dynamic or redacted URL prefix; not exact IOC.", + "source": [ + "arctic-wolf" + ], + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "id": "aw-resource-prefix-1", + "description": "Incomplete dynamic or redacted URL prefix; not exact IOC.", + "status": "experimental", + "confidence": "medium", + "original_value": "hxxp://89.44.80[.]7:65456/$(id|base64 -w0)", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "matching": "pattern", + "mapped_from": "aw-resource-prefix-1" + } + ] + }, + { + "id": "aw-resource-prefix-2", + "sigma_rule_id": "7ff4a684-f5e1-50b6-b543-ba30ae52818c", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "http://130\\.94\\.42\\.226:18805/\\?t=", + "description": "Incomplete dynamic or redacted URL prefix; not exact IOC.", + "source": [ + "arctic-wolf" + ], + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "id": "aw-resource-prefix-2", + "description": "Incomplete dynamic or redacted URL prefix; not exact IOC.", + "status": "experimental", + "confidence": "medium", + "original_value": "hxxp://130.94.42[.]226:18805/?t=", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "matching": "pattern", + "mapped_from": "aw-resource-prefix-2" + } + ] + }, + { + "id": "aw-nsmon-cron", + "sigma_rule_id": "6bb4bd57-96bf-5bf5-b2b2-36ce721d4902", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)\\*/5\\s+\\*\\s+\\*\\s+\\*\\s+\\*\\s+root\\s+perl\\s+/var/tmp/\\.nsmon/nsmon\\.pl", + "description": "Root cron invokes reported hidden Perl implant every five minutes.", + "source": [ + "arctic-wolf" + ], + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "id": "aw-nsmon-cron", + "description": "Root cron invokes reported hidden Perl implant every five minutes.", + "status": "experimental", + "confidence": "medium", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "matching": "pattern", + "mapped_from": "aw-nsmon-cron" + } + ] + }, + { + "id": "aw-encoded-command-output", + "sigma_rule_id": "7f6eb722-0be4-581f-bed5-10d8d3b26247", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)\\bid\\s*\\|\\s*base64\\s+-w\\s*0", + "description": "Identity output encoding; corroborate HTTP callback before declaring exfiltration.", + "source": [ + "arctic-wolf" + ], + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "id": "aw-encoded-command-output", + "description": "Identity output encoding; corroborate HTTP callback before declaring exfiltration.", + "status": "experimental", + "confidence": "medium", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "matching": "pattern", + "mapped_from": "aw-encoded-command-output" + } + ] + }, + { + "id": "rapid7-tar-config", + "sigma_rule_id": "156c151e-13b0-5dd7-a22c-07bdb4af9327", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)\\btar(?:\\$\\{?IFS\\}?|\\s)+czf.*?/var/netscaler/gui/vpn/c\\b.*?(?:/flash|nsconfig)", + "description": "Configuration archive staged under web root; command presence is not proof of execution.", + "source": [ + "rapid7" + ], + "source_ids": [ + "rapid7" + ], + "source_urls": [ + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" + ], + "observations": [ + { + "id": "rapid7-tar-config", + "description": "Configuration archive staged under web root; command presence is not proof of execution.", + "status": "experimental", + "confidence": "medium", + "original_command": "tar${IFS}czf$IFS/var/netscaler/gui/vpn/c$IFS-C$IFS/flash${IFS}nsconfig", + "normalized_command": "tar czf /var/netscaler/gui/vpn/c -C /flash nsconfig", + "source_ids": [ + "rapid7" + ], + "source_urls": [ + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" + ], + "matching": "pattern", + "mapped_from": "rapid7-tar-config" + } + ] + }, + { + "id": "sygnia-encoded-loader", + "sigma_rule_id": "9fb8bb55-fb55-535a-9b4c-6344f8b08bfe", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?im)^(?=.*(?:pitboss|NSPPE))(?=.*(?:base64|PD9))(?=.*(?:2N|httpaccess))", + "description": "Heuristic encoded HTTP-log loader chain; decode payload and check context.", + "source": [ + "sygnia" + ], + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "id": "sygnia-encoded-loader", + "description": "Heuristic encoded HTTP-log loader chain; decode payload and check context.", + "status": "experimental", + "confidence": "medium", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "matching": "pattern", + "mapped_from": "sygnia-encoded-loader" + } + ] + }, + { + "id": "elastic-inspired-crash-shell", + "sigma_rule_id": "a0f728c2-6c21-50e7-9909-ae5df3b77538", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?im)^(?=.*pitboss)(?:(?=.*(?:nsppe|\\bppe\\b|core))|(?=(?>.*?packet).*engine))(?=.*(?:;|`|\\$\\(|&&|\\|\\||%3b|%60|%7c|%24%28|%26%26|%3e|%3c))", + "description": "Independently derived raw-log heuristic: crash-like text and shell syntax. Broader than original field-scoped EQL.", + "source": [ + "elastic-toml" + ], + "source_ids": [ + "elastic-toml" + ], + "source_urls": [ + "https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml" + ], + "observations": [ + { + "id": "elastic-inspired-crash-shell", + "description": "Independently derived raw-log heuristic: crash-like text and shell syntax. Broader than original field-scoped EQL.", + "status": "experimental", + "confidence": "medium", + "license_note": "Original Elastic License v2; source rule not copied into product.", + "source_ids": [ + "elastic-toml" + ], + "source_urls": [ + "https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml" + ], + "matching": "pattern", + "mapped_from": "elastic-inspired-crash-shell" + } + ] + }, + { + "id": "aw-platypus-install-prefix", + "sigma_rule_id": "0a8f1d34-83bb-5ade-bfc8-1bd45f221a27", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "https://entretiensol\\.com:443/api/v1/install/", + "description": "Redacted installer URL prefix; no redacted token treated as exact IOC.", + "source": [ + "arctic-wolf" + ], + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "id": "aw-platypus-install-prefix", + "description": "Redacted installer URL prefix; no redacted token treated as exact IOC.", + "status": "experimental", + "confidence": "medium", + "original_value": "hxxps://entretiensol[.]com:443/api/v1/install/", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "matching": "pattern", + "mapped_from": "aw-platypus-install-prefix" + } + ] + }, + { + "id": "historical_startup_obfuscation", + "sigma_rule_id": "742a1576-1923-58ce-801a-813820e41169", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)fnoc\\.dptth|php\\.(?:xedni|xednimt|IUnogoL)|hs/pmt/rav/|tnioPnogoL|gifnocsn|relacsten\\.cr", + "description": "Historical reversed persistence strings; correlate with startup/configuration modifications.", + "source": [ + "deyda-script", + "ncsc-nl-2025" + ], + "source_ids": [ + "deyda-script", + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "observations": [ + { + "id": "historical_startup_obfuscation", + "description": "Historical reversed persistence strings; correlate with startup/configuration modifications.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "deyda-script", + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "matching": "pattern", + "mapped_from": "historical_startup_obfuscation" + } + ] + }, + { + "id": "php_input_execution", + "sigma_rule_id": "3fafb627-665f-5caa-9a4b-229086449433", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?is)<\\?(?:php)?[^\\r\\n]*(?:eval\\s*\\(\\s*\\$_|(?:base64_decode|passthru|shell_exec|array_filter)\\s*\\()", + "description": "PHP text with input evaluation or decoding; adapted content heuristic, not image metadata validation.", + "source": [ + "fox-it", + "ncsc-nl-2025" + ], + "source_ids": [ + "fox-it", + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025", + "https://github.com/fox-it/citrix-netscaler-triage" + ], + "observations": [ + { + "id": "php_input_execution", + "description": "PHP text with input evaluation or decoding; adapted content heuristic, not image metadata validation.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "fox-it", + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025", + "https://github.com/fox-it/citrix-netscaler-triage" + ], + "matching": "pattern", + "mapped_from": "php_input_execution" + } + ] + }, + { + "id": "persistence_target_write", + "sigma_rule_id": "b72b1566-d05a-5fca-8cb4-229fcb59cc95", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)(?:\\b(?:echo|printf|cp|mv|sed|tee)\\b[^\\r\\n]*)(?:rc\\.netscaler|nsafter\\.sh|/etc/rc\\.conf\\.defaults)", + "description": "Command text writes or edits startup targets; compare approved configuration.", + "source": [ + "deyda-script", + "poppelgaard" + ], + "source_ids": [ + "deyda-script", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "observations": [ + { + "id": "persistence_target_write", + "description": "Command text writes or edits startup targets; compare approved configuration.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "deyda-script", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "matching": "pattern", + "mapped_from": "persistence_target_write" + } + ] + }, + { + "id": "setuid_temporary_shell", + "sigma_rule_id": "67e7c3f5-d648-516e-97fc-79ceb36453fb", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)chmod\\s+(?:[ugoa]*\\+s|[4567][0-7]{3})\\s+(?:/var/tmp/sh|/bin/sh)", + "description": "Command text sets privileged permissions on a shell; corroborate actual file mode.", + "source": [ + "deyda-script" + ], + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "observations": [ + { + "id": "setuid_temporary_shell", + "description": "Command text sets privileged permissions on a shell; corroborate actual file mode.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "matching": "pattern", + "mapped_from": "setuid_temporary_shell" + } + ] + }, + { + "id": "trace_removal", + "sigma_rule_id": "5fbd05f0-df10-513d-acfc-e856fa90dd70", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)(?:\\brm\\s+(?:-[A-Za-z]+\\s+)*|\\btruncate\\s+[^\\r\\n]*|/dev/null\\s*>\\s*)(?:/var/(?:log|nslog|core)/|[^\\r\\n]*\\.log\\b)", + "description": "Log/core deletion or truncation command text; maintenance may be legitimate.", + "source": [ + "poppelgaard" + ], + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "id": "trace_removal", + "description": "Log/core deletion or truncation command text; maintenance may be legitimate.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "matching": "pattern", + "mapped_from": "trace_removal" + } + ] + }, + { + "id": "community_credential_access", + "sigma_rule_id": "83dd2ce5-c181-534b-b8b4-0b58dd9501d5", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)(?:\\b(?:cat|cp|tar|openssl|ldapsearch)\\b[^\\r\\n]*)(?:/flash/nsconfig/keys|F[12]\\.key|database\\.php|LDAPTLS_REQCERT)", + "description": "Credential/key access command context; legitimate administration can match.", + "source": [ + "poppelgaard" + ], + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "id": "community_credential_access", + "description": "Credential/key access command context; legitimate administration can match.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "matching": "pattern", + "mapped_from": "community_credential_access" + } + ] + } + ], + "external_rule_sets": [ + { + "source": "ncsc-php_webshell_rules.yara", + "format": "yara", + "rule_names": [ + "WEBSHELL_PHP_Generic", + "WEBSHELL_PHP_Generic_Callback", + "WEBSHELL_PHP_Base64_Encoded_Payloads", + "WEBSHELL_PHP_Unknown_1", + "WEBSHELL_PHP_Generic_Eval", + "WEBSHELL_PHP_Double_Eval_Tiny", + "WEBSHELL_PHP_OBFUSC", + "WEBSHELL_PHP_OBFUSC_Encoded", + "WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex", + "WEBSHELL_PHP_OBFUSC_Tiny", + "WEBSHELL_PHP_OBFUSC_Str_Replace", + "WEBSHELL_PHP_OBFUSC_Fopo", + "WEBSHELL_PHP_Gzinflated", + "WEBSHELL_PHP_OBFUSC_3", + "WEBSHELL_PHP_Includer_Eval", + "WEBSHELL_PHP_Includer_Tiny", + "WEBSHELL_PHP_Dynamic", + "WEBSHELL_PHP_Dynamic_Big", + "WEBSHELL_PHP_Encoded_Big", + "WEBSHELL_PHP_Generic_Backticks", + "WEBSHELL_PHP_Generic_Backticks_OBFUSC", + "WEBSHELL_PHP_By_String_Known_Webshell", + "WEBSHELL_PHP_Strings_SUSP", + "WEBSHELL_PHP_In_Htaccess", + "WEBSHELL_PHP_Function_Via_Get", + "WEBSHELL_PHP_Writer", + "WEBSHELL_ASP_Writer", + "WEBSHELL_ASP_OBFUSC", + "WEBSHELL_ASP_Generic_Eval_On_Input", + "WEBSHELL_ASP_Nano", + "WEBSHELL_ASP_Encoded", + "WEBSHELL_ASP_Encoded_AspCoding", + "WEBSHELL_ASP_By_String", + "WEBSHELL_ASP_Sniffer", + "WEBSHELL_ASP_Generic_Tiny", + "WEBSHELL_ASP_Generic", + "WEBSHELL_ASP_Generic_Registry_Reader", + "WEBSHELL_ASPX_Regeorg_CSHARP", + "WEBSHELL_CSHARP_Generic", + "WEBSHELL_ASP_Runtime_Compile", + "WEBSHELL_ASP_SQL", + "WEBSHELL_ASP_Scan_Writable", + "WEBSHELL_JSP_ReGeorg", + "WEBSHELL_JSP_HTTP_Proxy", + "WEBSHELL_JSP_Writer_Nano", + "EXT_WEBSHELL_JSP_Generic_Tiny", + "WEBSHELL_JSP_Generic", + "WEBSHELL_JSP_Generic_Base64", + "WEBSHELL_JSP_Generic_ProcessBuilder", + "WEBSHELL_JSP_Generic_Reflection", + "WEBSHELL_JSP_Generic_Classloader", + "WEBSHELL_JSP_Generic_Encoded_Shell", + "WEBSHELL_JSP_NetSpy", + "WEBSHELL_JSP_By_String", + "WEBSHELL_JSP_Input_Upload_Write", + "WEBSHELL_Generic_OS_Strings", + "WEBSHELL_In_Image", + "WEBSHELL_Mixed_OBFUSC", + "WEBSHELL_Cookie_Post_Obfuscation" + ], + "count": 59, + "enabled_in_log_scanner": false, + "reason": "Rules depend on whole-file byte/offset/string conditions or non-NetScaler platforms. Use their original YARA semantics on acquired files/images; generic PHP content hunting is separately adapted and attributed." + }, + { + "source": "ncsc-thor-webshells.yar", + "format": "yara", + "rule_names": [ + "Weevely_Webshell", + "WEBSHELL_H4ntu_Shell_Powered_Tsoi_3", + "WEBSHELL_H4ntu_Shell_Powered_Tsoi", + "webshell_PHP_sql", + "webshell_PHP_a", + "webshell_iMHaPFtp_2", + "webshell_Jspspyweb", + "webshell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2", + "webshell_SimAttacker_Vrsion_1_0_0_priv8_4_My_friend", + "webshell_phpshell_2_1_pwhash", + "webshell_PHPRemoteView", + "webshell_jsp_12302", + "webshell_caidao_shell_guo", + "webshell_PHP_redcod", + "webshell_remview_fix", + "webshell_asp_cmd", + "webshell_php_sh_server", + "webshell_PH_Vayv_PH_Vayv", + "webshell_caidao_shell_ice", + "webshell_cihshell_fix", + "webshell_asp_shell", + "webshell_Private_i3lue", + "webshell_php_up", + "webshell_Mysql_interface_v1_0", + "webshell_php_s_u", + "webshell_phpshell_2_1_config", + "webshell_asp_EFSO_2", + "webshell_jsp_up", + "webshell_NetworkFileManagerPHP", + "webshell_Server_Variables", + "webshell_caidao_shell_ice_2", + "webshell_caidao_shell_mdb", + "webshell_jsp_guige", + "webshell_phpspy2010", + "webshell_asp_ice", + "webshell_drag_system", + "webshell_DarkBlade1_3_asp_indexx", + "webshell_phpshell3", + "webshell_jsp_hsxa", + "webshell_jsp_utils", + "webshell_asp_01", + "webshell_asp_404", + "webshell_webshell_cnseay02_1", + "webshell_php_fbi", + "webshell_B374kPHP_B374k", + "webshell_cmd_asp_5_1", + "webshell_php_dodo_zip", + "webshell_aZRaiLPhp_v1_0", + "webshell_php_list", + "webshell_ironshell", + "webshell_caidao_shell_404", + "webshell_ASP_aspydrv", + "webshell_jsp_web", + "webshell_mysqlwebsh", + "webshell_jspShell", + "webshell_Dx_Dx", + "webshell_asp_ntdaddy", + "webshell_MySQL_Web_Interface_Version_0_8", + "webshell_elmaliseker_2", + "webshell_ASP_RemExp", + "webshell_jsp_list1", + "webshell_phpkit_1_0_odd", + "webshell_jsp_123", + "webshell_asp_1", + "webshell_ASP_tool", + "webshell_cmd_win32", + "webshell_jsp_jshell", + "webshell_ASP_zehir4", + "webshell_wsb_idc", + "webshell_cpg_143_incl_xpl", + "webshell_mumaasp_com", + "webshell_php_404", + "webshell_webshell_cnseay_x", + "webshell_asp_up", + "webshell_phpkit_0_1a_odd", + "webshell_ASP_cmd", + "webshell_PHP_Shell_x3", + "webshell_PHP_g00nv13", + "webshell_php_h6ss", + "webshell_jsp_zx", + "webshell_Ani_Shell", + "webshell_jsp_k8cmd", + "webshell_jsp_cmd", + "webshell_jsp_k81", + "webshell_ASP_zehir", + "webshell_Worse_Linux_Shell_1", + "webshell_zacosmall", + "webshell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit", + "webshell_redirect", + "webshell_jsp_cmdjsp", + "webshell_Java_Shell", + "webshell_asp_1d", + "webshell_jsp_IXRbE", + "webshell_PHP_G5", + "webshell_PHP_r57142", + "webshell_jsp_tree", + "webshell_C99madShell_v_3_0_smowu", + "webshell_simple_backdoor", + "webshell_PHP_404", + "webshell_Macker_s_Private_PHPShell", + "webshell_Antichat_Shell_v1_3_2", + "webshell_Safe_mode_breaker", + "webshell_Sst_Sheller", + "webshell_jsp_list", + "webshell_PHPJackal_v1_5", + "webshell_customize", + "webshell_s72_Shell_v1_1_Coding", + "webshell_jsp_sys3", + "webshell_jsp_guige02", + "webshell_php_ghost", + "webshell_WinX_Shell", + "webshell_Crystal_Crystal", + "webshell_r57_1_4_0", + "webshell_asp_ajn", + "webshell_php_cmd", + "webshell_asp_list", + "webshell_PHP_co", + "webshell_PHP_150", + "webshell_jsp_cmdjsp_2", + "webshell_PHP_c37", + "webshell_PHP_b37", + "webshell_php_backdoor", + "webshell_asp_dabao", + "webshell_php_2", + "webshell_asp_cmdasp", + "webshell_spjspshell", + "webshell_jsp_action", + "webshell_Inderxer", + "webshell_asp_Rader", + "webshell_c99_madnet_smowu", + "webshell_php_moon", + "webshell_minupload", + "webshell_ELMALISEKER_Backd00r", + "webshell_PHP_bug_1_", + "webshell_caidao_shell_hkmjj", + "webshell_jsp_asd", + "webshell_metaslsoft", + "webshell_asp_Ajan", + "webshell_config_myxx_zend", + "webshell_browser_201_3_ma_download", + "webshell_itsec_itsecteam_shell_jHn", + "webshell_ghost_source_icesword_silic", + "webshell_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_spy2009_m_ma3_xxx", + "webshell_2_520_job_ma1_ma4_2", + "webshell_000_403_807_a_c5_config_css_dm_he1p_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_xxx", + "webshell_wso2_5_1_wso2_5_wso2", + "webshell_000_403_c5_queryDong_spyjsp2010_t00ls", + "webshell_404_data_suiyue", + "webshell_r57shell_r57shell127_SnIpEr_SA_Shell_EgY_SpIdEr_ShElL_V2_r57_xxx", + "webshell_807_a_css_dm_he1p_JspSpy_xxx", + "webshell_201_3_ma_download", + "webshell_browser_201_3_400_in_JFolder_jfolder01_jsp_leo_ma_warn_webshell_nc_download", + "webshell_shell_phpspy_2006_arabicspy", + "webshell_in_JFolder_jfolder01_jsp_leo_warn", + "webshell_2_520_icesword_job_ma1_ma4_2", + "webshell_phpspy_2005_full_phpspy_2005_lite_PHPSPY", + "webshell_shell_phpspy_2006_arabicspy_hkrkoz", + "webshell_c99_Shell_ci_Biz_was_here_c100_v_xxx", + "webshell_2008_2009lite_2009mssql", + "webshell_shell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_arabicspy_PHPSPY_hkrkoz", + "webshell_807_dm_JspSpyJDK5_m_cofigrue", + "webshell_Dive_Shell_1_0_Emperor_Hacking_Team_xxx", + "webshell_404_data_in_JFolder_jfolder01_xxx", + "webshell_jsp_reverse_jsp_reverse_jspbd", + "webshell_400_in_JFolder_jfolder01_jsp_leo_warn_webshell_nc", + "webshell_2_520_job_JspWebshell_1_2_ma1_ma4_2", + "webshell_shell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz", + "webshell_gfs_sh_r57shell_r57shell127_SnIpEr_SA_xxx", + "webshell_itsec_PHPJackal_itsecteam_shell_jHn", + "webshell_Shell_ci_Biz_was_here_c100_v_xxx", + "webshell_NIX_REMOTE_WEB_SHELL_NIX_REMOTE_WEB_xxx1", + "webshell_c99_c99shell_c99_w4cking_Shell_xxx", + "webshell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz", + "webshell_c99_c66_c99_shadows_mod_c99shell", + "webshell_he1p_JspSpy_nogfw_ok_style_1_JspSpy1", + "webshell_000_403_c5_config_myxx_queryDong_spyjsp2010_zend", + "webshell_c99_c99shell_c99_c99shell", + "webshell_r57shell127_r57_iFX_r57_kartal_r57_antichat", + "webshell_NIX_REMOTE_WEB_SHELL_nstview_xxx", + "webshell_000_403_807_a_c5_config_css_dm_he1p_xxx", + "webshell_2_520_icesword_job_ma1", + "webshell_404_data_in_JFolder_jfolder01_jsp_suiyue_warn", + "webshell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_PHPSPY", + "webshell_c99_locus7s_c99_w4cking_xxx", + "webshell_browser_201_3_ma_ma2_download", + "webshell_000_403_c5_queryDong_spyjsp2010", + "webshell_r57shell127_r57_kartal_r57", + "webshell_webshells_new_con2", + "webshell_webshells_new_make2", + "webshell_webshells_new_aaa", + "webshell_Expdoor_com_ASP", + "webshell_webshells_new_php2", + "webshell_bypass_iisuser_p", + "webshell_sig_404super", + "webshell_webshells_new_JSP", + "webshell_webshell_123", + "webshell_dev_core", + "webshell_webshells_new_pHp", + "webshell_webshells_new_pppp", + "webshell_webshells_new_code", + "webshell_webshells_new_jspyyy", + "webshell_webshells_new_xxxx", + "webshell_webshells_new_JJjsp3", + "webshell_webshells_new_PHP1", + "webshell_webshells_new_JJJsp2", + "webshell_webshells_new_radhat", + "webshell_webshells_new_asp1", + "webshell_webshells_new_php6", + "webshell_webshells_new_xxx", + "webshell_GetPostpHp", + "webshell_webshells_new_php5", + "webshell_webshells_new_PHP", + "webshell_webshells_new_Asp", + "perlbot_pl", + "php_backdoor_php", + "Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_php", + "Nshell__1__php_php", + "shankar_php_php", + "Casus15_php_php", + "small_php_php", + "shellbot_pl", + "fuckphpshell_php", + "ngh_php_php", + "jsp_reverse_jsp", + "Tool_asp", + "NT_Addy_asp", + "SimAttacker___Vrsion_1_0_0___priv8_4_My_friend_php", + "RemExp_asp", + "phvayvv_php_php", + "klasvayv_asp", + "r57shell_php_php", + "rst_sql_php_php", + "wh_bindshell_py", + "lurm_safemod_on_cgi", + "c99madshell_v2_0_php_php", + "backupsql_php_often_with_c99shell", + "uploader_php_php", + "telnet_pl", + "w3d_php_php", + "WebShell_cgi", + "WinX_Shell_html", + "Dx_php_php", + "csh_php_php", + "pHpINJ_php_php", + "sig_2008_php_php", + "ak74shell_php_php", + "Rem_View_php_php", + "Java_Shell_js", + "STNC_php_php", + "aZRaiLPhp_v1_0_php", + "Moroccan_Spamers_Ma_EditioN_By_GhOsT_php", + "zacosmall_php", + "CmdAsp_asp", + "simple_backdoor_php", + "mysql_shell_php", + "Dive_Shell_1_0___Emperor_Hacking_Team_php", + "Asmodeus_v0_1_pl", + "backup_php_often_with_c99shell", + "Reader_asp", + "phpshell17_php", + "myshell_php_php", + "SimShell_1_0___Simorgh_Security_MGZ_php", + "jspshall_jsp", + "webshell_php", + "rootshell_php", + "connectback2_pl", + "DefaceKeeper_0_2_php", + "shells_PHP_wso", + "backdoor1_php", + "elmaliseker_asp", + "indexer_asp", + "DxShell_php_php", + "s72_Shell_v1_1_Coding_html", + "kacak_asp", + "PHP_Backdoor_Connect_pl_php", + "Antichat_Socks5_Server_php_php", + "Antichat_Shell_v1_3_php", + "Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_php", + "mysql_php_php", + "Worse_Linux_Shell_php", + "cyberlords_sql_php_php", + "cmd_asp_5_1_asp", + "pws_php_php", + "PHP_Shell_php_php", + "Ayyildiz_Tim___AYT__Shell_v_2_1_Biz_html", + "EFSO_2_asp", + "lamashell_php", + "Ajax_PHP_Command_Shell_php", + "JspWebshell_1_2_jsp", + "Sincap_php_php", + "Test_php_php", + "Phyton_Shell_py", + "mysql_tool_php_php", + "Zehir_4_asp", + "sh_php_php", + "phpbackdoor15_php", + "phpjackal_php", + "sql_php_php", + "cgi_python_py", + "ru24_post_sh_php_php", + "DTool_Pro_php", + "telnetd_pl", + "php_include_w_shell_php", + "Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php", + "shell_php_php", + "telnet_cgi", + "ironshell_php", + "backdoorfr_php", + "aspydrv_asp", + "cmdjsp_jsp", + "h4ntu_shell__powered_by_tsoi_", + "Ajan_asp", + "PHANTASMA_php", + "MySQL_Web_Interface_Version_0_8_php", + "simple_cmd_html", + "_1_c2007_php_php_c100_php", + "_nst_php_php_img_php_php_nstview_php_php", + "_network_php_php_xinfo_php_php_nfm_php_php", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SpecialShell_99_php_php", + "_r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php", + "_c99shell_v1_0_php_php_c99php_SsEs_php_php_ctt_sh_php_php", + "_r577_php_php_spy_php_php_s_php_php", + "webshell_c99_generic", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php", + "_w_php_php_wacking_php_php_SpecialShell_99_php_php", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php", + "_r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_spy_php_php_s_php_php", + "_r577_php_php_SnIpEr_SA_Shell_php_r57_php_php", + "_r577_php_php_r57_Shell_php_php_spy_php_php_s_php_php", + "_wacking_php_php_1_SpecialShell_99_php_php_c100_php", + "_r577_php_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php", + "_w_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php", + "multiple_php_webshells", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php", + "_GFS_web_shell_ver_3_1_7___PRiV8_php_nshell_php_php_gfs_sh_php_php", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_SpecialShell_99_php_php", + "_w_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php", + "_antichat_php_php_Fatalshell_php_php_a_gedit_php_php", + "_c99shell_v1_0_php_php_c99php_SsEs_php_php", + "_Crystal_php_nshell_php_php_load_shell_php_php", + "_nst_php_php_cybershell_php_php_img_php_php_nstview_php_php", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_dC3_Security_Crew_Shell_PRiV_php_SpecialShell_99_php_php", + "_c99shell_v1_0_php_php_c99php_1_c2007_php_php_c100_php", + "multiple_php_webshells_2", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_1_SpecialShell_99_php_php", + "_r577_php_php_r57_php_php_spy_php_php_s_php_php", + "_nixrem_php_php_c99shell_v1_0_php_php_c99php_NIX_REMOTE_WEB_SHELL_v_0_5_alpha_Lite_Public_Version_php", + "DarkSecurityTeam_Webshell", + "PHP_Cloaked_Webshell_SuperFetchExec", + "WebShell_RemExp_asp_php", + "WebShell_dC3_Security_Crew_Shell_PRiV", + "WebShell_simattacker", + "WebShell_DTool_Pro", + "WebShell_IronShell_4", + "WebShell_indexer_asp_php", + "WebShell_toolaspshell", + "WebShell_b374k_mini_shell_php_php", + "WebShell_Sincap_1_0", + "WebShell_b374k_php", + "WebShell_SimAttacker___Vrsion_1_0_0___priv8_4_My_friend", + "WEBSHELL_H4ntu_Shell_Powered_Tsoi_2", + "WebShell_php_webshells_MyShell", + "WebShell_php_webshells_pws", + "WebShell_reader_asp_php", + "WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_3", + "WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_2", + "WebShell_PHP_Backdoor_2", + "WebShell_Worse_Linux_Shell_2", + "WebShell_php_webshells_pHpINJ", + "WebShell_php_webshells_NGH", + "WebShell_php_webshells_matamu", + "WebShell_ru24_post_sh", + "WebShell_hiddens_shell_v1", + "WebShell_c99_madnet", + "WebShell_c99_locus7s", + "WebShell_JspWebshell_1_2", + "WebShell_safe0ver", + "WebShell_Uploader", + "WebShell_php_webshells_kral", + "WebShell_cgitelnet", + "WebShell_simple_backdoor_2", + "WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_2", + "WebShell_NTDaddy_v1_9", + "WebShell_lamashell", + "WebShell_Simple_PHP_backdoor_by_DK", + "WebShell_Moroccan_Spamers_Ma_EditioN_By_GhOsT", + "WebShell_C99madShell_v__2_0_madnet_edition", + "WebShell_CmdAsp_asp_php", + "WebShell_NCC_Shell", + "WebShell_php_webshells_README", + "WebShell_backupsql", + "WebShell_AK_74_Security_Team_Web_Shell_Beta_Version", + "WebShell_php_webshells_cpanel", + "WebShell_accept_language", + "WebShell_php_webshells_529", + "WebShell_STNC_WebShell_v0_8", + "WebShell_php_webshells_tryag", + "WebShell_dC3_Security_Crew_Shell_PRiV_2", + "WebShell_qsd_php_backdoor", + "WebShell_php_webshells_spygrup", + "WebShell_Web_shell__c_ShAnKaR", + "WebShell_Ayyildiz_Tim___AYT__Shell_v_2_1_Biz", + "WebShell_Gamma_Web_Shell", + "WebShell_php_webshells_aspydrv", + "WebShell_JspWebshell_1_2_2", + "WebShell_g00nshell_v1_3", + "WebShell_WinX_Shell_2", + "WebShell_PHANTASMA", + "WebShell_php_webshells_cw", + "WebShell_php_include_w_shell", + "WebShell_mysql_tool", + "WebShell_PhpSpy_Ver_2006", + "WebShell_ZyklonShell", + "WebShell_php_webshells_myshell_2", + "WebShell_php_webshells_lolipop", + "WebShell_simple_cmd", + "WebShell_go_shell", + "WebShell_aZRaiLPhp_v1_0_2", + "WebShell_webshells_zehir4", + "WebShell_zehir4_asp_php", + "WebShell_php_webshells_lostDC", + "WebShell_CasuS_1_5", + "WebShell_ftpsearch", + "WebShell__Cyber_Shell_cybershell_Cyber_Shell__v_1_0_", + "WebShell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_soldierofallah", + "WebShell_Generic_PHP_7", + "WebShell__Small_Web_Shell_by_ZaCo_small_zaco_zacosmall", + "WebShell_Generic_PHP_8", + "WebShell__PH_Vayv_PHVayv_PH_Vayv_klasvayv_asp_php", + "WebShell_Generic_PHP_9", + "WebShell__PH_Vayv_PHVayv_PH_Vayv", + "WebShell_Generic_PHP_1", + "WebShell_Generic_PHP_2", + "WebShell__CrystalShell_v_1_erne_stres", + "WebShell_Generic_PHP_3", + "WebShell_Generic_PHP_4", + "WebShell_GFS", + "WebShell__CrystalShell_v_1_sosyete_stres", + "WebShell_Generic_PHP_10", + "WebShell_Generic_PHP_11", + "WebShell__findsock_php_findsock_shell_php_reverse_shell", + "WebShell_Generic_PHP_6", + "Unpack_Injectt", + "HYTop_DevPack_fso", + "FeliksPack3___PHP_Shells_ssh", + "Debug_BDoor", + "bin_Client", + "ZXshell2_0_rar_Folder_ZXshell", + "RkNTLoad", + "binder2_binder2", + "thelast_orice2", + "FSO_s_sincap", + "PhpShell", + "HYTop_DevPack_config", + "sendmail", + "FSO_s_zehir4", + "hkshell_hkshell", + "iMHaPFtp", + "Unpack_TBack", + "DarkSpy105", + "EditServer_EXE", + "FSO_s_reader", + "ASP_CmdAsp", + "KA_uShell", + "PHP_Backdoor_v1", + "svchostdll", + "HYTop_DevPack_server", + "vanquish", + "winshell", + "FSO_s_remview", + "saphpshell", + "HYTop2006_rar_Folder_2006Z", + "admin_ad", + "FSO_s_casus15", + "BIN_Client", + "shelltools_g0t_root_uptime", + "Simple_PHP_BackDooR", + "sig_2005Gray", + "DllInjection", + "Mithril_v1_45_Mithril", + "hkshell_hkrmv", + "WEBSHELL_PHP_1", + "FSO_s_cmd", + "FeliksPack3___PHP_Shells_phpft", + "FSO_s_indexer", + "r57shell", + "bdcli100", + "HYTop_DevPack_2005Red", + "HYTop2006_rar_Folder_2006X2", + "rdrbs084", + "HYTop_CaseSwitch_2005", + "eBayId_index3", + "FSO_s_phvayv", + "byshell063_ntboot", + "FSO_s_casus15_2", + "installer", + "FSO_s_remview_2", + "FeliksPack3___PHP_Shells_r57", + "HYTop2006_rar_Folder_2006X", + "FSO_s_phvayv_2", + "elmaliseker", + "shelltools_g0t_root_resolve", + "FSO_s_RemExp", + "FSO_s_tool", + "FeliksPack3___PHP_Shells_2005", + "byloader", + "shelltools_g0t_root_Fport", + "BackDooR__fr_", + "FSO_s_ntdaddy", + "nstview_nstview", + "HYTop_DevPack_upload", + "PasswordReminder", + "Pack_InjectT", + "FSO_s_RemExp_2", + "FSO_s_c99", + "rknt_zip_Folder_RkNT", + "dbgntboot", + "PHP_shell", + "hxdef100", + "rdrbs100", + "Mithril_Mithril", + "hxdef100_2", + "Release_dllTest", + "webadmin", + "commands", + "hkdoordll", + "r57shell_2", + "Mithril_v1_45_dllTest", + "dbgiis6cli", + "remview_2003_04_22", + "FSO_s_test", + "Debug_cress", + "webshell", + "FSO_s_EFSO_2", + "thelast_index3", + "adjustcr", + "FeliksPack3___PHP_Shells_xIShell", + "HYTop_AppPack_2005", + "xssshell", + "FeliksPack3___PHP_Shells_usr", + "FSO_s_phpinj", + "xssshell_db", + "PHP_sh", + "xssshell_default", + "EditServer_2", + "by064cli", + "Mithril_dllTest", + "peek_a_boo", + "fmlibraryv3", + "Debug_dllTest_2", + "connector", + "shelltools_g0t_root_HideRun", + "PHP_Shell_v1_7", + "xssshell_save", + "screencap", + "FSO_s_phpinj_2", + "ZXshell2_0_rar_Folder_zxrecv", + "FSO_s_ajan", + "c99shell", + "phpspy_2005_full", + "FSO_s_zehir4_2", + "FSO_s_indexer_2", + "HYTop_DevPack_2005", + "_root_040_zip_Folder_deploy", + "by063cli", + "icyfox007v1_10_rar_Folder_asp", + "byshell063_ntboot_2", + "u_uay", + "bin_wuaus", + "pwreveal", + "shelltools_g0t_root_xwhois", + "vanquish_2", + "down_rar_Folder_down", + "cmdShell", + "ZXshell2_0_rar_Folder_nc", + "portlessinst", + "SetupBDoor", + "phpshell_3", + "BIN_Server", + "HYTop2006_rar_Folder_2006", + "r57shell_3", + "HDConfig", + "FSO_s_ajan_2", + "Webshell_and_Exploit_CN_APT_HK", + "JSP_Browser_APT_webshell", + "JSP_jfigueiredo_APT_webshell", + "JSP_jfigueiredo_APT_webshell_2", + "Webshell_Insomnia", + "HawkEye_PHP_Panel", + "SoakSoak_Infected_Wordpress", + "Pastebin_Webshell", + "ASPXspy2", + "Webshell_27_9_c66_c99", + "Webshell_acid_AntiSecShell_3", + "Webshell_c99_4", + "Webshell_r57shell_2", + "Webshell_27_9_acid_c99_locus7s", + "Webshell_Backdoor_PHP_Agent_r57_mod_bizzz_shell_r57", + "Webshell_c100", + "Webshell_AcidPoison", + "Webshell_acid_FaTaLisTiCz_Fx_fx_p0isoN_sh3ll_x0rg_byp4ss_256", + "Webshell_Ayyildiz", + "Webshell_zehir", + "UploadShell_98038f1efa4203432349badabad76d44337319a6", + "DKShell_f0772be3c95802a2d1e7a4a3f5a45dcdef6997f3", + "Unknown_8af033424f9590a15472a23cc3236e68070b952e", + "DkShell_4000bd83451f0d8501a9dfad60dce39e55ae167d", + "WebShell_5786d7d9f4b0df731d79ed927fb5a124195fc901", + "webshell_e8eaf8da94012e866e51547cd63bb996379690bf", + "Unknown_0f06c5d1b32f4994c3b3abf8bb76d5468f105167", + "WSOShell_0bbebaf46f87718caba581163d4beed56ddf73a7", + "WebShell_Generic_1609_A", + "Nishang_Webshell", + "PHP_Webshell_1_Feb17", + "Webshell_Tiny_JSP_2", + "Wordpress_Config_Webshell_Preprend", + "PAS_Webshell_Encoded", + "ALFA_SHELL", + "Webshell_FOPO_Obfuscation_APT_ON_Nov17_1", + "WebShell_JexBoss_JSP_1", + "WebShell_JexBoss_WAR_1", + "webshell_tinyasp", + "WEBSHELL_ASPX_Mar21_1" + ], + "count": 624, + "enabled_in_log_scanner": false, + "reason": "Rules depend on whole-file byte/offset/string conditions or non-NetScaler platforms. Use their original YARA semantics on acquired files/images; generic PHP content hunting is separately adapted and attributed." + } + ], + "excluded_patterns": [ + { + "id": "mandiant_log_scrubbing", + "pattern": "(?is)(?:crontab|/etc/crontab|sed).*(?:/vpn/scripts/linux|httpaccess|/vpn/media)", + "description": "Candidate installer log/crontab cleanup.", + "caveat": "Broad contextual rule: require delete/filter/write operation and adjacent installation artifacts.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "correlation": null, + "reason": "Generic sed/crontab/path co-occurrence does not establish deletion; use a compound cleanup rule instead." + }, + { + "id": "levelblue_customsnmpd", + "pattern": "(?is)(?:write|open|>|python|kill).*?/var/python/bin/customsnmpd", + "description": "Unexpected replacement or execution of customsnmpd may indicate reverse-shell implant.", + "caveat": "File path alone is legitimate; validate modified content and connection to reported callback.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", + "correlation": null, + "reason": "Generic operation and legitimate component path are insufficient; file-content/network corroboration required." + } + ], + "excluded_observables": [ + { + "type": "literal", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.112 Safari/537.36", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "python3 -c", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "base64.b85decode", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "base64.b64decode", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "zlib.decompress", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "touch -t", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "apachectl graceful", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "1245184", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "\"nsroot\", \"actions\":", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "/nf/auth/doDialogue.do", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "sha256", + "value": "60a9b62d59f1e025b9d1b413ec7c926dbe02134d82e8dea902fcb087c2d81879", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "a5366bdf12ecdd7ff4c87d34ec238717b0c1864598ace0fbd94a5f73f151060f", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "747d21f81f78d55435bc3857cc201f716979f3422d91427ae1355deda1826b5e", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "ee4203c88bd3de082bc67f1de694d93edca795e1106f9f1dbe2e891b3873f83c", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "8fc91bd3436bc6f958ba2f2897956fb3a24c068f55008adb01f3cb32869fec20", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "735e1b0e6ac42ea647198836ec1da79043342596806f83b24584abe79e437405", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "4ff2bdcc36c70c2a8cf298a8b92dc536a14e3fe655aa6de3ac9c1eafb27b4ac4", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "e0898d41e8c5e0b3b4174307be81ad908c23b3b11180083f4252e5b06d8e23b1", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "847d7fc0724470578d4ef8548a2b0eedef54da9ea61c964986e32ae74d90de73", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "10a1acb645b3a4a7cbc1135088429ac3214643facc3f3c783c909446c4142379", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "e1076b3642968044149abe2aabcf681dd22bf3dfb6c1d144f8f3f32a2f12b422", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "77417011220bf8e1d1e51d26c780875cbc51593275ff4080d73bb1da2016fbbb", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "2c1310d7c4d7dfb1ef47b137be1eb572cc743cc609898ae38320963cc0578665", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "source": "ncsc-nl-2025", + "rule": "NCSCNL_CitrixIncident2025_ropchain", + "reason": "Binary wildcard byte sequence requires core-memory YARA; not truthfully equivalent to line-oriented Sigma." + } + ], + "limitations": [ + "Reference matches do not prove local compromise. Shared infrastructure and testing markers require context.", + "Unavailable registered collections and undisclosed vendor rules are not reproduced.", + "Public reports describe attempts and successful intrusions separately; preserve original role and confidence." + ] +} diff --git a/examples/rules.json b/examples/rules.json new file mode 100644 index 0000000..a3ad4fd --- /dev/null +++ b/examples/rules.json @@ -0,0 +1,17 @@ +{ + "sources": [ + {"id": "synthetic_example", "title": "Documentation examples, not threat intelligence"} + ], + "patterns": [ + { + "id": "example_download_command", + "pattern": "(?i)\\b(?:curl|wget)\\s+https?://", + "description": "A download command appears in the log. Check its destination, arguments and execution evidence; legitimate administration can match.", + "source": "synthetic_example" + } + ], + "indicators": [ + {"type": "ipv4", "value": "192.0.2.42", "status": "reference_only", "source": "synthetic_example"}, + {"type": "domain", "value": "triage-demo.example.invalid", "status": "reference_only", "source": "synthetic_example"} + ] +} diff --git a/examples/rules.yml b/examples/rules.yml new file mode 100644 index 0000000..2ccb014 --- /dev/null +++ b/examples/rules.yml @@ -0,0 +1,23 @@ +title: NetScaler Encoded Diagnostic Command In Request Context +id: 34bd2f41-877e-4e16-91a5-4aeb62dddc21 +name: example_decoded_diagnostic_command +status: experimental +description: >- + Synthetic example matching a decoded identity command in an HTTP request. + A match does not prove execution and authorized diagnostics can match. +author: NetScaler Triage contributors +references: + - https://sigmahq.io/sigma-specification/specification/sigma-rules-specification.html +logsource: + product: netscaler + service: http_access +detection: + selection: + uri|startswith: /vpn/ + raw|re: '^id$' + excluded: + uri|contains: /health + condition: selection and not excluded +falsepositives: + - Authorized security tests and administrative diagnostics. +level: low diff --git a/examples/time.json b/examples/time.json new file mode 100644 index 0000000..74cfc58 --- /dev/null +++ b/examples/time.json @@ -0,0 +1,5 @@ +{ + "year": 2026, + "timezones": {"ADC-A": "UTC"}, + "file_years": {"ADC-A/messages.previous": 2025} +} diff --git a/pyproject.toml b/pyproject.toml new file mode 100644 index 0000000..8b6ae25 --- /dev/null +++ b/pyproject.toml @@ -0,0 +1,60 @@ +[build-system] +requires = ["hatchling>=1.27"] +build-backend = "hatchling.build" + +[project] +name = "netscaler-triage" +version = "1.0.0" +description = "Offline NetScaler evidence analysis with inspectable decoding and provenance" +readme = "README.md" +license = "MIT" +license-files = ["LICENSE.txt"] +requires-python = ">=3.14" +dependencies = [ + "py7zr>=1.0", + "regex>=2025.11", + "tzdata>=2025.2", + "rich>=14.1", + "rich-argparse>=1.7", + "pyzipper>=0.3.6", + "pysigma>=1.5.1", +] + +[project.scripts] +netscaler-triage = "netscaler_triage.cli:main" + +[tool.hatch.build.targets.wheel] +packages = ["src/netscaler_triage"] + +[tool.hatch.build.targets.sdist] +include = ["src/", "tests/", "typing_stubs/", "examples/", "config/threat_intel.json", "README.md", "README.txt", "RULES.txt", "VALIDATION.txt", "THREAT_INTELLIGENCE.txt", "LICENSE.txt", "uv.lock", ".python-version", ".gitignore", "pyproject.toml"] + +[dependency-groups] +dev = [ + "mypy>=2.3.1", + "ruff>=0.14", + "types-pyyaml>=6.0.12.20260906", + "types-regex>=2026.9.10.20260911", +] + +[tool.ruff] +line-length = 100 +target-version = "py314" + +[tool.ruff.lint] +select = ["E", "F", "I", "UP", "B", "SIM", "RUF", "PERF"] + +[tool.mypy] +strict = true +warn_unreachable = true +mypy_path = "typing_stubs" +python_version = "3.14" +files = ["src", "tests"] +check_untyped_defs = true +disallow_untyped_defs = true +warn_return_any = true +warn_unused_ignores = true +warn_redundant_casts = true +strict_equality = true +no_implicit_optional = true +pretty = true diff --git a/src/netscaler_triage/__init__.py b/src/netscaler_triage/__init__.py new file mode 100644 index 0000000..3c4785b --- /dev/null +++ b/src/netscaler_triage/__init__.py @@ -0,0 +1,3 @@ +"""Offline analysis; no discovered payload is ever executed.""" + +__version__ = "1.0.0" diff --git a/src/netscaler_triage/__main__.py b/src/netscaler_triage/__main__.py new file mode 100644 index 0000000..eb53e2f --- /dev/null +++ b/src/netscaler_triage/__main__.py @@ -0,0 +1,3 @@ +from .cli import main + +raise SystemExit(main()) diff --git a/src/netscaler_triage/cli.py b/src/netscaler_triage/cli.py new file mode 100644 index 0000000..03e798d --- /dev/null +++ b/src/netscaler_triage/cli.py @@ -0,0 +1,457 @@ +"""CLI for evidence preparation, search, safe decoding and IOC extraction.""" + +from __future__ import annotations + +import argparse +import getpass +import json +import os +import sys +from datetime import UTC, datetime +from pathlib import Path +from typing import Any, Never +from uuid import uuid4 + +from rich.console import Console +from rich.panel import Panel +from rich.table import Table +from rich.text import Text +from rich_argparse import ArgumentDefaultsRichHelpFormatter + +from .config_loading import ConfigError, load_config, load_configs +from .decoding import decode_layers +from .engine import dump, scan, validate_output +from .indicators import extract_indicators +from .ingest import extract_archive, inventory +from .preparation import PreparationEntry, prepare_inputs + + +class Parser(argparse.ArgumentParser): + """Consistent rich help and actionable argument errors for every subcommand.""" + + def __init__(self, *args: Any, **kwargs: Any) -> None: + kwargs.setdefault("formatter_class", ArgumentDefaultsRichHelpFormatter) + super().__init__(*args, **kwargs) + + def error(self, message: str) -> Never: + Console(stderr=True).print( + Panel(Text(message), title="Invalid arguments", border_style="red") + ) + self.exit(2, f"Run '{self.prog} --help' for options and examples.\n") + + +def display_result(result: object, json_output: bool = False) -> None: + """Keep redirected stdout machine-readable; format interactive summaries with Rich.""" + console = Console() + if json_output or not console.is_terminal: + print(json.dumps(result, ensure_ascii=False, indent=2)) + elif isinstance(result, dict) and "counts" in result: + table = Table(title="NetScaler triage results", header_style="bold cyan") + table.add_column("Metric") + table.add_column("Value", justify="right") + for key in ("status", "files", "duration_seconds", "integrity"): + table.add_row(key.replace("_", " ").title(), Text(str(result.get(key, "unknown")))) + for key, value in result["counts"].items(): + table.add_row(key.replace("_", " ").title(), str(value)) + console.print(table) + console.print( + "Use --json for all fields. Review summary.json for coverage and warnings.", style="dim" + ) + else: + console.print_json(data=result, ensure_ascii=False) + + +def assignment(value: str) -> tuple[str, str]: + name, separator, target = value.partition("=") + if not separator or not name or not target or "/" in name or "\\" in name: + raise argparse.ArgumentTypeError("Expected NAME=VALUE with a unique appliance name") + return name, target + + +def fresh_destination(parent: Path, label: str) -> Path: + """Choose a new sibling directory without placing results inside evidence.""" + stamp = datetime.now(UTC).strftime("%Y%m%d-%H%M%S") + return parent / f"{label}-{stamp}-{uuid4().hex[:6]}" + + +def main(argv: list[str] | None = None) -> int: + argv = list(sys.argv[1:] if argv is None else argv) + if not argv: + argv = ["scan"] + elif argv[0] not in { + "scan", + "extract", + "decode", + "indicators", + "inventory", + "rules", + "--help", + "-h", + }: + argv.insert(0, "scan") + advanced_help = "--help-all" in argv + parser = Parser( + description=( + "Offline NetScaler triage: search logs, inspect decoding and trace " + "evidence without executing payloads." + ), + epilog=( + "Quick start: netscaler-triage logs.7z | netscaler-triage ./logs | " + "netscaler-triage (current folder). Add --password for a hidden " + "password prompt. Use scan --help-all for advanced options." + ), + ) + commands = parser.add_subparsers(dest="command", required=True) + scan_parser = commands.add_parser( + "scan", help="Search multiple appliance log directories with patterns and indicators" + ) + scan_parser.add_argument( + "folders", + nargs="*", + type=Path, + metavar="LOG_FOLDER", + help="Log folders or archives; omit to use the current directory", + ) + scan_parser.add_argument( + "--input", action="append", type=assignment, default=[], metavar="NAME=DIRECTORY" + ) + scan_parser.add_argument("--output", type=Path) + scan_parser.add_argument( + "--config", + action="append", + type=Path, + default=[], + metavar="FILE_OR_DIRECTORY", + help="Explicit rule file or directory of packs (recursive); repeat to combine", + ) + scan_parser.add_argument("--pattern", action="append", default=[]) + scan_parser.add_argument("--ioc-file", action="append", type=Path, default=[]) + scan_parser.add_argument( + "--time-config", + type=Path, + help="JSON configuration with timezones, year and per-file year overrides", + ) + scan_parser.add_argument("--timezone", action="append", type=assignment, default=[]) + scan_parser.add_argument("--year", type=int) + scan_parser.add_argument("--no-default-patterns", action="store_true") + scan_parser.add_argument( + "--extract-all", + action="store_true", + help="Store every record and its extracted observable candidates", + ) + scan_parser.add_argument("--regex-timeout", type=float, default=0.05) + scan_parser.add_argument("--window", type=int, default=120) + scan_parser.add_argument("--max-line-bytes", type=int, default=1048576) + scan_parser.add_argument("--max-file-bytes", type=int, default=536870912) + scan_parser.add_argument("--max-bytes", type=int, default=2147483648) + scan_parser.add_argument("--max-files", type=int, default=100000) + scan_parser.add_argument("--max-depth", type=int, default=3) + scan_parser.add_argument( + "--password", + nargs="?", + const=True, + help="Archive password; omit its value for a hidden prompt", + ) + extract = commands.add_parser( + "extract", help="Safely extract a 7z, ZIP or TAR archive into a new directory" + ) + extract.add_argument("source", type=Path) + extract.add_argument("destination", type=Path, nargs="?") + extract.add_argument("--max-bytes", type=int, default=2147483648) + extract.add_argument("--max-files", type=int, default=100000) + extract.add_argument("--max-depth", type=int, default=3) + extract.add_argument( + "--password", + nargs="?", + const=True, + help="Archive password; omit its value for a hidden prompt", + ) + for name in ("decode", "indicators"): + sub = commands.add_parser( + name, help="Inspect a UTF-8 file: decode safely or extract observable candidates" + ) + sub.add_argument("file", type=Path) + sub.add_argument("--max-bytes", type=int, default=1048576) + rules_parser = commands.add_parser( + "rules", help="Validate and compile selected rule packs without scanning logs" + ) + rules_parser.add_argument( + "--config", + action="append", + type=Path, + default=[], + metavar="FILE_OR_DIRECTORY", + help="Explicit rule file or directory; repeat to combine packs", + ) + rules_parser.add_argument("--no-default-patterns", action="store_true") + rules_parser.add_argument("--regex-timeout", type=float, default=0.05) + inv = commands.add_parser( + "inventory", help="Create a SHA-256 inventory with paths relative to the input root" + ) + inv.add_argument("root", type=Path) + descriptions = { + "input": "Appliance name and log directory; repeat for multiple appliances", + "output": "Where to save results; by default, create a new folder beside the logs", + "config": "Sigma YAML, JSON rules or legacy CSV; repeat to combine rule packs", + "pattern": "Additional regular expression; repeat to add patterns", + "ioc_file": "Indicator JSON/CSV or a text file with one literal per line", + "timezone": "NAME=IANA_ZONE, for example ADC=Europe/Berlin; repeat per appliance", + "year": "Explicit year assumption for timestamps without a year", + "no_default_patterns": ( + "Disable built-in patterns and bundled public IOCs; keep update detection" + ), + "regex_timeout": "Maximum seconds per regex search before aborting", + "window": "Maximum time gap in seconds for correlation candidates", + "max_line_bytes": "Maximum expanded bytes per log line", + "max_file_bytes": "Maximum expanded bytes per log file", + "source": "Source archive; originals are never overwritten", + "destination": "Optional new directory; by default, create one beside the archive", + "max_bytes": "Maximum input or total extracted bytes", + "max_files": "Maximum archive entries across nested archives", + "max_depth": "Maximum nested archive depth", + "file": "UTF-8 input file to inspect without executing its contents", + "root": "Log directory to inventory recursively", + } + examples = { + "scan": ( + "Example: netscaler-triage scan ./logs\nBuilt-in patterns, safe " + "decoding, update detection and correlation run automatically. Missing " + "timestamp information is left unknown, not guessed." + ), + "extract": "Example: netscaler-triage extract logs.7z", + "decode": "Example: netscaler-triage decode payload.txt --json", + "indicators": "Example: netscaler-triage indicators payload.txt --json", + "rules": "Example: netscaler-triage rules --config ./my-rules --json", + "inventory": "Example: netscaler-triage inventory logs --json", + } + for name, subparser in commands.choices.items(): + subparser.epilog = examples[name] + for action in subparser._actions: + if action.help is None: + action.help = descriptions.get(action.dest) + subparser.add_argument( + "--json", + action="store_true", + help="Emit plain JSON, including in an interactive terminal", + ) + subparser.add_argument("--help-all", action="help", help="Show all advanced options") + if not advanced_help: + visible = { + "help", + "help_all", + "folders", + "output", + "pattern", + "config", + "ioc_file", + "source", + "destination", + "file", + "root", + "password", + } + for action in subparser._actions: + if action.dest not in visible: + action.help = argparse.SUPPRESS + args = parser.parse_args(argv) + result: object + try: + if args.command == "rules": + from .matching import Matcher + + configs = load_configs(args.config) + try: + matcher = Matcher( + configs, timeout=args.regex_timeout, defaults=not args.no_default_patterns + ) + except (ValueError, TypeError) as exc: + raise ConfigError(f"Rule validation failed: {exc}") from exc + result = { + "status": "valid", + "selected_pack_files": len(configs), + "defaults_enabled": not args.no_default_patterns, + "sigma_rules": sum(len(pack.rules) for pack in matcher.sigma_matchers), + "regex_rules": len(matcher.rules), + "explicit_active_indicators": sum( + row.get("type") != "regex" for row in matcher.indicators + ), + } + display_result(result, args.json) + return 0 + if args.command == "scan": + inputs = [(name, Path(path)) for name, path in args.input] + inputs.extend((path.resolve().name, path) for path in args.folders) + if not inputs: + inputs = [(Path.cwd().name, Path.cwd())] + if args.input and len({name for name, _ in inputs}) != len(inputs): + scan_parser.error( + "Folders have matching appliance names. Use --input NAME=DIRECTORY to " + "give each a unique name." + ) + if args.output is None: + try: + shared = Path(os.path.commonpath([path.resolve() for _, path in inputs])) + output_parent = shared.parent + except ValueError: + # Inputs on different Windows drives have no common parent. + output_parent = Path.cwd() + args.output = fresh_destination(output_parent, "triage-results") + validate_output(args.output, [(str(i), path) for i, (_, path) in enumerate(inputs)]) + configs = load_configs(args.config + args.ioc_file) + configs.append( + { + "patterns": [ + {"id": f"custom_{i}", "pattern": p} for i, p in enumerate(args.pattern) + ] + } + ) + times = load_config(args.time_config) if args.time_config else {} + password = ( + getpass.getpass("Archive password: ") if args.password is True else args.password + ) + prepared = None + preparation_manifest: list[PreparationEntry] = [] + # Keep explicit named directory inputs compatible with established forensic runs. + if args.folders or not args.input or any(not path.is_dir() for _, path in inputs): + if args.output.exists(): + raise FileExistsError("Output already exists") + args.output.parent.mkdir(parents=True, exist_ok=True) + prepared = fresh_destination(args.output.parent, ".triage-preparation") + inputs, preparation_manifest = prepare_inputs( + [path for _, path in inputs], + prepared, + password=password, + max_bytes=args.max_bytes, + max_files=args.max_files, + max_depth=args.max_depth, + ) + try: + result = scan( + inputs, + args.output, + configs, + year=args.year if args.year is not None else times.get("year"), + timezones={**times.get("timezones", {}), **dict(args.timezone)}, + file_years=times.get("file_years", {}), + defaults=not args.no_default_patterns, + extract_all=args.extract_all, + regex_timeout=args.regex_timeout, + window=args.window, + max_line_bytes=args.max_line_bytes, + max_file_bytes=args.max_file_bytes, + ) + finally: + if prepared is not None and args.output.is_dir(): + roots = [ + { + "appliance": name, + "path": "inputs/" + path.relative_to(prepared).as_posix(), + } + for name, path in inputs + ] + prepared.rename(args.output / "inputs") + with (args.output / "preparation_manifest.json").open( + "x", encoding="utf-8" + ) as handle: + json.dump( + {"roots": roots, "entries": preparation_manifest}, + handle, + ensure_ascii=False, + indent=2, + ) + preparation_errors = [ + entry for entry in preparation_manifest if entry.get("action") == "error" + ] + if preparation_errors: + result["status"] = "partial" + result["counts"]["preparation_errors"] = len(preparation_errors) + result["preparation_errors"] = preparation_errors + result["integrity"] = "not_fully_verified" + dump(args.output / "summary.json", result) + Console(stderr=True).print( + Text( + f"Preparation incomplete: {len(preparation_errors)} input error(s). " + "Readable inputs were analyzed; review preparation_manifest.json.", + style="yellow", + ) + ) + display_result(result, args.json) + Console(stderr=True).print(Text(f"Results saved to: {os.path.relpath(args.output)}")) + return 0 if result["status"] == "complete" else 2 + if args.command == "extract": + if args.destination is None: + args.destination = fresh_destination(args.source.resolve().parent, "extracted-logs") + manifest = args.destination.with_name(args.destination.name + ".manifest.json") + if manifest.exists() or manifest.is_symlink(): + raise ValueError("Extraction manifest already exists") + result = extract_archive( + args.source, + args.destination, + args.max_bytes, + args.max_files, + args.max_depth, + password=getpass.getpass("Archive password: ") + if args.password is True + else args.password, + ) + with manifest.open("x", encoding="utf-8") as handle: + json.dump(result, handle, ensure_ascii=False, indent=2) + Console(stderr=True).print( + Text(f"Logs extracted to: {os.path.relpath(args.destination)}") + ) + elif args.command == "inventory": + result = inventory(args.root) + else: + if args.max_bytes < 1: + raise ValueError("The size limit must be positive") + with args.file.open("rb") as handle: + data = handle.read(args.max_bytes + 1) + if len(data) > args.max_bytes: + raise ValueError("Input exceeds the size limit") + value = data.decode("utf-8") + result = ( + decode_layers(value, max_bytes=args.max_bytes) + if args.command == "decode" + else extract_indicators(value) + ) + display_result(result, args.json) + return 0 + except Exception as exc: + # No machine-specific paths or payload content in error output. + hints = { + "FileNotFoundError": "Check that the input file or directory exists.", + "FileExistsError": ( + "Choose a new output directory; existing evidence is never overwritten." + ), + "PermissionError": "Check read access to inputs and write access to the output parent.", + "TimeoutError": ( + "A search exceeded its time limit. Simplify the pattern or adjust --regex-timeout." + ), + "UnicodeDecodeError": ( + "This command expects UTF-8 text. Keep the original and supply a text export." + ), + "JSONDecodeError": "Check the configuration file for valid JSON.", + } + message = ( + str(exc) + if isinstance(exc, ConfigError) + else hints.get( + type(exc).__name__, "Check input formats, configuration and size limits." + ) + ) + Console(stderr=True).print( + Panel( + Text( + f"{type(exc).__name__}: {message}\n" + "If an output directory was created, inspect summary.json.\n" + "Run the command with --help for usage." + ), + title="Unable to complete the command", + border_style="red", + ) + ) + return 2 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/src/netscaler_triage/config_loading.py b/src/netscaler_triage/config_loading.py new file mode 100644 index 0000000..f5b8608 --- /dev/null +++ b/src/netscaler_triage/config_loading.py @@ -0,0 +1,195 @@ +"""Explicit, bounded loading of local rule files and directories.""" + +from __future__ import annotations + +import csv +import io +import ipaddress +import json +import os +import re +import stat +from pathlib import Path +from typing import Any + + +class ConfigError(ValueError): + """A configuration error with a filename-only user-facing explanation.""" + + +SUPPORTED_SUFFIXES = frozenset({".json", ".csv", ".txt", ".yaml", ".yml"}) +MAX_CONFIG_FILES = 64 +MAX_CONFIG_BYTES = 16 * 1024 * 1024 +MAX_TOTAL_BYTES = 32 * 1024 * 1024 +_SKIP_DOCUMENTS = frozenset({"readme.txt", "license.txt", "changelog.txt"}) +_SKIP_DIRECTORIES = frozenset({"__pycache__", "node_modules"}) + + +def _error_reason(exc: Exception) -> str: + if isinstance(exc, OSError): + return exc.strerror or type(exc).__name__ + return str(exc) + + +def _read_file(path: Path) -> bytes: + if path.is_symlink(): + raise ConfigError(f"Rule pack symlinks are not supported: {path.name}") + if not stat.S_ISREG(path.stat().st_mode): + raise ConfigError(f"Rule pack must be a regular file: {path.name}") + limit = 4 * 1024 * 1024 if path.suffix.lower() in {".yaml", ".yml"} else MAX_CONFIG_BYTES + with path.open("rb") as handle: + data = handle.read(limit + 1) + if len(data) > limit: + raise ConfigError(f"Rule pack exceeds {limit // (1024 * 1024)} MiB: {path.name}") + return data + + +def _text_indicator_type(value: str) -> str: + try: + address = ipaddress.ip_address(value) + except ValueError: + pass + else: + return "ipv4" if address.version == 4 else "ipv6" + if re.fullmatch(r"[a-fA-F0-9]{64}", value): + return "sha256" + if value.startswith(("http://", "https://")) and not any(c.isspace() for c in value): + return "url" + if value.startswith("/") and not any(c.isspace() for c in value): + return "path" + return "literal" + + +def _parse_config(path: Path, raw: bytes, source: str) -> dict[str, Any]: + text = raw.decode("utf-8-sig") + suffix = path.suffix.lower() + if suffix in {".yaml", ".yml"}: + return {"sigma_rules": [{"source": source, "yaml": text}]} + if suffix == ".json": + data = json.loads(text) + if isinstance(data, list): + return {"patterns": data} + if not isinstance(data, dict): + raise ConfigError("Configuration must be a JSON object or pattern list") + return dict(data) + if suffix == ".csv": + reader = csv.DictReader(io.StringIO(text, newline="")) + if not reader.fieldnames: + raise ConfigError("CSV rule pack has no header") + rows: list[dict[str, Any]] = [] + for row in reader: + if None in row or any(value is None for value in row.values()): + raise ConfigError(f"CSV column count mismatch at line {reader.line_num}") + rows.append(dict(row)) + if "Muster" in reader.fieldnames: + return { + "patterns": [ + {**row, "id": row.get("ID") or f"row_{index}", "pattern": row["Muster"]} + for index, row in enumerate(rows, 2) + ] + } + if not set(reader.fieldnames) & {"value", "indicator", "ip"}: + raise ConfigError("IOC CSV requires a value, indicator or ip column") + return { + "indicators": [ + { + **row, + "type": row.get("type") or row.get("indicator_type") or "literal", + "value": row.get("value") or row.get("indicator") or row.get("ip") or "", + "status": row.get("status") or "reference_only", + } + for row in rows + ] + } + if suffix != ".txt": + raise ConfigError(f"Unsupported rule pack format: {path.suffix or '(no extension)'}") + return { + "indicators": [ + { + "type": _text_indicator_type(line.strip()), + "value": line.strip(), + "status": "reference_only", + } + for line in text.splitlines() + if line.strip() and not line.lstrip().startswith("#") + ] + } + + +def load_config(path: Path) -> dict[str, Any]: + """Load one explicit pack; preserve additional CSV provenance columns.""" + try: + return _parse_config(path, _read_file(path), path.name) + except (OSError, UnicodeError, ValueError, csv.Error) as exc: + raise ConfigError(f"Cannot load rule pack {path.name}: {_error_reason(exc)}") from exc + + +def load_configs(paths: list[Path]) -> list[dict[str, Any]]: + """Expand explicitly requested folders deterministically, with shared quotas.""" + selected: list[tuple[Path, str]] = [] + seen: set[Path] = set() + visited = 0 + + def add(path: Path, source: str) -> None: + if path.is_symlink(): + raise ConfigError(f"Rule pack symlinks are not supported: {path.name}") + canonical = path.resolve() + if canonical in seen: + return + if len(selected) >= MAX_CONFIG_FILES: + raise ConfigError(f"Rule pack selection exceeds {MAX_CONFIG_FILES} files") + seen.add(canonical) + selected.append((path, source)) + + for path in paths: + if path.is_symlink(): + raise ConfigError(f"Rule pack symlinks are not supported: {path.name}") + if not path.is_dir(): + add(path, path.name) + continue + before = len(selected) + + def walk_error(error: OSError, directory: Path = path) -> None: + raise ConfigError( + f"Cannot read rule directory {directory.name}: {_error_reason(error)}" + ) from error + + for root, directories, filenames in os.walk(path, followlinks=False, onerror=walk_error): + relative = Path(root).relative_to(path) + if len(relative.parts) > 32: + raise ConfigError(f"Rule directory nesting exceeds 32 levels: {path.name}") + visited += 1 + if visited > 4096: + raise ConfigError("Rule directory selection exceeds 4096 directories") + directories[:] = sorted( + name + for name in directories + if not name.startswith(".") and name not in _SKIP_DIRECTORIES + ) + for name in directories: + if (Path(root) / name).is_symlink(): + raise ConfigError(f"Rule directory symlinks are not supported: {name}") + for name in sorted(filenames): + child = Path(root) / name + if ( + name.startswith(".") + or name.casefold() in _SKIP_DOCUMENTS + or child.suffix.lower() not in SUPPORTED_SUFFIXES + ): + continue + add(child, child.relative_to(path).as_posix()) + selected[before:] = sorted(selected[before:], key=lambda entry: entry[1]) + if len(selected) == before and not any(path.resolve() in p.parents for p in seen): + raise ConfigError(f"No supported rule packs found in directory: {path.name}") + total = 0 + configs = [] + for path, source in selected: + try: + raw = _read_file(path) + total += len(raw) + if total > MAX_TOTAL_BYTES: + raise ConfigError("Combined rule packs exceed 32 MiB") + configs.append(_parse_config(path, raw, source)) + except (OSError, UnicodeError, ValueError, csv.Error) as exc: + raise ConfigError(f"Cannot load rule pack {path.name}: {_error_reason(exc)}") from exc + return configs diff --git a/src/netscaler_triage/correlation.py b/src/netscaler_triage/correlation.py new file mode 100644 index 0000000..bcbe962 --- /dev/null +++ b/src/netscaler_triage/correlation.py @@ -0,0 +1,92 @@ +"""Bounded exact-key, cross-log temporal candidates, never proof of causation.""" + +import math +import sqlite3 +from datetime import UTC, datetime +from typing import Any + + +def correlate_database( + connection: sqlite3.Connection, window_seconds: float = 120, max_links: int = 100000 +) -> dict[str, Any]: + """Write correlations using existing events and event_keys tables. + + Per event/key, select only the nearest preceding event in a different log + on the same appliance. Source means the original relative log filename. + Naive timestamps cannot support a UTC comparison and are skipped. + """ + if not math.isfinite(window_seconds) or window_seconds < 0 or max_links < 1: + raise ValueError("invalid correlation limits") + connection.execute("""CREATE TABLE IF NOT EXISTS correlations ( + left_id INTEGER NOT NULL, right_id INTEGER NOT NULL, + key_type TEXT NOT NULL, key_value TEXT NOT NULL, + delta_seconds REAL NOT NULL, basis TEXT NOT NULL, + UNIQUE(left_id,right_id,key_type,key_value))""") + connection.execute("DELETE FROM correlations") + summary: dict[str, Any] = dict( + links=0, + groups=0, + keys_examined=0, + invalid_time_keys=0, + invalid_source_keys=0, + history_evictions=0, + groups_with_evictions=0, + truncated=False, + window_seconds=window_seconds, + max_links=max_links, + basis="Temporal candidates sharing an exact key; not evidence of causation or execution.", + ) + current_group = None + latest: dict[str, tuple[float, int]] = {} + group_evicted = False + rows = connection.execute("""SELECT k.event_id,k.appliance,k.key_type,k.key_value, + k.timestamp,e.source FROM event_keys k JOIN events e ON e.id=k.event_id + WHERE k.appliance=e.appliance AND k.key_value IS NOT NULL AND k.key_value<>'' + ORDER BY k.appliance,k.key_type,k.key_value,julianday(k.timestamp),k.event_id""") + for event_id, appliance, key_type, key_value, stamp, source in rows: + summary["keys_examined"] += 1 + group = appliance, key_type, key_value + if group != current_group: + current_group, latest, group_evicted = group, {}, False + summary["groups"] += 1 + if not source: + summary["invalid_source_keys"] += 1 + continue + try: + timestamp = datetime.fromisoformat(stamp.replace("Z", "+00:00")) + if timestamp.utcoffset() is None: + raise ValueError("timezone missing") + seconds = timestamp.astimezone(UTC).timestamp() + except AttributeError, ValueError, OverflowError, TypeError: + summary["invalid_time_keys"] += 1 + continue + latest = {s: p for s, p in latest.items() if 0 <= seconds - p[0] <= window_seconds} + candidates = [p for s, p in latest.items() if s != source and p[1] != event_id] + if candidates: + prior_seconds, prior_id = max(candidates) + if summary["links"] >= max_links: + summary["truncated"] = True + break + strong = key_type.lower() in {"transaction", "transaction_id", "session", "session_id"} + basis = ( + "Candidate: matching transaction/session identifier and temporal proximity; " + if strong + else "Candidate: matching search key and temporal proximity; " + ) + basis += "same appliance, different log files; causation and execution remain unproven." + result = connection.execute( + "INSERT OR IGNORE INTO correlations VALUES (?,?,?,?,?,?)", + (prior_id, event_id, key_type, key_value, seconds - prior_seconds, basis), + ) + summary["links"] += result.rowcount + latest[source] = seconds, event_id + # ponytail: retain at most 128 log sources per key; eviction is reported, never hidden. + if len(latest) > 128: + oldest = min(latest, key=lambda s: latest[s]) + del latest[oldest] + summary["history_evictions"] += 1 + if not group_evicted: + summary["groups_with_evictions"] += 1 + group_evicted = True + summary["incomplete"] = summary["truncated"] or bool(summary["history_evictions"]) + return summary diff --git a/src/netscaler_triage/data/public_sigma.yml b/src/netscaler_triage/data/public_sigma.yml new file mode 100644 index 0000000..1f838c2 --- /dev/null +++ b/src/netscaler_triage/data/public_sigma.yml @@ -0,0 +1,13164 @@ +title: NetScaler Log Poisoning +id: db5aa260-5141-5e4b-91a4-a7883d81a9a4 +name: log_poisoning +status: experimental +description: Process-monitor text contains shell metacharacters; inspect for log poisoning or injected command text. + This does not prove execution. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +detection: + selection: + raw|re: (?i)pitboss.*(?:NSPPE|PPE).*(?:unexpectedly died|missed too many heartbeats).*?(?:[;`|]|\$\{) + condition: selection +indicator_status: behavior_pattern +references: [] +source: [] +observations: [] +origin: + provenance_type: locally_authored_generic_heuristic + scope_not_campaign_specific: true + description: Inherited local triage heuristic. External observations attached separately provide supporting context, + not a claim of original derivation. +--- +title: NetScaler Engine Crash +id: 0390ae7b-c88e-5b57-afa4-dc2575ee1d66 +name: engine_crash +status: experimental +description: A process or accelerator failure is logged. Correlate with requests and restart records; a crash alone + does not establish exploitation. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +detection: + selection: + raw|re: (?i)(?:^|\s)pitboss(?:\[\d+\])?:.*(?:NOT restarting|core dumped|unexpectedly died)|qat\d+:.*orphan rings + condition: selection +indicator_status: behavior_pattern +references: [] +source: [] +observations: [] +origin: + provenance_type: locally_authored_generic_heuristic + scope_not_campaign_specific: true + description: Inherited local triage heuristic. External observations attached separately provide supporting context, + not a claim of original derivation. +--- +title: NetScaler Dtls Error +id: 5cb2d3c3-bb26-581e-be5a-3594b3aec4f7 +name: dtls_error +status: experimental +description: A DTLS handshake internal error is present. This is a diagnostic signal, not proof of a successful + attack. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +detection: + selection: + raw|re: (?i)DTLSv1\.0.*handshake failure.internal error + condition: selection +indicator_status: behavior_pattern +references: [] +source: [] +observations: [] +origin: + provenance_type: locally_authored_generic_heuristic + scope_not_campaign_specific: true + description: Inherited local triage heuristic. External observations attached separately provide supporting context, + not a claim of original derivation. +--- +title: NetScaler Command Injection +id: 2f64329b-edfa-5d35-9711-186f4860e6ef +name: command_injection +status: experimental +description: Command-download or injection syntax, including diagnostic command probes against PHP routes under + /vpn/ or /logon/. Requests, blocked probes and authorized testing are not evidence of execution. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +detection: + selection: + raw|re: (?i)(?:curl|wget)\s.*(?:https?://|\$\{IFS\})|b64decode|\$\{IFS\}|(?:;|`)(?:id|hostname|sleep)\b|/(?:vpn|logon)/[^\s?"<>]*\.php\?(?:0|x|cmd|exec|command)=(?:echo[ + \t]+[^\r\n&;|<>]{1,128}|id|date)(?:[ \t]*&&[ \t]*(?:date|id))*(?:[ \t]*$|[ \t]*[)"<>]|[ \t]+HTTP/) + condition: selection or (php_request and decoded_probe) + php_request: + uri|re: (?i)/(?:vpn|logon)/[^\s?"<>]*\.php\? + decoded_probe: + raw|re: (?i)(?:^|[?&](?:0|x|cmd|exec|command)=)(?:echo[ \t]+[^\r\n&;|<>]{1,128}|id|date)(?:[ \t]*&&[ \t]*(?:date|id))*(?:[ + \t]*$|[ \t]*[)"<>]|[ \t]+HTTP/) +indicator_status: behavior_pattern +references: [] +source: [] +observations: [] +origin: + provenance_type: locally_authored_generic_heuristic + scope_not_campaign_specific: true + description: Inherited local triage heuristic. External observations attached separately provide supporting context, + not a claim of original derivation. +--- +title: NetScaler Php Execution +id: 85769f76-e95b-5b33-bb3f-295709f4eaf3 +name: php_execution +status: experimental +description: PHP source or execution/decoding functions appear in the text. Inspect the complete payload and file + evidence; a text match does not establish server-side execution. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +detection: + selection: + raw|re: (?i)<\?php|(?:passthru|shell_exec|base64_decode)\s*\( + condition: selection +indicator_status: behavior_pattern +references: [] +source: [] +observations: [] +origin: + provenance_type: locally_authored_generic_heuristic + scope_not_campaign_specific: true + description: Inherited local triage heuristic. External observations attached separately provide supporting context, + not a claim of original derivation. +--- +title: NetScaler Privilege Persistence +id: 9d719506-517e-50fb-9675-48d2907c8733 +name: privilege_persistence +status: experimental +description: The text references permission changes, executable web handlers, SSH keys, or account creation. Verify + authorization and actual state changes before attributing persistence. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +detection: + selection: + raw|re: (?i)chmod\s+(?:[467][0-7]{3}|u\+s).*?/bin/sh|AddHandler.*php|AliasMatch|authorized_keys|add system user + condition: selection +indicator_status: behavior_pattern +references: +- https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances +source: +- mandiant +observations: +- id: mandiant_suid_shell + description: Sets privileged shell permissions. + caveat: Actual execution/filesystem state is stronger than command appearing in an injected username. + correlation: null + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + matching: pattern + mapped_from: mandiant_suid_shell +origin: + provenance_type: locally_authored_generic_heuristic + scope_not_campaign_specific: true + description: Inherited local triage heuristic. External observations attached separately provide supporting context, + not a claim of original derivation. +--- +title: NetScaler Traversal +id: e39745df-f20d-5ecb-831a-1c848b265a4d +name: traversal +status: experimental +description: The text references traversal syntax or commonly probed sensitive paths. Check response content and + related events; the request alone does not prove disclosure. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +detection: + selection: + raw|re: (?i)/(?:vpn|vpns)/\.\./|/etc/passwd|/\.git/|/\.env(?:\s|\?)|Path traversal detected[ \t]*\|/|/cgi-bin/(?:\.\./)+ + condition: selection +indicator_status: behavior_pattern +references: [] +source: [] +observations: [] +origin: + provenance_type: locally_authored_generic_heuristic + scope_not_campaign_specific: true + description: Inherited local triage heuristic. External observations attached separately provide supporting context, + not a claim of original derivation. +--- +title: NetScaler Encoded User Agent +id: d90f1337-428b-5156-adaf-3cba3906c11c +name: encoded_user_agent +status: experimental +description: A quoted marker and Base64-shaped value were found. Review bounded decoding results; this pattern alone + does not establish a malicious payload. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +detection: + selection: + raw|re: (?i)(?:"(?:INDEX|[A-Za-z0-9]{1,12}):[A-Za-z0-9+/]{32,}={0,2}"|User-Agent[^\r\n]*(?:INDEX|C2|3P|4B):?[A-Za-z0-9+/]{40,}) + condition: selection +indicator_status: behavior_pattern +references: +- https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771 +- https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ +source: +- cert-eu +- unit42 +observations: +- id: cert_staged_index + description: Base64 staging marker in HTTP User-Agent. + caveat: Decode offline; marker alone is staging, not execution. + correlation: null + source_ids: + - cert-eu + source_urls: + - https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771 + matching: pattern + mapped_from: cert_staged_index +- id: unit42_variable_stage_marker + description: Observed short staging prefixes vary; candidate must occur in User-Agent and decode to code. + caveat: Low-specificity without HTTP field context; do not match arbitrary text alone. + correlation: null + source_ids: + - unit42 + source_urls: + - https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ + matching: pattern + mapped_from: unit42_variable_stage_marker +origin: + provenance_type: locally_authored_generic_heuristic + scope_not_campaign_specific: true + description: Inherited local triage heuristic. External observations attached separately provide supporting context, + not a claim of original derivation. +--- +title: NetScaler Ti Dtls Internal Error +id: f2b2bc2b-d781-56e6-a464-5731efb85c10 +name: ti_dtls_internal_error +status: experimental +description: DTLS error; insufficient on its own to establish code execution. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +source: +- CERTFR-2026-ALE-011 +- mandiant +references: +- https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/ +- https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances +detection: + selection: + raw|re: (?i)SSL_HANDSHAKE_FAILURE.*DTLSv1\.0.*Handshake failure-Internal Error + condition: selection +indicator_status: behavior_pattern +observations: +- id: mandiant_dtls_crash + description: DTLS failure associated with observed exploitation. + caveat: An isolated handshake failure is not conclusive. + correlation: Correlate qat orphan rings and NSPPE pitboss termination on same appliance in a short interval. + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + matching: pattern + mapped_from: mandiant_dtls_crash +- id: certfr_dtls_handshake + description: Joint DTLS/cipher/internal-error log pattern; contextual lead, not standalone success verdict. + status: reference_only + published: '2026-09-30' + retrieved: '2026-10-01' + use_or_omission_reason: Map to existing Google-derived detection; add secondary provenance rather than duplicate + a rule. No ANSSI independent qualification. + source_ids: + - CERTFR-2026-ALE-011 + source_urls: + - https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/ + matching: pattern + mapped_from: certfr_dtls_handshake +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Ti Nsppe Orphan +id: 5aef80fe-3a2a-5f9e-b109-7d768d0a8f23 +name: ti_nsppe_orphan +status: experimental +description: Process termination indicator. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +source: +- CERTFR-2026-ALE-011 +- mandiant +references: +- https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/ +- https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances +detection: + selection: + raw|re: (?i)NSPPE-\d+.*exit with orphan rings + condition: selection +indicator_status: behavior_pattern +observations: +- id: mandiant_qat_orphans + description: NSPPE abnormal exit signal paired with DTLS failure. + caveat: Crashes have benign causes. + correlation: null + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + matching: pattern + mapped_from: mandiant_qat_orphans +- id: certfr_nsppe_orphan + description: Packet-engine orphan-ring message; correlate with nearby restart suppression and other evidence. + status: reference_only + published: '2026-09-30' + retrieved: '2026-10-01' + use_or_omission_reason: Map to existing Google-derived detection; add secondary provenance rather than duplicate + a rule. No ANSSI independent qualification. + source_ids: + - CERTFR-2026-ALE-011 + source_urls: + - https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/ + matching: pattern + mapped_from: certfr_nsppe_orphan +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Ti Nsppe Not Restart +id: 35bc541e-25f4-5d4b-80e4-b22f2e9ff801 +name: ti_nsppe_not_restart +status: experimental +description: Indicator that a process was not restarted. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +source: +- CERTFR-2026-ALE-011 +- mandiant +references: +- https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/ +- https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances +detection: + selection: + raw|re: (?i)pitboss.*NOT restarting NSPPE + condition: selection +indicator_status: behavior_pattern +observations: +- id: certfr_pitboss_restart + description: Restart suppression message; preserve PID/device/time and correlate, allowing benign crash context. + status: reference_only + published: '2026-09-30' + retrieved: '2026-10-01' + use_or_omission_reason: Map to existing Google-derived detection; add secondary provenance rather than duplicate + a rule. No ANSSI independent qualification. + source_ids: + - CERTFR-2026-ALE-011 + source_urls: + - https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/ + matching: pattern + mapped_from: certfr_pitboss_restart +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Ti Shell Headers +id: f2336666-9fca-5688-93b7-bf4fa85e082e +name: ti_shell_headers +status: experimental +description: Header hunting pattern. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +source: +- mandiant +references: +- https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances +detection: + selection: + raw|re: (?i)(?:HTTP_)?(?:NSC[-_]LDAP|NSC[-_]CLIENTTYPE|X[-_]UX(?:[-_]\d+)?) + condition: selection +indicator_status: behavior_pattern +observations: +- id: mandiant_header_transport + description: Header channels used by reported PHP implants. + caveat: Header name is contextual; require encoded payload, suspicious route or implant evidence. + correlation: null + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + matching: pattern + mapped_from: mandiant_header_transport +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Ti Php Handler +id: 2fe32158-28e3-5512-8640-f713c7f6d2c0 +name: ti_php_handler +status: experimental +description: PHP handler mapped to a non-PHP artifact extension such as .deb or .sig. Ordinary .php/.phps mappings + alone do not match; verify whether this is a requested change or an actual configuration change. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +source: +- mandiant +- sygnia +references: +- https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances +- https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ +detection: + selection: + raw|re: (?i)Add(?:Handler|Type)\s+[^\r\n]*application/x-httpd-php(?:-source)?\s+(?:\.[A-Za-z0-9]+[ \t]+)*\.(?:deb|sig|ico|css|js|png|gif|jpg)\b + condition: selection +indicator_status: behavior_pattern +observations: +- id: mandiant_nonphp_handler + description: PHP handler registration for non-PHP extension. + caveat: Validate appliance configuration baseline. + correlation: null + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + matching: pattern + mapped_from: mandiant_nonphp_handler +- id: sygnia-php-handlers + description: PHP handler mapping for disguised file extensions. + status: experimental + confidence: medium + source_ids: + - sygnia + source_urls: + - https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ + matching: pattern + mapped_from: sygnia-php-handlers +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Ti Staged Webshell +id: 3aa3db2c-e2c7-583d-9203-e96833e5b5c2 +name: ti_staged_webshell +status: experimental +description: Path pattern for webshell hunting. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +source: +- mandiant +references: +- https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances +detection: + selection: + raw|re: (?i)/vpn/scripts/linux/(?:nsginstaller[^\s/?]*\.deb|nsgclient[^\s/?]*\.(?:deb|sig)|[^\s/?]+\.php) + condition: selection +indicator_status: behavior_pattern +observations: +- id: mandiant_staging_paths + description: Published staging path patterns; .deb directory also contains legitimate packages. + caveat: Review context and actual execution separately. + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + matching: pattern + mapped_from: mandiant_staging_paths +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Ti Log Poisoning +id: 3ec17436-eb51-5768-9b72-aece3b7d907a +name: ti_log_poisoning +status: experimental +description: Potentially manipulated text; establish subsequent processing independently. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +source: +- cert-eu +- sygnia +- watchtowr +- watchtowr-repo +references: +- https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771 +- https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 +- https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ +- https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ +detection: + selection: + raw|re: (?i)pitboss[^\r\n]*(?:NSPPE|PPE)[^\r\n]*(?:;|`|\$\{?IFS\}?|%3b|%60|%24%28) + condition: selection +indicator_status: behavior_pattern +observations: +- id: cert_log_poisoning + description: Authentication data imitates a crash line and appends commands. + caveat: Failed authentication does not rule out later execution. + correlation: 'Same appliance: staged access-log marker, poisoned auth event, ns_monuploadd_err.pl invocation, + then side effects.' + source_ids: + - cert-eu + source_urls: + - https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771 + matching: pattern + mapped_from: cert_log_poisoning +- id: sygnia-pitboss-command + description: Crash-like authentication text with command delimiter; injection attempt, not proof of execution. + status: experimental + confidence: medium + source_ids: + - sygnia + source_urls: + - https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ + matching: pattern + mapped_from: sygnia-pitboss-command +- id: watchtowr_crash_injection + description: Crash-like text followed by command syntax, including the public artifact-generator form. + confidence: low + caveat: Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence. + source_ids: + - watchtowr + - watchtowr-repo + source_urls: + - https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 + - https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ + matching: pattern + mapped_from: watchtowr_crash_injection +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Ti Delayed Processor +id: 324d542c-d00d-5ee9-be43-7f6e44d30afa +name: ti_delayed_processor +status: experimental +description: Indicator of possible subsequent processing. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +source: +- watchtowr +references: +- https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ +detection: + selection: + raw|re: (?i)ns_monuploadd_err\.pl + condition: selection +indicator_status: behavior_pattern +observations: [] +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Ti Css Journal +id: db27552c-3c30-5a99-9e82-7ec76c7ba3cd +name: ti_css_journal +status: experimental +description: CSS disguise and journal artifact pattern. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized security testing, legitimate administration, and unrelated text may match. Validate the original event + and surrounding evidence. +level: low +source: +- levelblue +references: +- https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators +detection: + selection: + raw|re: (?i)LogonUISimple\.html\.style(?:\.[a-f0-9]+)?\.min\.css|\.local_journal + condition: selection +indicator_status: behavior_pattern +observations: +- id: levelblue_local_journal_alias + description: Reported .local_journal masquerading route. + caveat: CSS names may overlap legitimate assets; require PHP alias/content corroboration. + correlation: null + source_ids: + - levelblue + source_urls: + - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators + matching: pattern + mapped_from: levelblue_local_journal_alias +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Unit42 Cookie Execution +id: 623305d2-16b6-5710-adc8-b762522af1be +name: unit42_cookie_execution +status: experimental +description: Paired implant cookies; NSC_TASS carries URL-encoded command. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?is)(?:CsrfToken.*NSC_TASS|NSC_TASS.*CsrfToken) + condition: selection +indicator_status: behavior_pattern +references: +- https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ +source: +- unit42 +observations: +- id: unit42_cookie_execution + description: Paired implant cookies; NSC_TASS carries URL-encoded command. + caveat: Legitimate cookie names alone are insufficient; decode value and examine destination/response. + correlation: null + source_ids: + - unit42 + source_urls: + - https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ + matching: pattern + mapped_from: unit42_cookie_execution +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Unit42 Receiver Alias +id: 48774954-8559-562c-902a-2ba8a75f2e2c +name: unit42_receiver_alias +status: experimental +description: CSS-disguised webshell route. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?i)/logon/LogonPoint/custom/receiver\.min(?:\.[0-9a-f]+)?\.css + condition: selection +indicator_status: behavior_pattern +references: +- https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json +- https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ +source: +- ifin-event +- unit42 +observations: +- id: unit42_receiver_alias + description: CSS-disguised webshell route. + caveat: Confirm alias or shell content; request alone does not prove execution. + correlation: null + source_ids: + - unit42 + source_urls: + - https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ + matching: pattern + mapped_from: unit42_receiver_alias +- id: ifin-css-hex-alias + description: Community-reported alias pattern; verify context. + status: experimental + confidence: medium + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + matching: pattern + mapped_from: ifin-css-hex-alias +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Unit42 Anomalous Getusername +id: 31940357-e53f-57f8-b908-9599b0913fd2 +name: unit42_anomalous_getusername +status: experimental +description: Repeated pre-disclosure activity to anomalous endpoint. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: /logon/LogonPoint/Authentication/GetUserName + condition: selection +indicator_status: behavior_pattern +references: +- https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ +source: +- unit42 +observations: +- id: unit42_anomalous_getusername + description: Repeated pre-disclosure activity to anomalous endpoint. + caveat: Investigative signal; no standalone exploitation conclusion. + correlation: null + source_ids: + - unit42 + source_urls: + - https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ + matching: pattern + mapped_from: unit42_anomalous_getusername +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Mandiant Slapshot Launch +id: 86c468d2-0afc-5eb2-9070-62a4d0f0ba42 +name: mandiant_slapshot_launch +status: experimental +description: Detached encoded Python tunneler launch with hidden IPC files. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?is)nohup\s+python.*base64.*\.uxdport.*\.uxdlock + condition: selection +indicator_status: behavior_pattern +references: +- https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances +source: +- mandiant +observations: +- id: mandiant_slapshot_launch + description: Detached encoded Python tunneler launch with hidden IPC files. + caveat: Do not execute the decoded code. + correlation: null + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + matching: pattern + mapped_from: mandiant_slapshot_launch +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Mandiant Fato Webshell +id: 5614e015-a1e0-5c80-bce4-f20f3e689a50 +name: mandiant_fato_webshell +status: experimental +description: PHP implant framing markers. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?is).* + condition: selection +indicator_status: behavior_pattern +references: +- https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances +source: +- mandiant +observations: +- id: mandiant_fato_webshell + description: PHP implant framing markers. + caveat: Combine with NSC header parsing and dynamic execution; markup alone insufficient. + correlation: null + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + matching: pattern + mapped_from: mandiant_fato_webshell +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Esentire Php Useragent +id: a5f6d8e8-e170-5aae-a7a2-710beac8ee28 +name: esentire_php_useragent +status: experimental +description: Icon request followed by encoded PHP staging in User-Agent. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?i)/vpn/media/[^\s"?]+\.ico.*PD9[A-Za-z0-9+/]{20,} + condition: selection +indicator_status: behavior_pattern +references: +- https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772 +source: +- esentire +observations: +- id: esentire_php_useragent + description: Icon request followed by encoded PHP staging in User-Agent. + caveat: HTTP404 is expected for both unsuccessful staging and active stealth webshell responses. + correlation: Correlate poisoned auth event, script invocation, changed handlers/files and outbound/lateral traffic. + source_ids: + - esentire + source_urls: + - https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772 + matching: pattern + mapped_from: esentire_php_useragent +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Levelblue Backtick Poisoning +id: 11c3813f-894b-51f6-80fb-d7dab0c0e8dd +name: levelblue_backtick_poisoning +status: experimental +description: Backtick substitution variant can avoid semicolon-only detections. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?i)pitboss.*NSPPE.*`.*(?:tar|curl|wget|cat).*`.*unexpectedly died + condition: selection +indicator_status: behavior_pattern +references: +- https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators +source: +- levelblue +observations: +- id: levelblue_backtick_poisoning + description: Backtick substitution variant can avoid semicolon-only detections. + caveat: '' + correlation: null + source_ids: + - levelblue + source_urls: + - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators + matching: pattern + mapped_from: levelblue_backtick_poisoning +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Levelblue Config Staging +id: 5907a6d1-0c74-5eae-9e9b-588c0bab859d +name: levelblue_config_staging +status: experimental +description: Copies or archives configuration into web-accessible files. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?is)(?:cat|cp|tar).*?/flash/nsconfig.*(?:>|/var/netscaler/logon)|(?:tar|cat).*?/var/netscaler/logon.*?/flash/nsconfig + condition: selection +indicator_status: behavior_pattern +references: +- https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators +source: +- levelblue +observations: +- id: levelblue_config_staging + description: Copies or archives configuration into web-accessible files. + caveat: Validate command execution and HTTP retrieval or network exfiltration. + correlation: null + source_ids: + - levelblue + source_urls: + - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators + matching: pattern + mapped_from: levelblue_config_staging +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Mandiant Icon Route +id: 052a9870-fe4b-5b43-8261-5e523636590b +name: mandiant_icon_route +status: experimental +description: Icon-to-signature PHP routing persistence. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?i)AliasMatch.*?/vpn/media/.*?/var/netscaler/gui/vpn/scripts/linux/.*?\.sig + condition: selection +indicator_status: behavior_pattern +references: +- https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances +source: +- mandiant +observations: +- id: mandiant_icon_route + description: Icon-to-signature PHP routing persistence. + caveat: Review context and actual execution separately. + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + matching: pattern + mapped_from: mandiant_icon_route +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Mandiant Php Execution +id: 79c6ea05-8efd-51b4-8fd2-79613054863d +name: mandiant_php_execution +status: experimental +description: Header parsing combined with encoded dynamic PHP execution; inspect full file when statements occur + across lines. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?is)(?:HTTP_)?NSC_(?:LDAP|CLIENTTYPE|USER|NONCE|FT_HIDE).*?(?:eval|shell_exec|passthru|system).*?base64_decode + condition: selection +indicator_status: behavior_pattern +references: +- https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances +source: +- mandiant +observations: +- id: mandiant_php_execution + description: Header parsing combined with encoded dynamic PHP execution; inspect full file when statements occur + across lines. + caveat: Review context and actual execution separately. + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + matching: pattern + mapped_from: mandiant_php_execution +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Aw Resource Prefix 1 +id: 985490ff-cbe4-50e7-b4a9-f962543255af +name: aw-resource-prefix-1 +status: experimental +description: Incomplete dynamic or redacted URL prefix; not exact IOC. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: http://89\.44\.80\.7:65456/ + condition: selection +indicator_status: behavior_pattern +references: +- https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md +source: +- arctic-wolf +observations: +- id: aw-resource-prefix-1 + description: Incomplete dynamic or redacted URL prefix; not exact IOC. + status: experimental + confidence: medium + original_value: hxxp://89.44.80[.]7:65456/$(id|base64 -w0) + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + matching: pattern + mapped_from: aw-resource-prefix-1 +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Aw Resource Prefix 2 +id: 7ff4a684-f5e1-50b6-b543-ba30ae52818c +name: aw-resource-prefix-2 +status: experimental +description: Incomplete dynamic or redacted URL prefix; not exact IOC. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: http://130\.94\.42\.226:18805/\?t= + condition: selection +indicator_status: behavior_pattern +references: +- https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md +source: +- arctic-wolf +observations: +- id: aw-resource-prefix-2 + description: Incomplete dynamic or redacted URL prefix; not exact IOC. + status: experimental + confidence: medium + original_value: hxxp://130.94.42[.]226:18805/?t= + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + matching: pattern + mapped_from: aw-resource-prefix-2 +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Aw Nsmon Cron +id: 6bb4bd57-96bf-5bf5-b2b2-36ce721d4902 +name: aw-nsmon-cron +status: experimental +description: Root cron invokes reported hidden Perl implant every five minutes. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?i)\*/5\s+\*\s+\*\s+\*\s+\*\s+root\s+perl\s+/var/tmp/\.nsmon/nsmon\.pl + condition: selection +indicator_status: behavior_pattern +references: +- https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md +source: +- arctic-wolf +observations: +- id: aw-nsmon-cron + description: Root cron invokes reported hidden Perl implant every five minutes. + status: experimental + confidence: medium + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + matching: pattern + mapped_from: aw-nsmon-cron +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Aw Encoded Command Output +id: 7f6eb722-0be4-581f-bed5-10d8d3b26247 +name: aw-encoded-command-output +status: experimental +description: Identity output encoding; corroborate HTTP callback before declaring exfiltration. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?i)\bid\s*\|\s*base64\s+-w\s*0 + condition: selection +indicator_status: behavior_pattern +references: +- https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md +source: +- arctic-wolf +observations: +- id: aw-encoded-command-output + description: Identity output encoding; corroborate HTTP callback before declaring exfiltration. + status: experimental + confidence: medium + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + matching: pattern + mapped_from: aw-encoded-command-output +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Rapid7 Tar Config +id: 156c151e-13b0-5dd7-a22c-07bdb4af9327 +name: rapid7-tar-config +status: experimental +description: Configuration archive staged under web root; command presence is not proof of execution. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?i)\btar(?:\$\{?IFS\}?|\s)+czf.*?/var/netscaler/gui/vpn/c\b.*?(?:/flash|nsconfig) + condition: selection +indicator_status: behavior_pattern +references: +- https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/ +source: +- rapid7 +observations: +- id: rapid7-tar-config + description: Configuration archive staged under web root; command presence is not proof of execution. + status: experimental + confidence: medium + original_command: tar${IFS}czf$IFS/var/netscaler/gui/vpn/c$IFS-C$IFS/flash${IFS}nsconfig + normalized_command: tar czf /var/netscaler/gui/vpn/c -C /flash nsconfig + source_ids: + - rapid7 + source_urls: + - https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/ + matching: pattern + mapped_from: rapid7-tar-config +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Sygnia Encoded Loader +id: 9fb8bb55-fb55-535a-9b4c-6344f8b08bfe +name: sygnia-encoded-loader +status: experimental +description: Heuristic encoded HTTP-log loader chain; decode payload and check context. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?im)^(?=.*(?:pitboss|NSPPE))(?=.*(?:base64|PD9))(?=.*(?:2N|httpaccess)) + condition: selection +indicator_status: behavior_pattern +references: +- https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ +source: +- sygnia +observations: +- id: sygnia-encoded-loader + description: Heuristic encoded HTTP-log loader chain; decode payload and check context. + status: experimental + confidence: medium + source_ids: + - sygnia + source_urls: + - https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ + matching: pattern + mapped_from: sygnia-encoded-loader +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Elastic Inspired Crash Shell +id: a0f728c2-6c21-50e7-9909-ae5df3b77538 +name: elastic-inspired-crash-shell +status: experimental +description: 'Independently derived raw-log heuristic: crash-like text and shell syntax. Broader than original field-scoped + EQL.' +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: "(?im)^(?=.*pitboss)(?:(?=.*(?:nsppe|\\bppe\\b|core))|(?=(?>.*?packet).*engine))(?=.*(?:;|`|\\$\\(|&&|\\|\\||%3b|%60|%7c|%24%28|%26%26|%3e|%3c))" + condition: selection +indicator_status: behavior_pattern +references: +- https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml +source: +- elastic-toml +observations: +- id: elastic-inspired-crash-shell + description: 'Independently derived raw-log heuristic: crash-like text and shell syntax. Broader than original + field-scoped EQL.' + status: experimental + confidence: medium + license_note: Original Elastic License v2; source rule not copied into product. + source_ids: + - elastic-toml + source_urls: + - https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml + matching: pattern + mapped_from: elastic-inspired-crash-shell +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Aw Platypus Install Prefix +id: 0a8f1d34-83bb-5ade-bfc8-1bd45f221a27 +name: aw-platypus-install-prefix +status: experimental +description: Redacted installer URL prefix; no redacted token treated as exact IOC. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: https://entretiensol\.com:443/api/v1/install/ + condition: selection +indicator_status: behavior_pattern +references: +- https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md +source: +- arctic-wolf +observations: +- id: aw-platypus-install-prefix + description: Redacted installer URL prefix; no redacted token treated as exact IOC. + status: experimental + confidence: medium + original_value: hxxps://entretiensol[.]com:443/api/v1/install/ + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + matching: pattern + mapped_from: aw-platypus-install-prefix +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Historical Startup Obfuscation +id: 742a1576-1923-58ce-801a-813820e41169 +name: historical_startup_obfuscation +status: experimental +description: Historical reversed persistence strings; correlate with startup/configuration modifications. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?i)fnoc\.dptth|php\.(?:xedni|xednimt|IUnogoL)|hs/pmt/rav/|tnioPnogoL|gifnocsn|relacsten\.cr + condition: selection +indicator_status: behavior_pattern +references: +- https://github.com/NCSC-NL/citrix-2025 +- https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh +source: +- deyda-script +- ncsc-nl-2025 +observations: +- id: historical_startup_obfuscation + description: Historical reversed persistence strings; correlate with startup/configuration modifications. + confidence: low + caveat: Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence. + source_ids: + - deyda-script + - ncsc-nl-2025 + source_urls: + - https://github.com/NCSC-NL/citrix-2025 + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + matching: pattern + mapped_from: historical_startup_obfuscation +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Php Input Execution +id: 3fafb627-665f-5caa-9a4b-229086449433 +name: php_input_execution +status: experimental +description: PHP text with input evaluation or decoding; adapted content heuristic, not image metadata validation. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?is)<\?(?:php)?[^\r\n]*(?:eval\s*\(\s*\$_|(?:base64_decode|passthru|shell_exec|array_filter)\s*\() + condition: selection +indicator_status: behavior_pattern +references: +- https://github.com/NCSC-NL/citrix-2025 +- https://github.com/fox-it/citrix-netscaler-triage +source: +- fox-it +- ncsc-nl-2025 +observations: +- id: php_input_execution + description: PHP text with input evaluation or decoding; adapted content heuristic, not image metadata validation. + confidence: low + caveat: Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence. + source_ids: + - fox-it + - ncsc-nl-2025 + source_urls: + - https://github.com/NCSC-NL/citrix-2025 + - https://github.com/fox-it/citrix-netscaler-triage + matching: pattern + mapped_from: php_input_execution +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Persistence Target Write +id: b72b1566-d05a-5fca-8cb4-229fcb59cc95 +name: persistence_target_write +status: experimental +description: Command text writes or edits startup targets; compare approved configuration. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?i)(?:\b(?:echo|printf|cp|mv|sed|tee)\b[^\r\n]*)(?:rc\.netscaler|nsafter\.sh|/etc/rc\.conf\.defaults) + condition: selection +indicator_status: behavior_pattern +references: +- https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker +- https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh +source: +- deyda-script +- poppelgaard +observations: +- id: persistence_target_write + description: Command text writes or edits startup targets; compare approved configuration. + confidence: low + caveat: Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence. + source_ids: + - deyda-script + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + matching: pattern + mapped_from: persistence_target_write +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Setuid Temporary Shell +id: 67e7c3f5-d648-516e-97fc-79ceb36453fb +name: setuid_temporary_shell +status: experimental +description: Command text sets privileged permissions on a shell; corroborate actual file mode. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?i)chmod\s+(?:[ugoa]*\+s|[4567][0-7]{3})\s+(?:/var/tmp/sh|/bin/sh) + condition: selection +indicator_status: behavior_pattern +references: +- https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh +source: +- deyda-script +observations: +- id: setuid_temporary_shell + description: Command text sets privileged permissions on a shell; corroborate actual file mode. + confidence: low + caveat: Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence. + source_ids: + - deyda-script + source_urls: + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + matching: pattern + mapped_from: setuid_temporary_shell +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Trace Removal +id: 5fbd05f0-df10-513d-acfc-e856fa90dd70 +name: trace_removal +status: experimental +description: Log/core deletion or truncation command text; maintenance may be legitimate. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?i)(?:\brm\s+(?:-[A-Za-z]+\s+)*|\btruncate\s+[^\r\n]*|/dev/null\s*>\s*)(?:/var/(?:log|nslog|core)/|[^\r\n]*\.log\b) + condition: selection +indicator_status: behavior_pattern +references: +- https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker +source: +- poppelgaard +observations: +- id: trace_removal + description: Log/core deletion or truncation command text; maintenance may be legitimate. + confidence: low + caveat: Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence. + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + matching: pattern + mapped_from: trace_removal +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +title: NetScaler Community Credential Access +id: 83dd2ce5-c181-534b-b8b4-0b58dd9501d5 +name: community_credential_access +status: experimental +description: Credential/key access command context; legitimate administration can match. +author: NetScaler Triage contributors +logsource: + product: netscaler +falsepositives: +- Authorized tests, quoted threat intelligence, and benign administration may match. Validate raw evidence and execution + separately. +level: low +detection: + selection: + raw|re: (?i)(?:\b(?:cat|cp|tar|openssl|ldapsearch)\b[^\r\n]*)(?:/flash/nsconfig/keys|F[12]\.key|database\.php|LDAPTLS_REQCERT) + condition: selection +indicator_status: behavior_pattern +references: +- https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker +source: +- poppelgaard +observations: +- id: community_credential_access + description: Credential/key access command context; legitimate administration can match. + confidence: low + caveat: Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence. + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + matching: pattern + mapped_from: community_credential_access +origin: + provenance_type: public_source_informed_heuristic + scope_not_campaign_specific: false + description: Detection adapted from cited public observations; a match is a review lead, not proof of successful + execution. +--- +id: 7b494cb0-3191-5a78-9ceb-e97092f9f2ed +name: public_reference_domain +title: NetScaler Public Reference DOMAIN Indicators +status: experimental +description: Public reference indicators for retrospective review. Matches do not establish malicious ownership, + successful execution or local compromise; review individual provenance and roles. +author: NetScaler Triage contributors +references: +- https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker +- https://labs.beazley.security/advisories/BSL-A1216 +- https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json +- https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md +source: +- arctic-wolf +- beazley +- ifin-event +- poppelgaard +logsource: + product: netscaler +detection: + selection: + raw|re: "(?:(?i:(?\"\\x27]+))/\\.x(?![\\w./%+-])|(?:(?\"\\x27]+))/logon/LogonPoint/custom/receiver\\.min\\.\\.css(?![\\w./%+-])|(?:(?\"\\x27]+))/logon/LogonPoint/custom/receiver\\.min\\.css(?![\\w./%+-])|(?:(?\"\\x27]+))/netscaler/ns_gui/admin_ui/e\\.txt(?![\\w./%+-])|(?:(?\"\\x27]+))/netscaler/ns_gui/admin_ui/log\\.txt(?![\\w./%+-])|(?:(?\"\\x27]+))/netscaler/ns_gui/vpn/c88771\\.json(?![\\w./%+-])|(?:(?\"\\x27]+))/tmp/\\.uxdlock(?![\\w./%+-])|(?:(?\"\\x27]+))/tmp/\\.uxdport(?![\\w./%+-])|(?:(?\"\\x27]+))/tmp/lula(?![\\w./%+-])|(?:(?\"\\x27]+))/tmp/update_result_3567cs\\.tgz(?![\\w./%+-])|(?:(?\"\\x27]+))/tmp/watchTowr(?![\\w./%+-])|(?:(?\"\\x27]+))/var/1\\.py(?![\\w./%+-])|(?:(?\"\\x27]+))/var/netscaler/gui/admin_ui/e\\.txt(?![\\w./%+-])|(?:(?\"\\x27]+))/var/netscaler/gui/admin_ui/log\\.txt(?![\\w./%+-])|(?:(?\"\\x27]+))/var/netscaler/gui/vpn/c(?![\\w./%+-])|(?:(?\"\\x27]+))/var/netscaler/gui/vpn/scripts/linux/1bd8a664\\.sig(?![\\w./%+-])|(?:(?\"\\x27]+))/var/netscaler/logon/LogonPoint/\\.local_journal(?![\\w./%+-])|(?:(?\"\\x27]+))/var/netscaler/logon/LogonPoint/custom/\\.ctxs\\.receiver(?![\\w./%+-])|(?:(?\"\\x27]+))/var/netscaler/logon/LogonPoint/xua\\.html(?![\\w./%+-])|(?:(?\"\\x27]+))/var/netscaler/logon/insight\\-new\\.js(?![\\w./%+-])|(?:(?\"\\x27]+))/var/tmp/\\.nsmon/\\.cfg(?![\\w./%+-])|(?:(?\"\\x27]+))/var/tmp/\\.nsmon/\\.state(?![\\w./%+-])|(?:(?\"\\x27]+))/var/tmp/\\.nsmon/nsmon\\.pl(?![\\w./%+-])|(?:(?\"\\x27]+))/var/tmp/\\.s(?![\\w./%+-])|(?:(?\"\\x27]+))/var/tmp/boom(?![\\w./%+-])|(?:(?\"\\x27]+))/var/tmp/lula(?![\\w./%+-])|(?:(?\"\\x27]+))/var/vpn/theme/x\\.php(?![\\w./%+-])|(?:(?\"\\x27]+))/var/vpn/themes/logon\\.php(?![\\w./%+-])|(?:(?\"\\x27]+))/vpn/media/e6ee7c85\\.ico(?![\\w./%+-])|(?:(?\"\\x27]+))/vpn/media/nsgclient\\.ico(?![\\w./%+-])|(?:(?\"\\x27]+))/vpn/scripts/linux/nsg64\\.deb(?![\\w./%+-])|(?:(?\"\\x27]+))/vpn/scripts/linux/nsgclient18\\.deb(?![\\w./%+-])|(?/var/netscaler/logon/insight-new.js`. Source: LevelBlue THOR team.' + misp_type: filename + misp_to_ids: true + attribute_uuid: 2a223be1-7a2a-4829-b003-7d085fdd0ddd + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + original_status: reference_only + source_dates: + - id: ifin-event + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039091+00:00' + - description: Investigation-derived artifact or routing path. + role: Investigation-derived artifact or routing path. + confidence: high + status: reference_only + source_ids: + - sygnia + source_urls: + - https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ + original_status: reference_only + source_dates: + - id: sygnia + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039387+00:00' + source: + - ifin-event + - levelblue + - sygnia + roles: + - Investigation-derived artifact or routing path. + - Secondary-source artifact; validate cited original report. + - Staged NetScaler configuration + - reference_indicator + role: Investigation-derived artifact or routing path.; Secondary-source artifact; validate cited original report.; + Staged NetScaler configuration; reference_indicator + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-9403c81b-60f9-5a30-ac36-990b112a43e6 + type: path + value: /var/python/bin/customsnmpd + status: reference_only + source_ids: + - levelblue + source_urls: + - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators + observations: + - status: reference_only + description: Artifact path; a textual reference does not prove that the file exists. + source_ids: + - levelblue + source_urls: + - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators + original_status: reference_only + source_dates: + - id: levelblue + published: '2026-09-30' + retrieved: '2026-10-01' + - status: context_only + role: modified_legitimate_component + description: 'Context only: legitimate appliance path becomes relevant when overwritten by reverse-shell code.' + confidence: published + source_ids: + - levelblue + source_urls: + - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators + original_status: context_only + source_dates: + - id: levelblue + published: '2026-09-30' + retrieved: '2026-10-01' + source: + - levelblue + roles: + - modified_legitimate_component + - reference_indicator + role: modified_legitimate_component; reference_indicator + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: true +- id: ioc-791d9376-2278-579f-b65b-e2f1603eb86c + type: path + value: /var/tmp/.nsmon/.cfg + status: reference_only + source_ids: + - arctic-wolf + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + observations: + - description: Reported payload, persistence or network artifact. + role: Reported payload, persistence or network artifact. + confidence: high + status: reference_only + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + original_status: reference_only + source_dates: + - id: arctic-wolf + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039386+00:00' + - status: reference_only + role: Community-reported payload, persistence or staging path; verify context + confidence: low + description: Community-reported payload, persistence or staging path; verify context + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + source: + - arctic-wolf + - poppelgaard + roles: + - Community-reported payload, persistence or staging path; verify context + - Reported payload, persistence or network artifact. + role: Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or + network artifact. + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-33152f79-ced9-5032-b8c5-5cdd2bd25022 + type: path + value: /var/tmp/.nsmon/.state + status: reference_only + source_ids: + - arctic-wolf + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + observations: + - description: Reported payload, persistence or network artifact. + role: Reported payload, persistence or network artifact. + confidence: high + status: reference_only + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + original_status: reference_only + source_dates: + - id: arctic-wolf + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039386+00:00' + - status: reference_only + role: Community-reported payload, persistence or staging path; verify context + confidence: low + description: Community-reported payload, persistence or staging path; verify context + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + source: + - arctic-wolf + - poppelgaard + roles: + - Community-reported payload, persistence or staging path; verify context + - Reported payload, persistence or network artifact. + role: Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or + network artifact. + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-262b6f76-9739-549a-b409-588867871d8d + type: path + value: /var/tmp/.nsmon/nsmon.pl + status: reference_only + source_ids: + - arctic-wolf + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + observations: + - description: Reported payload, persistence or network artifact. + role: Reported payload, persistence or network artifact. + confidence: high + status: reference_only + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + original_status: reference_only + source_dates: + - id: arctic-wolf + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039386+00:00' + - status: reference_only + role: Community-reported payload, persistence or staging path; verify context + confidence: low + description: Community-reported payload, persistence or staging path; verify context + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + source: + - arctic-wolf + - poppelgaard + roles: + - Community-reported payload, persistence or staging path; verify context + - Reported payload, persistence or network artifact. + role: Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or + network artifact. + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-a177a90a-0a05-5dcf-a623-257a8268b012 + type: path + value: /var/tmp/.s + status: reference_only + source_ids: + - arctic-wolf + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + observations: + - description: Reported payload, persistence or network artifact. + role: Reported payload, persistence or network artifact. + confidence: high + status: reference_only + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + original_status: reference_only + source_dates: + - id: arctic-wolf + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039386+00:00' + - status: reference_only + role: Community-reported payload, persistence or staging path; verify context + confidence: low + description: Community-reported payload, persistence or staging path; verify context + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + source: + - arctic-wolf + - poppelgaard + roles: + - Community-reported payload, persistence or staging path; verify context + - Reported payload, persistence or network artifact. + role: Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or + network artifact. + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-aacbb570-45a0-557c-a81e-a3a34ae45b95 + type: path + value: /var/tmp/boom + status: reference_only + source_ids: + - watchtowr-repo + source_urls: + - https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 + observations: + - status: reference_only + role: PoC/example output marker; attribution and execution require corroboration + confidence: low + description: PoC/example output marker; attribution and execution require corroboration + observation_category: poc_marker + source_ids: + - watchtowr-repo + source_urls: + - https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 + original_status: reference_only + source_dates: + - id: watchtowr-repo + published: null + retrieved: '2026-10-01' + source: + - watchtowr-repo + roles: + - PoC/example output marker; attribution and execution require corroboration + role: PoC/example output marker; attribution and execution require corroboration + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-d249a2a1-2961-51e6-bded-02f39ec7cd9b + type: path + value: /var/tmp/lula + status: reference_only + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + observations: + - status: reference_only + role: Community-reported payload, persistence or staging path; verify context + confidence: low + description: Community-reported payload, persistence or staging path; verify context + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + source: + - poppelgaard + roles: + - Community-reported payload, persistence or staging path; verify context + role: Community-reported payload, persistence or staging path; verify context + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-766da79a-4f98-5d5c-a12d-68de5383a0a9 + type: path + value: /var/vpn/theme/x.php + status: reference_only + source_ids: + - technion + source_urls: + - https://github.com/technion/netscaler_scanner + observations: + - status: reference_only + role: Author-reported webshell path; text reference does not establish file existence + confidence: medium + description: Author-reported webshell path; text reference does not establish file existence + source_ids: + - technion + source_urls: + - https://github.com/technion/netscaler_scanner + original_status: reference_only + source_dates: + - id: technion + published: null + retrieved: '2026-10-01' + source: + - technion + roles: + - Author-reported webshell path; text reference does not establish file existence + role: Author-reported webshell path; text reference does not establish file existence + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-b6be1d96-6a37-5350-bade-d162ede2dae5 + type: path + value: /var/vpn/themes/logon.php + status: reference_only + source_ids: + - technion + source_urls: + - https://github.com/technion/netscaler_scanner + observations: + - status: reference_only + role: Author-reported webshell path; text reference does not establish file existence + confidence: medium + description: Author-reported webshell path; text reference does not establish file existence + source_ids: + - technion + source_urls: + - https://github.com/technion/netscaler_scanner + original_status: reference_only + source_dates: + - id: technion + published: null + retrieved: '2026-10-01' + source: + - technion + roles: + - Author-reported webshell path; text reference does not establish file existence + role: Author-reported webshell path; text reference does not establish file existence + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-a9d659c4-0eed-53d7-b042-d9ca9dcf21e7 + type: path + value: /vpn/media/e6ee7c85.ico + status: reference_only + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + observations: + - status: reference_only + role: webshell_request + description: Mandiant published example; filenames vary between victims. + confidence: published + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + original_status: reference_only + source_dates: + - id: mandiant + published: '2026-09-29' + retrieved: '2026-10-01' + source: + - mandiant + roles: + - webshell_request + role: webshell_request + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-dc82bcbc-de78-570e-bbae-ab486a372e8e + type: path + value: /vpn/media/nsgclient.ico + status: reference_only + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + observations: + - status: reference_only + description: Hunting reference, not a local finding. + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + original_status: reference_only + source_dates: + - id: mandiant + published: '2026-09-29' + retrieved: '2026-10-01' + - status: reference_only + role: published_artifact + description: published_artifact + confidence: published + source_ids: + - mandiant + source_urls: + - https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances + original_status: reference_only + source_dates: + - id: mandiant + published: '2026-09-29' + retrieved: '2026-10-01' + source: + - mandiant + roles: + - published_artifact + - reference_indicator + role: published_artifact; reference_indicator + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-3d510830-d3b1-5e44-a242-b699980c2a6e + type: path + value: /vpn/scripts/linux/nsg64.deb + status: reference_only + source_ids: + - ifin-event + - unit42 + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + - https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ + observations: + - status: reference_only + role: webshell_artifact + description: webshell_artifact + confidence: published + source_ids: + - unit42 + source_urls: + - https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ + original_status: reference_only + source_dates: + - id: unit42 + published: '2026-09-30' + retrieved: '2026-10-01T19:36:45.064965+00:00' + - description: Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + confidence: low + status: reference_only + original_comment: '.deb PHP webshell — RC4-encrypted C2 using key 7489a0f93c67fa5cdaeb4b921d90594d (MD5 of passphrase + Rhfajaf1H992). Commands via HTTP headers, cookies, GET/POST params. Supports cmd/size/dl/up/info commands. + Uses /var/netscaler/.ns_suidcmd for privilege escalation. Source: Unit42 threat brief.' + misp_type: filename + misp_to_ids: true + attribute_uuid: 287f7064-4981-41dc-977b-3d6801448747 + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + original_status: reference_only + source_dates: + - id: ifin-event + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039091+00:00' + source: + - ifin-event + - unit42 + roles: + - Secondary-source artifact; validate cited original report. + - webshell_artifact + role: Secondary-source artifact; validate cited original report.; webshell_artifact + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-4f7d5878-969d-5828-be5d-b5862d29c92e + type: path + value: /vpn/scripts/linux/nsgclient18.deb + status: reference_only + source_ids: + - ifin-event + - unit42 + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + - https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ + observations: + - status: reference_only + role: webshell_artifact + description: webshell_artifact + confidence: published + source_ids: + - unit42 + source_urls: + - https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ + original_status: reference_only + source_dates: + - id: unit42 + published: '2026-09-30' + retrieved: '2026-10-01T19:36:45.064965+00:00' + - description: Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + confidence: low + status: reference_only + original_comment: '.deb webshell in VPN client scripts directory — .deb extension masquerading as PHP script + via AddHandler in httpd.conf. Requested by multiple attacker IPs Sep 4-24 with daily VPS rotation. Source: + Unit42 threat brief.' + misp_type: filename + misp_to_ids: true + attribute_uuid: 31528ea2-29c1-4d3c-ac7b-ef2e5a4c753c + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + original_status: reference_only + source_dates: + - id: ifin-event + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039091+00:00' + source: + - ifin-event + - unit42 + roles: + - Secondary-source artifact; validate cited original report. + - webshell_artifact + role: Secondary-source artifact; validate cited original report.; webshell_artifact + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-f76deaef-883d-5aae-b0b1-7ded0aeebd6e + type: path + value: 80974ca9.sig + status: reference_only + source_ids: + - sygnia + source_urls: + - https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ + observations: + - description: Investigation-derived artifact or routing path. + role: Investigation-derived artifact or routing path. + confidence: high + status: reference_only + source_ids: + - sygnia + source_urls: + - https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ + original_status: reference_only + source_dates: + - id: sygnia + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039387+00:00' + source: + - sygnia + roles: + - Investigation-derived artifact or routing path. + role: Investigation-derived artifact or routing path. + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-00ff8419-6ddb-5974-8a48-0cc1ab2f54ee + type: path + value: LoginIcon.sig + status: reference_only + source_ids: + - sygnia + source_urls: + - https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ + observations: + - description: Investigation-derived artifact or routing path. + role: Investigation-derived artifact or routing path. + confidence: high + status: reference_only + source_ids: + - sygnia + source_urls: + - https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ + original_status: reference_only + source_dates: + - id: sygnia + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039387+00:00' + source: + - sygnia + roles: + - Investigation-derived artifact or routing path. + role: Investigation-derived artifact or routing path. + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-3363ed4f-2283-54d6-9d4f-5da305fdbc66 + type: path + value: e6ee7c85.sig + status: reference_only + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + observations: + - description: Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + confidence: low + status: reference_only + original_comment: 'WHIPSHOT web shell variant — .sig extension masquerading as PHP script via AddHandler in + httpd.conf. Extracts Base64 payloads from HTTP_NSC_CLIENTTYPE header, executes via eval(). Routes via AliasMatch + from /vpn/media/e6ee7c85.ico. Source: Mandiant/GTIG.' + misp_type: filename + misp_to_ids: true + attribute_uuid: 619c3c8a-e3b9-44e1-afd0-fec0abd60097 + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + original_status: reference_only + source_dates: + - id: ifin-event + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039091+00:00' + source: + - ifin-event + roles: + - Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-7c21e715-4cdc-58cd-9a78-2acaec7ea3dd + type: path + value: nsginstaller.deb + status: reference_only + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + observations: + - description: Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + confidence: low + status: reference_only + original_comment: 'Lightweight PHP installer web shell — .deb extension masquerading as PHP script via AddHandler + in httpd.conf. Extracts Base64 commands from HTTP_NSC_LDAP header, executes via shell_exec(). Modifies httpd.conf, + sets SUID on /bin/sh, scrubs /etc/crontab, reboots via /netscaler/nsshutdown -R. Filenames vary (nginstaller, + nginstaller2, etc.). Source: Mandiant/GTIG.' + misp_type: filename + misp_to_ids: true + attribute_uuid: e398d998-726f-46e0-8701-a4c514c5351e + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + original_status: reference_only + source_dates: + - id: ifin-event + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039091+00:00' + source: + - ifin-event + roles: + - Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-7ba7dbfd-64f8-5dd5-9e02-6ab5ca52ef98 + type: path + value: receiver.min.css + status: reference_only + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + observations: + - description: Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + confidence: low + status: reference_only + original_comment: 'Webshell Apache Alias — attacker configures httpd.conf to route requests for non-existent + receiver.min.css to .ctxs.receiver webshell. Check httpd.conf for ''Alias /logon/LogonPoint/custom/receiver.min.css''. + Source: GreyNoise blog 2026-09-28.' + misp_type: filename + misp_to_ids: true + attribute_uuid: 7f2b241e-5fa2-4ec9-a949-d95a28dec58a + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + original_status: reference_only + source_dates: + - id: ifin-event + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039091+00:00' + source: + - ifin-event + roles: + - Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-e5d46efc-25d8-5489-8f0a-5c4b335c44a6 + type: path + value: update_c08937.pl + status: reference_only + source_ids: + - sygnia + source_urls: + - https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ + observations: + - description: Investigation-derived artifact or routing path. + role: Investigation-derived artifact or routing path. + confidence: high + status: reference_only + source_ids: + - sygnia + source_urls: + - https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ + original_status: reference_only + source_dates: + - id: sygnia + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039387+00:00' + source: + - sygnia + roles: + - Investigation-derived artifact or routing path. + role: Investigation-derived artifact or routing path. + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +--- +title: NetScaler Public Reference SHA256 Indicators +id: 1ea4d3c0-720b-5949-ab47-6ca1da4860e9 +name: public_reference_sha256 +status: experimental +description: Public reference indicators for retrospective review. Matches do not establish malicious ownership, + successful execution or local compromise; review individual provenance and roles. +author: NetScaler Triage contributors +references: +- https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker +- https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json +- https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh +- https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md +- https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ +- https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772 +- https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation +- https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators +- https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/ +- https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ +source: +- arctic-wolf +- deyda-script +- esentire +- greynoise +- ifin-event +- levelblue +- poppelgaard +- rapid7 +- sygnia +- unit42 +logsource: + product: netscaler +detection: + selection: + raw|re: "(?:(?i:(?''. Stage 3: /netscaler/ns_monuploadd_err.pl processes poisoned log, extracts + and executes command. Source: Unit42 threat brief.' + misp_type: sha256 + misp_to_ids: true + attribute_uuid: cc4e48ab-6198-4c1d-a4b0-e670a3e28c1a + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + original_status: reference_only + source_dates: + - id: ifin-event + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039091+00:00' + - status: reference_only + role: Published community webshell/payload hash aggregation + confidence: low + description: Published community webshell/payload hash aggregation + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + - status: reference_only + role: Community-repeated published webshell or payload hash + confidence: low + description: Community-repeated published webshell or payload hash + source_ids: + - deyda-script + source_urls: + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + original_status: reference_only + source_dates: + - id: deyda-script + published: null + retrieved: '2026-10-01' + source: + - deyda-script + - ifin-event + - poppelgaard + - unit42 + roles: + - Community-repeated published webshell or payload hash + - Published community webshell/payload hash aggregation + - Secondary-source artifact; validate cited original report. + - payload_hash + role: Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; + Secondary-source artifact; validate cited original report.; payload_hash + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-afd36d04-8867-5378-888a-35110f025138 + type: sha256 + value: 57f9f30c50240fd48d761de7961a430cdebf2c084a36bc76d376a1ce8e6dfa9d + status: reference_only + source_ids: + - arctic-wolf + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + observations: + - description: 'Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ' + role: 'Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ' + confidence: high + status: reference_only + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + original_status: reference_only + source_dates: + - id: arctic-wolf + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039386+00:00' + - status: reference_only + role: Published community webshell/payload hash aggregation + confidence: low + description: Published community webshell/payload hash aggregation + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + source: + - arctic-wolf + - poppelgaard + roles: + - 'Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ' + - Published community webshell/payload hash aggregation + role: Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ; Published + community webshell/payload hash aggregation + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-92fc2c99-4cf5-58aa-a5d7-008d3155c8cd + type: sha256 + value: 5ea5ea61e9062822bee3f66ef5ff47c217178d9e31936ad6daf10c5dfae44d12 + status: reference_only + source_ids: + - deyda-script + - esentire + - poppelgaard + - sygnia + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + - https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772 + - https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ + observations: + - status: reference_only + role: SHA256 hash of webshell (.ico variant) + description: SHA256 hash of webshell (.ico variant) + confidence: published + source_ids: + - esentire + source_urls: + - https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772 + original_status: reference_only + source_dates: + - id: esentire + published: '2026-09-29' + retrieved: '2026-10-01T19:36:45.424617+00:00' + - description: Suspicious investigation artifact hash. + role: Suspicious investigation artifact hash. + confidence: high + status: reference_only + source_ids: + - sygnia + source_urls: + - https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ + original_status: reference_only + source_dates: + - id: sygnia + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039387+00:00' + - status: reference_only + role: Published community webshell/payload hash aggregation + confidence: low + description: Published community webshell/payload hash aggregation + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + - status: reference_only + role: Community-repeated published webshell or payload hash + confidence: low + description: Community-repeated published webshell or payload hash + source_ids: + - deyda-script + source_urls: + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + original_status: reference_only + source_dates: + - id: deyda-script + published: null + retrieved: '2026-10-01' + source: + - deyda-script + - esentire + - poppelgaard + - sygnia + roles: + - Community-repeated published webshell or payload hash + - Published community webshell/payload hash aggregation + - SHA256 hash of webshell (.ico variant) + - Suspicious investigation artifact hash. + role: Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; + SHA256 hash of webshell (.ico variant); Suspicious investigation artifact hash. + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-56976039-ce98-5925-9da5-42f80fe3d742 + type: sha256 + value: 6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7 + status: reference_only + source_ids: + - deyda-script + - greynoise + - ifin-event + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + - https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation + observations: + - status: reference_only + role: webshell_hash + description: webshell_hash + confidence: published + source_ids: + - greynoise + source_urls: + - https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation + original_status: reference_only + source_dates: + - id: greynoise + published: '2026-09-28' + retrieved: '2026-10-01T19:36:45.065290+00:00' + - description: Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + confidence: low + status: reference_only + original_comment: 'Webshell SHA-256 — GreyNoise-observed variant of .ctxs.receiver webshell. Different hash + from Reddit-sourced sample (ed082f74...). Token redacted in GreyNoise post. Attacker playbook: chmod 6555 + /bin/sh, install webshell, modify httpd.conf (Alias + AliasMatch + php_flag engine on), kill -HUP httpd. Source: + GreyNoise blog 2026-09-28.' + misp_type: sha256 + misp_to_ids: true + attribute_uuid: b8870657-980e-4e2f-bd14-2d3d2ec0300e + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + original_status: reference_only + source_dates: + - id: ifin-event + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039091+00:00' + - status: reference_only + role: Published community webshell/payload hash aggregation + confidence: low + description: Published community webshell/payload hash aggregation + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + - status: reference_only + role: Community-repeated published webshell or payload hash + confidence: low + description: Community-repeated published webshell or payload hash + source_ids: + - deyda-script + source_urls: + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + original_status: reference_only + source_dates: + - id: deyda-script + published: null + retrieved: '2026-10-01' + source: + - deyda-script + - greynoise + - ifin-event + - poppelgaard + roles: + - Community-repeated published webshell or payload hash + - Published community webshell/payload hash aggregation + - Secondary-source artifact; validate cited original report. + - webshell_hash + role: Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; + Secondary-source artifact; validate cited original report.; webshell_hash + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-b2c779cd-c0a6-56ee-bd4d-1a8fe9b08018 + type: sha256 + value: 73b74309f4728d169cc9edfb2767c5aadd75d39b62de93c935a86c777d2646bc + status: reference_only + source_ids: + - arctic-wolf + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + observations: + - description: 'First payload returned from /xd7h/x. ' + role: 'First payload returned from /xd7h/x. ' + confidence: high + status: reference_only + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + original_status: reference_only + source_dates: + - id: arctic-wolf + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039386+00:00' + - status: reference_only + role: Published community webshell/payload hash aggregation + confidence: low + description: Published community webshell/payload hash aggregation + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + source: + - arctic-wolf + - poppelgaard + roles: + - 'First payload returned from /xd7h/x. ' + - Published community webshell/payload hash aggregation + role: First payload returned from /xd7h/x. ; Published community webshell/payload hash aggregation + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-6aadf255-b9d5-5708-a4cb-39814fa86cc9 + type: sha256 + value: 79c65fa04541032e251fa4796b97800374b63c7982593dd1a2e0db605d429186 + status: reference_only + source_ids: + - deyda-script + - ifin-event + - poppelgaard + - unit42 + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + - https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ + observations: + - status: reference_only + role: payload_hash + description: Decoded shell script + confidence: published + source_ids: + - unit42 + source_urls: + - https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ + original_status: reference_only + source_dates: + - id: unit42 + published: '2026-09-30' + retrieved: '2026-10-01T19:36:45.064965+00:00' + - description: Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + confidence: low + status: reference_only + original_comment: 'SHA-256 of decoded shell script from 3-stage chain — deploys .ctxs.receiver webshell, patches + httpd.conf (Alias/AliasMatch for receiver.min.css + hex variants), enables PHP engine, kill -HUP httpd. Source: + Unit42 threat brief.' + misp_type: sha256 + misp_to_ids: true + attribute_uuid: 709f0879-af79-4d79-a1d0-dccd855eac3d + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + original_status: reference_only + source_dates: + - id: ifin-event + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039091+00:00' + - status: reference_only + role: Published community webshell/payload hash aggregation + confidence: low + description: Published community webshell/payload hash aggregation + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + - status: reference_only + role: Community-repeated published webshell or payload hash + confidence: low + description: Community-repeated published webshell or payload hash + source_ids: + - deyda-script + source_urls: + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + original_status: reference_only + source_dates: + - id: deyda-script + published: null + retrieved: '2026-10-01' + source: + - deyda-script + - ifin-event + - poppelgaard + - unit42 + roles: + - Community-repeated published webshell or payload hash + - Published community webshell/payload hash aggregation + - Secondary-source artifact; validate cited original report. + - payload_hash + role: Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; + Secondary-source artifact; validate cited original report.; payload_hash + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-f5816171-a941-52ac-bb19-94d0648bc8e8 + type: sha256 + value: 7add390ceee4a1373211b3e340451b34f08965fc4d805f94c9b8cebdc0775774 + status: reference_only + source_ids: + - deyda-script + - esentire + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + - https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772 + observations: + - status: reference_only + role: SHA256 hash of webshell (.deb variant) + description: SHA256 hash of webshell (.deb variant) + confidence: published + source_ids: + - esentire + source_urls: + - https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772 + original_status: reference_only + source_dates: + - id: esentire + published: '2026-09-29' + retrieved: '2026-10-01T19:36:45.424617+00:00' + - status: reference_only + role: Published community webshell/payload hash aggregation + confidence: low + description: Published community webshell/payload hash aggregation + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + - status: reference_only + role: Community-repeated published webshell or payload hash + confidence: low + description: Community-repeated published webshell or payload hash + source_ids: + - deyda-script + source_urls: + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + original_status: reference_only + source_dates: + - id: deyda-script + published: null + retrieved: '2026-10-01' + source: + - deyda-script + - esentire + - poppelgaard + roles: + - Community-repeated published webshell or payload hash + - Published community webshell/payload hash aggregation + - SHA256 hash of webshell (.deb variant) + role: Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; + SHA256 hash of webshell (.deb variant) + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-9612b66f-4245-59ae-9405-057c997c80a0 + type: sha256 + value: 927c7fbef2e620c1ce482c3ed67ebf53da97693c1d6c7552c77aec84ba982cf8 + status: reference_only + source_ids: + - arctic-wolf + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + observations: + - description: Platypus agent (shell script) retrieved from entretiensol[.]com + role: Platypus agent (shell script) retrieved from entretiensol[.]com + confidence: high + status: reference_only + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + original_status: reference_only + source_dates: + - id: arctic-wolf + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039386+00:00' + - status: reference_only + role: Published community webshell/payload hash aggregation + confidence: low + description: Published community webshell/payload hash aggregation + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + source: + - arctic-wolf + - poppelgaard + roles: + - Platypus agent (shell script) retrieved from entretiensol[.]com + - Published community webshell/payload hash aggregation + role: Platypus agent (shell script) retrieved from entretiensol[.]com; Published community webshell/payload hash + aggregation + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-d33d9d79-6b65-5e52-902a-b1c4b3e17959 + type: sha256 + value: 974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938 + status: reference_only + source_ids: + - arctic-wolf + - ifin-event + - levelblue + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators + observations: + - status: reference_only + description: Published hash for update_c08937.pl; no independently acquired sample. + source_ids: + - levelblue + source_urls: + - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators + original_status: reference_only + source_dates: + - id: levelblue + published: '2026-09-30' + retrieved: '2026-10-01' + - status: reference_only + role: update_c08937.pl + description: update_c08937.pl + confidence: published + source_ids: + - levelblue + source_urls: + - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators + original_status: reference_only + source_dates: + - id: levelblue + published: '2026-09-30' + retrieved: '2026-10-01' + - description: Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + confidence: low + status: reference_only + original_comment: 'SHA-256 of update_c08937.pl — Perl post-exploitation payload. Creates local account sec_monitor + with superuser role in ns.conf, archives /flash/nsconfig to /tmp/update_result_3567cs.tgz, uploads to 64.94.85.67:443, + chmod 6555 /bin/sh, deploys PHP webshell at /var/netscaler/logon/LogonPoint/.local_journal with httpd.conf + AliasMatch to CSS-like URLs (LogonUISimple.html.style.min.css and hex variants). Self-deletes after execution. + Source: LevelBlue THOR team.' + misp_type: sha256 + misp_to_ids: true + attribute_uuid: 7959b6fc-84f3-40e2-af66-790edcc1fe97 + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + original_status: reference_only + source_dates: + - id: ifin-event + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039091+00:00' + - description: 'Perl script update_c08937.pl ' + role: 'Perl script update_c08937.pl ' + confidence: high + status: reference_only + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + original_status: reference_only + source_dates: + - id: arctic-wolf + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039386+00:00' + - status: reference_only + role: Published community webshell/payload hash aggregation + confidence: low + description: Published community webshell/payload hash aggregation + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + source: + - arctic-wolf + - ifin-event + - levelblue + - poppelgaard + roles: + - 'Perl script update_c08937.pl ' + - Published community webshell/payload hash aggregation + - Secondary-source artifact; validate cited original report. + - reference_indicator + - update_c08937.pl + role: Perl script update_c08937.pl ; Published community webshell/payload hash aggregation; Secondary-source artifact; + validate cited original report.; reference_indicator; update_c08937.pl + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-965e969a-aa75-541b-9191-d544bf92ca6e + type: sha256 + value: 9c7bf01d2c2cb31a3609d27c1bc9abc60d86e37b7f9908547e0c75fb18b99aab + status: reference_only + source_ids: + - arctic-wolf + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + observations: + - description: 'Perl script returned from /xd7h/nsmon.pl. ' + role: 'Perl script returned from /xd7h/nsmon.pl. ' + confidence: high + status: reference_only + source_ids: + - arctic-wolf + source_urls: + - https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md + original_status: reference_only + source_dates: + - id: arctic-wolf + published: '2026-09-30' + retrieved: '2026-10-01T19:44:37.039386+00:00' + - status: reference_only + role: Published community webshell/payload hash aggregation + confidence: low + description: Published community webshell/payload hash aggregation + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + source: + - arctic-wolf + - poppelgaard + roles: + - 'Perl script returned from /xd7h/nsmon.pl. ' + - Published community webshell/payload hash aggregation + role: Perl script returned from /xd7h/nsmon.pl. ; Published community webshell/payload hash aggregation + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-c7329309-8c04-5ce5-8303-92e89a112f48 + type: sha256 + value: ae22ef2517b5c0fb47f78745b9cb5260acee0e751b89bcd354640ff8bc8d29ec + status: reference_only + source_ids: + - deyda-script + - ifin-event + - poppelgaard + - unit42 + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + - https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ + observations: + - status: reference_only + role: payload_hash + description: nsg64.deb PHP webshell + confidence: published + source_ids: + - unit42 + source_urls: + - https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ + original_status: reference_only + source_dates: + - id: unit42 + published: '2026-09-30' + retrieved: '2026-10-01T19:36:45.064965+00:00' + - description: Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + confidence: low + status: reference_only + original_comment: 'SHA-256 of nsg64.deb — .deb PHP webshell with RC4 C2. Key: 7489a0f93c67fa5cdaeb4b921d90594d + (MD5 of passphrase Rhfajaf1H992). Commands: cmd (shell_exec), size (wc -c), dl (file exfil), up (file write), + info (PHP version). Uses /var/netscaler/.ns_suidcmd for privesc. Source: Unit42 threat brief.' + misp_type: sha256 + misp_to_ids: true + attribute_uuid: 8dafb7e1-c580-41a2-b52a-0a685eec02ae + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + original_status: reference_only + source_dates: + - id: ifin-event + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039091+00:00' + - status: reference_only + role: Published community webshell/payload hash aggregation + confidence: low + description: Published community webshell/payload hash aggregation + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + - status: reference_only + role: Community-repeated published webshell or payload hash + confidence: low + description: Community-repeated published webshell or payload hash + source_ids: + - deyda-script + source_urls: + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + original_status: reference_only + source_dates: + - id: deyda-script + published: null + retrieved: '2026-10-01' + source: + - deyda-script + - ifin-event + - poppelgaard + - unit42 + roles: + - Community-repeated published webshell or payload hash + - Published community webshell/payload hash aggregation + - Secondary-source artifact; validate cited original report. + - payload_hash + role: Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; + Secondary-source artifact; validate cited original report.; payload_hash + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-cd3ee9e8-d0e7-5eec-886c-fef590f7be79 + type: sha256 + value: e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c + status: reference_only + source_ids: + - ifin-event + - levelblue + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators + observations: + - status: reference_only + description: Published hash for main.py; no independently acquired sample. + source_ids: + - levelblue + source_urls: + - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators + original_status: reference_only + source_dates: + - id: levelblue + published: '2026-09-30' + retrieved: '2026-10-01' + - status: reference_only + role: main.py + description: main.py + confidence: published + source_ids: + - levelblue + source_urls: + - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators + original_status: reference_only + source_dates: + - id: levelblue + published: '2026-09-30' + retrieved: '2026-10-01' + - description: Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + confidence: low + status: reference_only + original_comment: 'SHA-256 of main.py — Python reverse-shell payload. Overwrites /var/python/bin/customsnmpd + with code that connects to 45.141.21.130:443, redirects stdin/stdout/stderr to socket, launches /bin/sh. Also + kills existing customsnmpd processes. Source: LevelBlue THOR team.' + misp_type: sha256 + misp_to_ids: true + attribute_uuid: eac3991b-e3a0-4335-8180-a32bddf999e7 + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + original_status: reference_only + source_dates: + - id: ifin-event + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039091+00:00' + source: + - ifin-event + - levelblue + roles: + - Secondary-source artifact; validate cited original report. + - main.py + - reference_indicator + role: Secondary-source artifact; validate cited original report.; main.py; reference_indicator + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +- id: ioc-161bf202-a189-53a3-9a30-5f9ffcca29b2 + type: sha256 + value: ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1 + status: reference_only + source_ids: + - deyda-script + - ifin-event + - poppelgaard + - rapid7 + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + - https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/ + observations: + - description: Secondary-source artifact; validate cited original report. + role: Secondary-source artifact; validate cited original report. + confidence: low + status: reference_only + original_comment: 'PHP webshell .ctxs.receiver — backdoor on NetScaler LogonPoint. passthru(urldecode($_COOKIE["NSC_TASS"])) + triggered by CsrfToken cookie match. 237 bytes. Token likely varies per victim — grep for content pattern, + not just hash. Source: Reddit user K7Fy6fWmTv76D3qAPn via Discourse post #6.' + misp_type: sha256 + misp_to_ids: true + attribute_uuid: 7d28869f-a134-4b95-9ed2-735c7866a52f + source_ids: + - ifin-event + source_urls: + - https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json + original_status: reference_only + source_dates: + - id: ifin-event + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039091+00:00' + - description: Hidden PHP webshell hash. + role: Hidden PHP webshell hash. + confidence: high + status: reference_only + source_ids: + - rapid7 + source_urls: + - https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/ + original_status: reference_only + source_dates: + - id: rapid7 + published: '2026-09-28' + retrieved: '2026-10-01T19:44:37.039385+00:00' + - status: reference_only + role: Published community webshell/payload hash aggregation + confidence: low + description: Published community webshell/payload hash aggregation + source_ids: + - poppelgaard + source_urls: + - https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker + original_status: reference_only + source_dates: + - id: poppelgaard + published: null + retrieved: '2026-10-01' + - status: reference_only + role: Community-repeated published webshell or payload hash + confidence: low + description: Community-repeated published webshell or payload hash + source_ids: + - deyda-script + source_urls: + - https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh + original_status: reference_only + source_dates: + - id: deyda-script + published: null + retrieved: '2026-10-01' + source: + - deyda-script + - ifin-event + - poppelgaard + - rapid7 + roles: + - Community-repeated published webshell or payload hash + - Hidden PHP webshell hash. + - Published community webshell/payload hash aggregation + - Secondary-source artifact; validate cited original report. + role: Community-repeated published webshell or payload hash; Hidden PHP webshell hash.; Published community webshell/payload + hash aggregation; Secondary-source artifact; validate cited original report. + description: Published reference; evaluate the original source role, observation date and surrounding local evidence. + A match does not establish compromise. + matching: exact + context_only: false +--- +title: NetScaler Public Reference URL Indicators +id: d19912af-166e-5f23-a191-f072117d1057 +name: public_reference_url +status: experimental +description: Public reference indicators for retrospective review. Matches do not establish malicious ownership, + successful execution or local compromise; review individual provenance and roles. +author: NetScaler Triage contributors +references: +- https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json +- https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md +- https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators +source: +- arctic-wolf +- ifin-event +- levelblue +logsource: + product: netscaler +detection: + selection: + raw|re: "(?:(?/var/netscaler/logon/insight-new.js`. Source: LevelBlue THOR team.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "2a223be1-7a2a-4829-b003-7d085fdd0ddd", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Investigation-derived artifact or routing path.", + "role": "Investigation-derived artifact or routing path.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue", + "sygnia" + ], + "roles": [ + "Investigation-derived artifact or routing path.", + "Secondary-source artifact; validate cited original report.", + "Staged NetScaler configuration", + "reference_indicator" + ], + "role": "Investigation-derived artifact or routing path.; Secondary-source artifact; validate cited original report.; Staged NetScaler configuration; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-9403c81b-60f9-5a30-ac36-990b112a43e6", + "type": "path", + "value": "/var/python/bin/customsnmpd", + "status": "reference_only", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Artifact path; a textual reference does not prove that the file exists.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "context_only", + "role": "modified_legitimate_component", + "description": "Context only: legitimate appliance path becomes relevant when overwritten by reverse-shell code.", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "context_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "levelblue" + ], + "roles": [ + "modified_legitimate_component", + "reference_indicator" + ], + "role": "modified_legitimate_component; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": true + }, + { + "id": "ioc-791d9376-2278-579f-b65b-e2f1603eb86c", + "type": "path", + "value": "/var/tmp/.nsmon/.cfg", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context", + "Reported payload, persistence or network artifact." + ], + "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-33152f79-ced9-5032-b8c5-5cdd2bd25022", + "type": "path", + "value": "/var/tmp/.nsmon/.state", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context", + "Reported payload, persistence or network artifact." + ], + "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-262b6f76-9739-549a-b409-588867871d8d", + "type": "path", + "value": "/var/tmp/.nsmon/nsmon.pl", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context", + "Reported payload, persistence or network artifact." + ], + "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a177a90a-0a05-5dcf-a623-257a8268b012", + "type": "path", + "value": "/var/tmp/.s", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Reported payload, persistence or network artifact.", + "role": "Reported payload, persistence or network artifact.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context", + "Reported payload, persistence or network artifact." + ], + "role": "Community-reported payload, persistence or staging path; verify context; Reported payload, persistence or network artifact.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-aacbb570-45a0-557c-a81e-a3a34ae45b95", + "type": "path", + "value": "/var/tmp/boom", + "status": "reference_only", + "source_ids": [ + "watchtowr-repo" + ], + "source_urls": [ + "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771" + ], + "observations": [ + { + "status": "reference_only", + "role": "PoC/example output marker; attribution and execution require corroboration", + "confidence": "low", + "description": "PoC/example output marker; attribution and execution require corroboration", + "observation_category": "poc_marker", + "source_ids": [ + "watchtowr-repo" + ], + "source_urls": [ + "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "watchtowr-repo", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "watchtowr-repo" + ], + "roles": [ + "PoC/example output marker; attribution and execution require corroboration" + ], + "role": "PoC/example output marker; attribution and execution require corroboration", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-d249a2a1-2961-51e6-bded-02f39ec7cd9b", + "type": "path", + "value": "/var/tmp/lula", + "status": "reference_only", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "status": "reference_only", + "role": "Community-reported payload, persistence or staging path; verify context", + "confidence": "low", + "description": "Community-reported payload, persistence or staging path; verify context", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "poppelgaard" + ], + "roles": [ + "Community-reported payload, persistence or staging path; verify context" + ], + "role": "Community-reported payload, persistence or staging path; verify context", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-766da79a-4f98-5d5c-a12d-68de5383a0a9", + "type": "path", + "value": "/var/vpn/theme/x.php", + "status": "reference_only", + "source_ids": [ + "technion" + ], + "source_urls": [ + "https://github.com/technion/netscaler_scanner" + ], + "observations": [ + { + "status": "reference_only", + "role": "Author-reported webshell path; text reference does not establish file existence", + "confidence": "medium", + "description": "Author-reported webshell path; text reference does not establish file existence", + "source_ids": [ + "technion" + ], + "source_urls": [ + "https://github.com/technion/netscaler_scanner" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "technion", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "technion" + ], + "roles": [ + "Author-reported webshell path; text reference does not establish file existence" + ], + "role": "Author-reported webshell path; text reference does not establish file existence", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-b6be1d96-6a37-5350-bade-d162ede2dae5", + "type": "path", + "value": "/var/vpn/themes/logon.php", + "status": "reference_only", + "source_ids": [ + "technion" + ], + "source_urls": [ + "https://github.com/technion/netscaler_scanner" + ], + "observations": [ + { + "status": "reference_only", + "role": "Author-reported webshell path; text reference does not establish file existence", + "confidence": "medium", + "description": "Author-reported webshell path; text reference does not establish file existence", + "source_ids": [ + "technion" + ], + "source_urls": [ + "https://github.com/technion/netscaler_scanner" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "technion", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "technion" + ], + "roles": [ + "Author-reported webshell path; text reference does not establish file existence" + ], + "role": "Author-reported webshell path; text reference does not establish file existence", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a9d659c4-0eed-53d7-b042-d9ca9dcf21e7", + "type": "path", + "value": "/vpn/media/e6ee7c85.ico", + "status": "reference_only", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_request", + "description": "Mandiant published example; filenames vary between victims.", + "confidence": "published", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "mandiant" + ], + "roles": [ + "webshell_request" + ], + "role": "webshell_request", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-dc82bcbc-de78-570e-bbae-ab486a372e8e", + "type": "path", + "value": "/vpn/media/nsgclient.ico", + "status": "reference_only", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "status": "reference_only", + "description": "Hunting reference, not a local finding.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "published_artifact", + "description": "published_artifact", + "confidence": "published", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "mandiant", + "published": "2026-09-29", + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "mandiant" + ], + "roles": [ + "published_artifact", + "reference_indicator" + ], + "role": "published_artifact; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-3d510830-d3b1-5e44-a242-b699980c2a6e", + "type": "path", + "value": "/vpn/scripts/linux/nsg64.deb", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_artifact", + "description": "webshell_artifact", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": ".deb PHP webshell — RC4-encrypted C2 using key 7489a0f93c67fa5cdaeb4b921d90594d (MD5 of passphrase Rhfajaf1H992). Commands via HTTP headers, cookies, GET/POST params. Supports cmd/size/dl/up/info commands. Uses /var/netscaler/.ns_suidcmd for privilege escalation. Source: Unit42 threat brief.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "287f7064-4981-41dc-977b-3d6801448747", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Secondary-source artifact; validate cited original report.", + "webshell_artifact" + ], + "role": "Secondary-source artifact; validate cited original report.; webshell_artifact", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-4f7d5878-969d-5828-be5d-b5862d29c92e", + "type": "path", + "value": "/vpn/scripts/linux/nsgclient18.deb", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_artifact", + "description": "webshell_artifact", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": ".deb webshell in VPN client scripts directory — .deb extension masquerading as PHP script via AddHandler in httpd.conf. Requested by multiple attacker IPs Sep 4-24 with daily VPS rotation. Source: Unit42 threat brief.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "31528ea2-29c1-4d3c-ac7b-ef2e5a4c753c", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "unit42" + ], + "roles": [ + "Secondary-source artifact; validate cited original report.", + "webshell_artifact" + ], + "role": "Secondary-source artifact; validate cited original report.; webshell_artifact", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f76deaef-883d-5aae-b0b1-7ded0aeebd6e", + "type": "path", + "value": "80974ca9.sig", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "description": "Investigation-derived artifact or routing path.", + "role": "Investigation-derived artifact or routing path.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "sygnia" + ], + "roles": [ + "Investigation-derived artifact or routing path." + ], + "role": "Investigation-derived artifact or routing path.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-00ff8419-6ddb-5974-8a48-0cc1ab2f54ee", + "type": "path", + "value": "LoginIcon.sig", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "description": "Investigation-derived artifact or routing path.", + "role": "Investigation-derived artifact or routing path.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "sygnia" + ], + "roles": [ + "Investigation-derived artifact or routing path." + ], + "role": "Investigation-derived artifact or routing path.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-3363ed4f-2283-54d6-9d4f-5da305fdbc66", + "type": "path", + "value": "e6ee7c85.sig", + "status": "reference_only", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "WHIPSHOT web shell variant — .sig extension masquerading as PHP script via AddHandler in httpd.conf. Extracts Base64 payloads from HTTP_NSC_CLIENTTYPE header, executes via eval(). Routes via AliasMatch from /vpn/media/e6ee7c85.ico. Source: Mandiant/GTIG.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "619c3c8a-e3b9-44e1-afd0-fec0abd60097", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event" + ], + "roles": [ + "Secondary-source artifact; validate cited original report." + ], + "role": "Secondary-source artifact; validate cited original report.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-7c21e715-4cdc-58cd-9a78-2acaec7ea3dd", + "type": "path", + "value": "nsginstaller.deb", + "status": "reference_only", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Lightweight PHP installer web shell — .deb extension masquerading as PHP script via AddHandler in httpd.conf. Extracts Base64 commands from HTTP_NSC_LDAP header, executes via shell_exec(). Modifies httpd.conf, sets SUID on /bin/sh, scrubs /etc/crontab, reboots via /netscaler/nsshutdown -R. Filenames vary (nginstaller, nginstaller2, etc.). Source: Mandiant/GTIG.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "e398d998-726f-46e0-8701-a4c514c5351e", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event" + ], + "roles": [ + "Secondary-source artifact; validate cited original report." + ], + "role": "Secondary-source artifact; validate cited original report.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-7ba7dbfd-64f8-5dd5-9e02-6ab5ca52ef98", + "type": "path", + "value": "receiver.min.css", + "status": "reference_only", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "observations": [ + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Webshell Apache Alias — attacker configures httpd.conf to route requests for non-existent receiver.min.css to .ctxs.receiver webshell. Check httpd.conf for 'Alias /logon/LogonPoint/custom/receiver.min.css'. Source: GreyNoise blog 2026-09-28.", + "misp_type": "filename", + "misp_to_ids": true, + "attribute_uuid": "7f2b241e-5fa2-4ec9-a949-d95a28dec58a", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event" + ], + "roles": [ + "Secondary-source artifact; validate cited original report." + ], + "role": "Secondary-source artifact; validate cited original report.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-e5d46efc-25d8-5489-8f0a-5c4b335c44a6", + "type": "path", + "value": "update_c08937.pl", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "description": "Investigation-derived artifact or routing path.", + "role": "Investigation-derived artifact or routing path.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + } + ], + "source": [ + "sygnia" + ], + "roles": [ + "Investigation-derived artifact or routing path." + ], + "role": "Investigation-derived artifact or routing path.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-9fffc883-a4a3-50aa-a44b-c0a10fb3c99c", + "type": "sha256", + "value": "1bd314b661396c7086f6367fbbb48025e03ca2de69c073d53a8b0a38aa5fbb7d", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "payload_hash", + "description": "Base64 payload text", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "SHA-256 of Base64 payload from 3-stage CVE-2026-88771 exploit chain. Stage 1: dropper command in User-Agent → logged to httpaccess-vpn.log. Stage 2: login request poisons ns.log with 'pitboss PPE missed too many heartbeatsNSPPE;'. Stage 3: /netscaler/ns_monuploadd_err.pl processes poisoned log, extracts and executes command. Source: Unit42 threat brief.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "cc4e48ab-6198-4c1d-a4b0-e670a3e28c1a", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "unit42" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Published community webshell/payload hash aggregation", + "Secondary-source artifact; validate cited original report.", + "payload_hash" + ], + "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; payload_hash", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-afd36d04-8867-5378-888a-35110f025138", + "type": "sha256", + "value": "57f9f30c50240fd48d761de7961a430cdebf2c084a36bc76d376a1ce8e6dfa9d", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ", + "role": "Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ", + "Published community webshell/payload hash aggregation" + ], + "role": "Initial payload hash recorded in a separate sanitized observation involving 62.133.62[.]80. ; Published community webshell/payload hash aggregation", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-92fc2c99-4cf5-58aa-a5d7-008d3155c8cd", + "type": "sha256", + "value": "5ea5ea61e9062822bee3f66ef5ff47c217178d9e31936ad6daf10c5dfae44d12", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "esentire", + "poppelgaard", + "sygnia" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772", + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "status": "reference_only", + "role": "SHA256 hash of webshell (.ico variant)", + "description": "SHA256 hash of webshell (.ico variant)", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "description": "Suspicious investigation artifact hash.", + "role": "Suspicious investigation artifact hash.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "sygnia", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039387+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "esentire", + "poppelgaard", + "sygnia" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Published community webshell/payload hash aggregation", + "SHA256 hash of webshell (.ico variant)", + "Suspicious investigation artifact hash." + ], + "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; SHA256 hash of webshell (.ico variant); Suspicious investigation artifact hash.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-56976039-ce98-5925-9da5-42f80fe3d742", + "type": "sha256", + "value": "6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "greynoise", + "ifin-event", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" + ], + "observations": [ + { + "status": "reference_only", + "role": "webshell_hash", + "description": "webshell_hash", + "confidence": "published", + "source_ids": [ + "greynoise" + ], + "source_urls": [ + "https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "greynoise", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:36:45.065290+00:00" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Webshell SHA-256 — GreyNoise-observed variant of .ctxs.receiver webshell. Different hash from Reddit-sourced sample (ed082f74...). Token redacted in GreyNoise post. Attacker playbook: chmod 6555 /bin/sh, install webshell, modify httpd.conf (Alias + AliasMatch + php_flag engine on), kill -HUP httpd. Source: GreyNoise blog 2026-09-28.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "b8870657-980e-4e2f-bd14-2d3d2ec0300e", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "greynoise", + "ifin-event", + "poppelgaard" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Published community webshell/payload hash aggregation", + "Secondary-source artifact; validate cited original report.", + "webshell_hash" + ], + "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; webshell_hash", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-b2c779cd-c0a6-56ee-bd4d-1a8fe9b08018", + "type": "sha256", + "value": "73b74309f4728d169cc9edfb2767c5aadd75d39b62de93c935a86c777d2646bc", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "First payload returned from /xd7h/x. ", + "role": "First payload returned from /xd7h/x. ", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "First payload returned from /xd7h/x. ", + "Published community webshell/payload hash aggregation" + ], + "role": "First payload returned from /xd7h/x. ; Published community webshell/payload hash aggregation", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-6aadf255-b9d5-5708-a4cb-39814fa86cc9", + "type": "sha256", + "value": "79c65fa04541032e251fa4796b97800374b63c7982593dd1a2e0db605d429186", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "payload_hash", + "description": "Decoded shell script", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "SHA-256 of decoded shell script from 3-stage chain — deploys .ctxs.receiver webshell, patches httpd.conf (Alias/AliasMatch for receiver.min.css + hex variants), enables PHP engine, kill -HUP httpd. Source: Unit42 threat brief.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "709f0879-af79-4d79-a1d0-dccd855eac3d", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "unit42" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Published community webshell/payload hash aggregation", + "Secondary-source artifact; validate cited original report.", + "payload_hash" + ], + "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; payload_hash", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f5816171-a941-52ac-bb19-94d0648bc8e8", + "type": "sha256", + "value": "7add390ceee4a1373211b3e340451b34f08965fc4d805f94c9b8cebdc0775774", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "esentire", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "observations": [ + { + "status": "reference_only", + "role": "SHA256 hash of webshell (.deb variant)", + "description": "SHA256 hash of webshell (.deb variant)", + "confidence": "published", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "esentire", + "published": "2026-09-29", + "retrieved": "2026-10-01T19:36:45.424617+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "esentire", + "poppelgaard" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Published community webshell/payload hash aggregation", + "SHA256 hash of webshell (.deb variant)" + ], + "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; SHA256 hash of webshell (.deb variant)", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-9612b66f-4245-59ae-9405-057c997c80a0", + "type": "sha256", + "value": "927c7fbef2e620c1ce482c3ed67ebf53da97693c1d6c7552c77aec84ba982cf8", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Platypus agent (shell script) retrieved from entretiensol[.]com", + "role": "Platypus agent (shell script) retrieved from entretiensol[.]com", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Platypus agent (shell script) retrieved from entretiensol[.]com", + "Published community webshell/payload hash aggregation" + ], + "role": "Platypus agent (shell script) retrieved from entretiensol[.]com; Published community webshell/payload hash aggregation", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-d33d9d79-6b65-5e52-902a-b1c4b3e17959", + "type": "sha256", + "value": "974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "ifin-event", + "levelblue", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published hash for update_c08937.pl; no independently acquired sample.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "update_c08937.pl", + "description": "update_c08937.pl", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "SHA-256 of update_c08937.pl — Perl post-exploitation payload. Creates local account sec_monitor with superuser role in ns.conf, archives /flash/nsconfig to /tmp/update_result_3567cs.tgz, uploads to 64.94.85.67:443, chmod 6555 /bin/sh, deploys PHP webshell at /var/netscaler/logon/LogonPoint/.local_journal with httpd.conf AliasMatch to CSS-like URLs (LogonUISimple.html.style.min.css and hex variants). Self-deletes after execution. Source: LevelBlue THOR team.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "7959b6fc-84f3-40e2-af66-790edcc1fe97", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Perl script update_c08937.pl ", + "role": "Perl script update_c08937.pl ", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "ifin-event", + "levelblue", + "poppelgaard" + ], + "roles": [ + "Perl script update_c08937.pl ", + "Published community webshell/payload hash aggregation", + "Secondary-source artifact; validate cited original report.", + "reference_indicator", + "update_c08937.pl" + ], + "role": "Perl script update_c08937.pl ; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; reference_indicator; update_c08937.pl", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-965e969a-aa75-541b-9191-d544bf92ca6e", + "type": "sha256", + "value": "9c7bf01d2c2cb31a3609d27c1bc9abc60d86e37b7f9908547e0c75fb18b99aab", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Perl script returned from /xd7h/nsmon.pl. ", + "role": "Perl script returned from /xd7h/nsmon.pl. ", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "arctic-wolf", + "poppelgaard" + ], + "roles": [ + "Perl script returned from /xd7h/nsmon.pl. ", + "Published community webshell/payload hash aggregation" + ], + "role": "Perl script returned from /xd7h/nsmon.pl. ; Published community webshell/payload hash aggregation", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-c7329309-8c04-5ce5-8303-92e89a112f48", + "type": "sha256", + "value": "ae22ef2517b5c0fb47f78745b9cb5260acee0e751b89bcd354640ff8bc8d29ec", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "unit42" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "status": "reference_only", + "role": "payload_hash", + "description": "nsg64.deb PHP webshell", + "confidence": "published", + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "unit42", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:36:45.064965+00:00" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "SHA-256 of nsg64.deb — .deb PHP webshell with RC4 C2. Key: 7489a0f93c67fa5cdaeb4b921d90594d (MD5 of passphrase Rhfajaf1H992). Commands: cmd (shell_exec), size (wc -c), dl (file exfil), up (file write), info (PHP version). Uses /var/netscaler/.ns_suidcmd for privesc. Source: Unit42 threat brief.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "8dafb7e1-c580-41a2-b52a-0a685eec02ae", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "unit42" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Published community webshell/payload hash aggregation", + "Secondary-source artifact; validate cited original report.", + "payload_hash" + ], + "role": "Community-repeated published webshell or payload hash; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.; payload_hash", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-cd3ee9e8-d0e7-5eec-886c-fef590f7be79", + "type": "sha256", + "value": "e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published hash for main.py; no independently acquired sample.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "main.py", + "description": "main.py", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "SHA-256 of main.py — Python reverse-shell payload. Overwrites /var/python/bin/customsnmpd with code that connects to 45.141.21.130:443, redirects stdin/stdout/stderr to socket, launches /bin/sh. Also kills existing customsnmpd processes. Source: LevelBlue THOR team.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "eac3991b-e3a0-4335-8180-a32bddf999e7", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue" + ], + "roles": [ + "Secondary-source artifact; validate cited original report.", + "main.py", + "reference_indicator" + ], + "role": "Secondary-source artifact; validate cited original report.; main.py; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-161bf202-a189-53a3-9a30-5f9ffcca29b2", + "type": "sha256", + "value": "ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1", + "status": "reference_only", + "source_ids": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "rapid7" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh", + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" + ], + "observations": [ + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "PHP webshell .ctxs.receiver — backdoor on NetScaler LogonPoint. passthru(urldecode($_COOKIE[\"NSC_TASS\"])) triggered by CsrfToken cookie match. 237 bytes. Token likely varies per victim — grep for content pattern, not just hash. Source: Reddit user K7Fy6fWmTv76D3qAPn via Discourse post #6.", + "misp_type": "sha256", + "misp_to_ids": true, + "attribute_uuid": "7d28869f-a134-4b95-9ed2-735c7866a52f", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Hidden PHP webshell hash.", + "role": "Hidden PHP webshell hash.", + "confidence": "high", + "status": "reference_only", + "source_ids": [ + "rapid7" + ], + "source_urls": [ + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "rapid7", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039385+00:00" + } + ] + }, + { + "status": "reference_only", + "role": "Published community webshell/payload hash aggregation", + "confidence": "low", + "description": "Published community webshell/payload hash aggregation", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "poppelgaard", + "published": null, + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Community-repeated published webshell or payload hash", + "confidence": "low", + "description": "Community-repeated published webshell or payload hash", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "deyda-script", + "published": null, + "retrieved": "2026-10-01" + } + ] + } + ], + "source": [ + "deyda-script", + "ifin-event", + "poppelgaard", + "rapid7" + ], + "roles": [ + "Community-repeated published webshell or payload hash", + "Hidden PHP webshell hash.", + "Published community webshell/payload hash aggregation", + "Secondary-source artifact; validate cited original report." + ], + "role": "Community-repeated published webshell or payload hash; Hidden PHP webshell hash.; Published community webshell/payload hash aggregation; Secondary-source artifact; validate cited original report.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-ed202314-1f91-5a66-8c36-502623bdbfd3", + "type": "url", + "value": "http://134.175.71.50:4123/1", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://134.175.71[.]50:4123/1", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-49be21fd-6b54-51f3-8ab5-6c4b65bcd3a6", + "type": "url", + "value": "http://153.75.82.220/download/x.sh", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://153.75.82[.]220/download/x.sh", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-48342f6c-9687-5227-9482-717ab428c77c", + "type": "url", + "value": "http://177.4.12.11:8080/s?t=a", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://177.4.12[.]11:8080/s?t=a", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-59dd2664-9887-539e-bc3a-b8972625933a", + "type": "url", + "value": "http://177.4.12.11:8080/s?t=b", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://177.4.12[.]11:8080/s?t=b", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f3832e49-bc15-5a17-a33a-d18bcebaf835", + "type": "url", + "value": "http://177.4.12.11:8080/s?t=c", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://177.4.12[.]11:8080/s?t=c", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-4624107f-3f54-58f3-8634-aa9218c919d2", + "type": "url", + "value": "http://23.27.143.20:9000/main.py", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published endpoint; do not contact it.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Python reverse-shell payload", + "description": "Python reverse-shell payload", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Python reverse-shell payload — overwrites /var/python/bin/customsnmpd with code connecting to 45.141.21.130:443. Source: LevelBlue THOR team.", + "misp_type": "url", + "misp_to_ids": true, + "attribute_uuid": "daacdefc-6b6a-483e-885d-002f64346944", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "medium", + "status": "reference_only", + "original_value": "hxxp:/23.27.143[.]20:9000/main.py", + "normalization_inferred": true, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "roles": [ + "Payload retrieval or execution-check resource.", + "Python reverse-shell payload", + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "Payload retrieval or execution-check resource.; Python reverse-shell payload; Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-fb0b6f32-e20b-516a-951b-69158d6910a7", + "type": "url", + "value": "http://31.56.197.72/kk", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://31.56.197[.]72/kk", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-01772fb3-a35a-5447-8d2c-7a4665bcea56", + "type": "url", + "value": "http://31.56.197.72/lula", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://31.56.197[.]72/lula", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-aa684f87-82f4-590c-83ba-1d285df74fb8", + "type": "url", + "value": "http://31.56.197.72:9090/lula", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published endpoint; do not contact it.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Payload download URL", + "description": "Payload download URL", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Payload download URL — retrieved via curl/wget during CVE-2026-88771 exploitation. Source: LevelBlue THOR team.", + "misp_type": "url", + "misp_to_ids": true, + "attribute_uuid": "510806c9-df51-4b1f-b985-d2b469471b7c", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://31.56.197[.]72:9090/lula", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "roles": [ + "Payload download URL", + "Payload retrieval or execution-check resource.", + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "Payload download URL; Payload retrieval or execution-check resource.; Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-3c8206c9-a9db-5cdc-9a56-2b845387e628", + "type": "url", + "value": "http://62.133.62.80:80/xd7h/nsmon.pl", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://62.133.62[.]80:80/xd7h/nsmon.pl", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-daac9d9a-2c5d-56e4-aa37-20aea1d31b0f", + "type": "url", + "value": "http://62.133.62.80:80/xd7h/x", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published endpoint; do not contact it.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Payload download URL", + "description": "Payload download URL", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Payload download URL — retrieved via curl/wget during CVE-2026-88771 exploitation. Source: LevelBlue THOR team.", + "misp_type": "url", + "misp_to_ids": true, + "attribute_uuid": "b81cc60d-d93f-4c6d-8fb7-fb32a71a2fff", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://62.133.62[.]80:80/xd7h/x", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "roles": [ + "Payload download URL", + "Payload retrieval or execution-check resource.", + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "Payload download URL; Payload retrieval or execution-check resource.; Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-fbf3d4d7-beec-524f-83a0-e51a211662b3", + "type": "url", + "value": "http://64.94.85.67:443/update_c08937.pl", + "status": "reference_only", + "source_ids": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published endpoint; do not contact it.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Perl post-exploitation payload", + "description": "Perl post-exploitation payload", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Perl post-exploitation payload — creates sec_monitor account with superuser role, chmod 6555 /bin/sh, deploys .local_journal webshell, exfiltrates /flash/nsconfig. Piped directly to perl. Source: LevelBlue THOR team.", + "misp_type": "url", + "misp_to_ids": true, + "attribute_uuid": "d56c3308-357e-4afc-9a60-bb3159c70497", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + }, + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://64.94.85[.]67:443/update_c08937.pl", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf", + "ifin-event", + "levelblue" + ], + "roles": [ + "Payload retrieval or execution-check resource.", + "Perl post-exploitation payload", + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "Payload retrieval or execution-check resource.; Perl post-exploitation payload; Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-6b2c5f46-4b51-542a-ac4a-22a82ca18d34", + "type": "url", + "value": "http://64.94.85.67:443/update_result_3567cs.tgz", + "status": "reference_only", + "source_ids": [ + "ifin-event", + "levelblue" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "status": "reference_only", + "description": "Published endpoint; do not contact it.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "status": "reference_only", + "role": "Configuration exfiltration endpoint", + "description": "Configuration exfiltration endpoint", + "confidence": "published", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "levelblue", + "published": "2026-09-30", + "retrieved": "2026-10-01" + } + ] + }, + { + "description": "Secondary-source artifact; validate cited original report.", + "role": "Secondary-source artifact; validate cited original report.", + "confidence": "low", + "status": "reference_only", + "original_comment": "Configuration exfiltration endpoint — upload target for archived /flash/nsconfig data. Source: LevelBlue THOR team.", + "misp_type": "url", + "misp_to_ids": true, + "attribute_uuid": "2626a32d-8681-41ba-9c7c-92b04c345976", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "ifin-event", + "published": "2026-09-28", + "retrieved": "2026-10-01T19:44:37.039091+00:00" + } + ] + } + ], + "source": [ + "ifin-event", + "levelblue" + ], + "roles": [ + "Configuration exfiltration endpoint", + "Secondary-source artifact; validate cited original report.", + "reference_indicator" + ], + "role": "Configuration exfiltration endpoint; Secondary-source artifact; validate cited original report.; reference_indicator", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-f641d7d2-2d09-5490-8a90-d24e12541532", + "type": "url", + "value": "http://68.178.160.183:8888/test", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://68.178.160[.]183:8888/test", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-a72639b6-e8bd-5954-bc27-e56981f25122", + "type": "url", + "value": "http://68.178.160.183:8899/test111", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://68.178.160[.]183:8899/test111", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + }, + { + "id": "ioc-e1cab8ac-c435-58ec-a680-0b71d0f945dd", + "type": "url", + "value": "http://89.44.80.7:65456/exec-ok", + "status": "reference_only", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "description": "Payload retrieval or execution-check resource.", + "role": "Payload retrieval or execution-check resource.", + "confidence": "high", + "status": "reference_only", + "original_value": "hxxp://89.44.80[.]7:65456/exec-ok", + "normalization_inferred": false, + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "original_status": "reference_only", + "source_dates": [ + { + "id": "arctic-wolf", + "published": "2026-09-30", + "retrieved": "2026-10-01T19:44:37.039386+00:00" + } + ] + } + ], + "source": [ + "arctic-wolf" + ], + "roles": [ + "Payload retrieval or execution-check resource." + ], + "role": "Payload retrieval or execution-check resource.", + "description": "Published reference; evaluate the original source role, observation date and surrounding local evidence. A match does not establish compromise.", + "matching": "exact", + "context_only": false + } + ], + "patterns": [ + { + "id": "log_poisoning", + "sigma_rule_id": "db5aa260-5141-5e4b-91a4-a7883d81a9a4", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)pitboss.*(?:NSPPE|PPE).*(?:unexpectedly died|missed too many heartbeats).*?(?:[;`|]|\\$\\{)", + "description": "Process-monitor text contains shell metacharacters; inspect for log poisoning or injected command text. This does not prove execution.", + "source": [], + "source_ids": [], + "source_urls": [], + "observations": [] + }, + { + "id": "engine_crash", + "sigma_rule_id": "0390ae7b-c88e-5b57-afa4-dc2575ee1d66", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)(?:^|\\s)pitboss(?:\\[\\d+\\])?:.*(?:NOT restarting|core dumped|unexpectedly died)|qat\\d+:.*orphan rings", + "description": "A process or accelerator failure is logged. Correlate with requests and restart records; a crash alone does not establish exploitation.", + "source": [], + "source_ids": [], + "source_urls": [], + "observations": [] + }, + { + "id": "dtls_error", + "sigma_rule_id": "5cb2d3c3-bb26-581e-be5a-3594b3aec4f7", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)DTLSv1\\.0.*handshake failure.internal error", + "description": "A DTLS handshake internal error is present. This is a diagnostic signal, not proof of a successful attack.", + "source": [], + "source_ids": [], + "source_urls": [], + "observations": [] + }, + { + "id": "command_injection", + "sigma_rule_id": "2f64329b-edfa-5d35-9711-186f4860e6ef", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)(?:curl|wget)\\s.*(?:https?://|\\$\\{IFS\\})|b64decode|\\$\\{IFS\\}|(?:;|`)(?:id|hostname|sleep)\\b|/(?:vpn|logon)/[^\\s?\"<>]*\\.php\\?(?:0|x|cmd|exec|command)=(?:echo[ \\t]+[^\\r\\n&;|<>]{1,128}|id|date)(?:[ \\t]*&&[ \\t]*(?:date|id))*(?:[ \\t]*$|[ \\t]*[)\"<>]|[ \\t]+HTTP/)", + "description": "Command-download or injection syntax, including diagnostic command probes against PHP routes under /vpn/ or /logon/. Requests, blocked probes and authorized testing are not evidence of execution.", + "source": [], + "source_ids": [], + "source_urls": [], + "observations": [], + "implementation_note": "Local detector refinement: contextual command probes and narrower handler-extension matching; source observations remain unchanged." + }, + { + "id": "php_execution", + "sigma_rule_id": "85769f76-e95b-5b33-bb3f-295709f4eaf3", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)<\\?php|(?:passthru|shell_exec|base64_decode)\\s*\\(", + "description": "PHP source or execution/decoding functions appear in the text. Inspect the complete payload and file evidence; a text match does not establish server-side execution.", + "source": [], + "source_ids": [], + "source_urls": [], + "observations": [] + }, + { + "id": "privilege_persistence", + "sigma_rule_id": "9d719506-517e-50fb-9675-48d2907c8733", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)chmod\\s+(?:[467][0-7]{3}|u\\+s).*?/bin/sh|AddHandler.*php|AliasMatch|authorized_keys|add system user", + "description": "The text references permission changes, executable web handlers, SSH keys, or account creation. Verify authorization and actual state changes before attributing persistence.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_suid_shell", + "description": "Sets privileged shell permissions.", + "caveat": "Actual execution/filesystem state is stronger than command appearing in an injected username.", + "correlation": null, + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_suid_shell" + } + ] + }, + { + "id": "traversal", + "sigma_rule_id": "e39745df-f20d-5ecb-831a-1c848b265a4d", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)/(?:vpn|vpns)/\\.\\./|/etc/passwd|/\\.git/|/\\.env(?:\\s|\\?)|Path traversal detected[ \\t]*\\|/|/cgi-bin/(?:\\.\\./)+", + "description": "The text references traversal syntax or commonly probed sensitive paths. Check response content and related events; the request alone does not prove disclosure.", + "source": [], + "source_ids": [], + "source_urls": [], + "observations": [] + }, + { + "id": "encoded_user_agent", + "sigma_rule_id": "d90f1337-428b-5156-adaf-3cba3906c11c", + "origin": { + "provenance_type": "locally_authored_generic_heuristic", + "scope_not_campaign_specific": true, + "description": "Inherited local triage heuristic. External observations attached separately provide supporting context, not a claim of original derivation." + }, + "pattern": "(?i)(?:\"(?:INDEX|[A-Za-z0-9]{1,12}):[A-Za-z0-9+/]{32,}={0,2}\"|User-Agent[^\\r\\n]*(?:INDEX|C2|3P|4B):?[A-Za-z0-9+/]{40,})", + "description": "A quoted marker and Base64-shaped value were found. Review bounded decoding results; this pattern alone does not establish a malicious payload.", + "source": [ + "cert-eu", + "unit42" + ], + "source_ids": [ + "cert-eu", + "unit42" + ], + "source_urls": [ + "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "id": "cert_staged_index", + "description": "Base64 staging marker in HTTP User-Agent.", + "caveat": "Decode offline; marker alone is staging, not execution.", + "correlation": null, + "source_ids": [ + "cert-eu" + ], + "source_urls": [ + "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771" + ], + "matching": "pattern", + "mapped_from": "cert_staged_index" + }, + { + "id": "unit42_variable_stage_marker", + "description": "Observed short staging prefixes vary; candidate must occur in User-Agent and decode to code.", + "caveat": "Low-specificity without HTTP field context; do not match arbitrary text alone.", + "correlation": null, + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "matching": "pattern", + "mapped_from": "unit42_variable_stage_marker" + } + ] + }, + { + "id": "ti_dtls_internal_error", + "sigma_rule_id": "f2b2bc2b-d781-56e6-a464-5731efb85c10", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)SSL_HANDSHAKE_FAILURE.*DTLSv1\\.0.*Handshake failure-Internal Error", + "description": "DTLS error; insufficient on its own to establish code execution.", + "source": [ + "CERTFR-2026-ALE-011", + "mandiant" + ], + "source_ids": [ + "CERTFR-2026-ALE-011", + "mandiant" + ], + "source_urls": [ + "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_dtls_crash", + "description": "DTLS failure associated with observed exploitation.", + "caveat": "An isolated handshake failure is not conclusive.", + "correlation": "Correlate qat orphan rings and NSPPE pitboss termination on same appliance in a short interval.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_dtls_crash" + }, + { + "id": "certfr_dtls_handshake", + "description": "Joint DTLS/cipher/internal-error log pattern; contextual lead, not standalone success verdict.", + "status": "reference_only", + "published": "2026-09-30", + "retrieved": "2026-10-01", + "use_or_omission_reason": "Map to existing Google-derived detection; add secondary provenance rather than duplicate a rule. No ANSSI independent qualification.", + "source_ids": [ + "CERTFR-2026-ALE-011" + ], + "source_urls": [ + "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/" + ], + "matching": "pattern", + "mapped_from": "certfr_dtls_handshake" + } + ] + }, + { + "id": "ti_nsppe_orphan", + "sigma_rule_id": "5aef80fe-3a2a-5f9e-b109-7d768d0a8f23", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)NSPPE-\\d+.*exit with orphan rings", + "description": "Process termination indicator.", + "source": [ + "CERTFR-2026-ALE-011", + "mandiant" + ], + "source_ids": [ + "CERTFR-2026-ALE-011", + "mandiant" + ], + "source_urls": [ + "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_qat_orphans", + "description": "NSPPE abnormal exit signal paired with DTLS failure.", + "caveat": "Crashes have benign causes.", + "correlation": null, + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_qat_orphans" + }, + { + "id": "certfr_nsppe_orphan", + "description": "Packet-engine orphan-ring message; correlate with nearby restart suppression and other evidence.", + "status": "reference_only", + "published": "2026-09-30", + "retrieved": "2026-10-01", + "use_or_omission_reason": "Map to existing Google-derived detection; add secondary provenance rather than duplicate a rule. No ANSSI independent qualification.", + "source_ids": [ + "CERTFR-2026-ALE-011" + ], + "source_urls": [ + "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/" + ], + "matching": "pattern", + "mapped_from": "certfr_nsppe_orphan" + } + ] + }, + { + "id": "ti_nsppe_not_restart", + "sigma_rule_id": "35bc541e-25f4-5d4b-80e4-b22f2e9ff801", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)pitboss.*NOT restarting NSPPE", + "description": "Indicator that a process was not restarted.", + "source": [ + "CERTFR-2026-ALE-011", + "mandiant" + ], + "source_ids": [ + "CERTFR-2026-ALE-011", + "mandiant" + ], + "source_urls": [ + "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "certfr_pitboss_restart", + "description": "Restart suppression message; preserve PID/device/time and correlate, allowing benign crash context.", + "status": "reference_only", + "published": "2026-09-30", + "retrieved": "2026-10-01", + "use_or_omission_reason": "Map to existing Google-derived detection; add secondary provenance rather than duplicate a rule. No ANSSI independent qualification.", + "source_ids": [ + "CERTFR-2026-ALE-011" + ], + "source_urls": [ + "https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/" + ], + "matching": "pattern", + "mapped_from": "certfr_pitboss_restart" + } + ] + }, + { + "id": "ti_shell_headers", + "sigma_rule_id": "f2336666-9fca-5688-93b7-bf4fa85e082e", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)(?:HTTP_)?(?:NSC[-_]LDAP|NSC[-_]CLIENTTYPE|X[-_]UX(?:[-_]\\d+)?)", + "description": "Header hunting pattern.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_header_transport", + "description": "Header channels used by reported PHP implants.", + "caveat": "Header name is contextual; require encoded payload, suspicious route or implant evidence.", + "correlation": null, + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_header_transport" + } + ] + }, + { + "id": "ti_php_handler", + "sigma_rule_id": "2fe32158-28e3-5512-8640-f713c7f6d2c0", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)Add(?:Handler|Type)\\s+[^\\r\\n]*application/x-httpd-php(?:-source)?\\s+(?:\\.[A-Za-z0-9]+[ \\t]+)*\\.(?:deb|sig|ico|css|js|png|gif|jpg)\\b", + "description": "PHP handler mapped to a non-PHP artifact extension such as .deb or .sig. Ordinary .php/.phps mappings alone do not match; verify whether this is a requested change or an actual configuration change.", + "source": [ + "mandiant", + "sygnia" + ], + "source_ids": [ + "mandiant", + "sygnia" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "id": "mandiant_nonphp_handler", + "description": "PHP handler registration for non-PHP extension.", + "caveat": "Validate appliance configuration baseline.", + "correlation": null, + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_nonphp_handler" + }, + { + "id": "sygnia-php-handlers", + "description": "PHP handler mapping for disguised file extensions.", + "status": "experimental", + "confidence": "medium", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "matching": "pattern", + "mapped_from": "sygnia-php-handlers" + } + ], + "implementation_note": "Local detector refinement: contextual command probes and narrower handler-extension matching; source observations remain unchanged." + }, + { + "id": "ti_staged_webshell", + "sigma_rule_id": "3aa3db2c-e2c7-583d-9203-e96833e5b5c2", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)/vpn/scripts/linux/(?:nsginstaller[^\\s/?]*\\.deb|nsgclient[^\\s/?]*\\.(?:deb|sig)|[^\\s/?]+\\.php)", + "description": "Path pattern for webshell hunting.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_staging_paths", + "description": "Published staging path patterns; .deb directory also contains legitimate packages.", + "caveat": "Review context and actual execution separately.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_staging_paths" + } + ] + }, + { + "id": "ti_log_poisoning", + "sigma_rule_id": "3ec17436-eb51-5768-9b72-aece3b7d907a", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)pitboss[^\\r\\n]*(?:NSPPE|PPE)[^\\r\\n]*(?:;|`|\\$\\{?IFS\\}?|%3b|%60|%24%28)", + "description": "Potentially manipulated text; establish subsequent processing independently.", + "source": [ + "cert-eu", + "sygnia", + "watchtowr", + "watchtowr-repo" + ], + "source_ids": [ + "cert-eu", + "sygnia", + "watchtowr", + "watchtowr-repo" + ], + "source_urls": [ + "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771", + "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", + "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "id": "cert_log_poisoning", + "description": "Authentication data imitates a crash line and appends commands.", + "caveat": "Failed authentication does not rule out later execution.", + "correlation": "Same appliance: staged access-log marker, poisoned auth event, ns_monuploadd_err.pl invocation, then side effects.", + "source_ids": [ + "cert-eu" + ], + "source_urls": [ + "https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771" + ], + "matching": "pattern", + "mapped_from": "cert_log_poisoning" + }, + { + "id": "sygnia-pitboss-command", + "description": "Crash-like authentication text with command delimiter; injection attempt, not proof of execution.", + "status": "experimental", + "confidence": "medium", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "matching": "pattern", + "mapped_from": "sygnia-pitboss-command" + }, + { + "id": "watchtowr_crash_injection", + "description": "Crash-like text followed by command syntax, including the public artifact-generator form.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "watchtowr", + "watchtowr-repo" + ], + "source_urls": [ + "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", + "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/" + ], + "matching": "pattern", + "mapped_from": "watchtowr_crash_injection" + } + ] + }, + { + "id": "ti_delayed_processor", + "sigma_rule_id": "324d542c-d00d-5ee9-be43-7f6e44d30afa", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)ns_monuploadd_err\\.pl", + "description": "Indicator of possible subsequent processing.", + "source": [ + "watchtowr" + ], + "source_ids": [ + "watchtowr" + ], + "source_urls": [ + "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/" + ], + "observations": [] + }, + { + "id": "ti_css_journal", + "sigma_rule_id": "db27552c-3c30-5a99-9e82-7ec76c7ba3cd", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)LogonUISimple\\.html\\.style(?:\\.[a-f0-9]+)?\\.min\\.css|\\.local_journal", + "description": "CSS disguise and journal artifact pattern.", + "source": [ + "levelblue" + ], + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "id": "levelblue_local_journal_alias", + "description": "Reported .local_journal masquerading route.", + "caveat": "CSS names may overlap legitimate assets; require PHP alias/content corroboration.", + "correlation": null, + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "matching": "pattern", + "mapped_from": "levelblue_local_journal_alias" + } + ] + }, + { + "id": "unit42_cookie_execution", + "sigma_rule_id": "623305d2-16b6-5710-adc8-b762522af1be", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?is)(?:CsrfToken.*NSC_TASS|NSC_TASS.*CsrfToken)", + "description": "Paired implant cookies; NSC_TASS carries URL-encoded command.", + "source": [ + "unit42" + ], + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "id": "unit42_cookie_execution", + "description": "Paired implant cookies; NSC_TASS carries URL-encoded command.", + "caveat": "Legitimate cookie names alone are insufficient; decode value and examine destination/response.", + "correlation": null, + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "matching": "pattern", + "mapped_from": "unit42_cookie_execution" + } + ] + }, + { + "id": "unit42_receiver_alias", + "sigma_rule_id": "48774954-8559-562c-902a-2ba8a75f2e2c", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)/logon/LogonPoint/custom/receiver\\.min(?:\\.[0-9a-f]+)?\\.css", + "description": "CSS-disguised webshell route.", + "source": [ + "ifin-event", + "unit42" + ], + "source_ids": [ + "ifin-event", + "unit42" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json", + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "id": "unit42_receiver_alias", + "description": "CSS-disguised webshell route.", + "caveat": "Confirm alias or shell content; request alone does not prove execution.", + "correlation": null, + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "matching": "pattern", + "mapped_from": "unit42_receiver_alias" + }, + { + "id": "ifin-css-hex-alias", + "description": "Community-reported alias pattern; verify context.", + "status": "experimental", + "confidence": "medium", + "source_ids": [ + "ifin-event" + ], + "source_urls": [ + "https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json" + ], + "matching": "pattern", + "mapped_from": "ifin-css-hex-alias" + } + ] + }, + { + "id": "unit42_anomalous_getusername", + "sigma_rule_id": "31940357-e53f-57f8-b908-9599b0913fd2", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "/logon/LogonPoint/Authentication/GetUserName", + "description": "Repeated pre-disclosure activity to anomalous endpoint.", + "source": [ + "unit42" + ], + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "observations": [ + { + "id": "unit42_anomalous_getusername", + "description": "Repeated pre-disclosure activity to anomalous endpoint.", + "caveat": "Investigative signal; no standalone exploitation conclusion.", + "correlation": null, + "source_ids": [ + "unit42" + ], + "source_urls": [ + "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/" + ], + "matching": "pattern", + "mapped_from": "unit42_anomalous_getusername" + } + ] + }, + { + "id": "mandiant_slapshot_launch", + "sigma_rule_id": "86c468d2-0afc-5eb2-9070-62a4d0f0ba42", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?is)nohup\\s+python.*base64.*\\.uxdport.*\\.uxdlock", + "description": "Detached encoded Python tunneler launch with hidden IPC files.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_slapshot_launch", + "description": "Detached encoded Python tunneler launch with hidden IPC files.", + "caveat": "Do not execute the decoded code.", + "correlation": null, + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_slapshot_launch" + } + ] + }, + { + "id": "mandiant_fato_webshell", + "sigma_rule_id": "5614e015-a1e0-5c80-bce4-f20f3e689a50", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?is).*", + "description": "PHP implant framing markers.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_fato_webshell", + "description": "PHP implant framing markers.", + "caveat": "Combine with NSC header parsing and dynamic execution; markup alone insufficient.", + "correlation": null, + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_fato_webshell" + } + ] + }, + { + "id": "esentire_php_useragent", + "sigma_rule_id": "a5f6d8e8-e170-5aae-a7a2-710beac8ee28", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)/vpn/media/[^\\s\"?]+\\.ico.*PD9[A-Za-z0-9+/]{20,}", + "description": "Icon request followed by encoded PHP staging in User-Agent.", + "source": [ + "esentire" + ], + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "observations": [ + { + "id": "esentire_php_useragent", + "description": "Icon request followed by encoded PHP staging in User-Agent.", + "caveat": "HTTP404 is expected for both unsuccessful staging and active stealth webshell responses.", + "correlation": "Correlate poisoned auth event, script invocation, changed handlers/files and outbound/lateral traffic.", + "source_ids": [ + "esentire" + ], + "source_urls": [ + "https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772" + ], + "matching": "pattern", + "mapped_from": "esentire_php_useragent" + } + ] + }, + { + "id": "levelblue_backtick_poisoning", + "sigma_rule_id": "11c3813f-894b-51f6-80fb-d7dab0c0e8dd", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)pitboss.*NSPPE.*`.*(?:tar|curl|wget|cat).*`.*unexpectedly died", + "description": "Backtick substitution variant can avoid semicolon-only detections.", + "source": [ + "levelblue" + ], + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "id": "levelblue_backtick_poisoning", + "description": "Backtick substitution variant can avoid semicolon-only detections.", + "caveat": "", + "correlation": null, + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "matching": "pattern", + "mapped_from": "levelblue_backtick_poisoning" + } + ] + }, + { + "id": "levelblue_config_staging", + "sigma_rule_id": "5907a6d1-0c74-5eae-9e9b-588c0bab859d", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?is)(?:cat|cp|tar).*?/flash/nsconfig.*(?:>|/var/netscaler/logon)|(?:tar|cat).*?/var/netscaler/logon.*?/flash/nsconfig", + "description": "Copies or archives configuration into web-accessible files.", + "source": [ + "levelblue" + ], + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "observations": [ + { + "id": "levelblue_config_staging", + "description": "Copies or archives configuration into web-accessible files.", + "caveat": "Validate command execution and HTTP retrieval or network exfiltration.", + "correlation": null, + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "matching": "pattern", + "mapped_from": "levelblue_config_staging" + } + ] + }, + { + "id": "mandiant_icon_route", + "sigma_rule_id": "052a9870-fe4b-5b43-8261-5e523636590b", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)AliasMatch.*?/vpn/media/.*?/var/netscaler/gui/vpn/scripts/linux/.*?\\.sig", + "description": "Icon-to-signature PHP routing persistence.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_icon_route", + "description": "Icon-to-signature PHP routing persistence.", + "caveat": "Review context and actual execution separately.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_icon_route" + } + ] + }, + { + "id": "mandiant_php_execution", + "sigma_rule_id": "79c6ea05-8efd-51b4-8fd2-79613054863d", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?is)(?:HTTP_)?NSC_(?:LDAP|CLIENTTYPE|USER|NONCE|FT_HIDE).*?(?:eval|shell_exec|passthru|system).*?base64_decode", + "description": "Header parsing combined with encoded dynamic PHP execution; inspect full file when statements occur across lines.", + "source": [ + "mandiant" + ], + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "observations": [ + { + "id": "mandiant_php_execution", + "description": "Header parsing combined with encoded dynamic PHP execution; inspect full file when statements occur across lines.", + "caveat": "Review context and actual execution separately.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "matching": "pattern", + "mapped_from": "mandiant_php_execution" + } + ] + }, + { + "id": "aw-resource-prefix-1", + "sigma_rule_id": "985490ff-cbe4-50e7-b4a9-f962543255af", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "http://89\\.44\\.80\\.7:65456/", + "description": "Incomplete dynamic or redacted URL prefix; not exact IOC.", + "source": [ + "arctic-wolf" + ], + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "id": "aw-resource-prefix-1", + "description": "Incomplete dynamic or redacted URL prefix; not exact IOC.", + "status": "experimental", + "confidence": "medium", + "original_value": "hxxp://89.44.80[.]7:65456/$(id|base64 -w0)", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "matching": "pattern", + "mapped_from": "aw-resource-prefix-1" + } + ] + }, + { + "id": "aw-resource-prefix-2", + "sigma_rule_id": "7ff4a684-f5e1-50b6-b543-ba30ae52818c", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "http://130\\.94\\.42\\.226:18805/\\?t=", + "description": "Incomplete dynamic or redacted URL prefix; not exact IOC.", + "source": [ + "arctic-wolf" + ], + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "id": "aw-resource-prefix-2", + "description": "Incomplete dynamic or redacted URL prefix; not exact IOC.", + "status": "experimental", + "confidence": "medium", + "original_value": "hxxp://130.94.42[.]226:18805/?t=", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "matching": "pattern", + "mapped_from": "aw-resource-prefix-2" + } + ] + }, + { + "id": "aw-nsmon-cron", + "sigma_rule_id": "6bb4bd57-96bf-5bf5-b2b2-36ce721d4902", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)\\*/5\\s+\\*\\s+\\*\\s+\\*\\s+\\*\\s+root\\s+perl\\s+/var/tmp/\\.nsmon/nsmon\\.pl", + "description": "Root cron invokes reported hidden Perl implant every five minutes.", + "source": [ + "arctic-wolf" + ], + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "id": "aw-nsmon-cron", + "description": "Root cron invokes reported hidden Perl implant every five minutes.", + "status": "experimental", + "confidence": "medium", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "matching": "pattern", + "mapped_from": "aw-nsmon-cron" + } + ] + }, + { + "id": "aw-encoded-command-output", + "sigma_rule_id": "7f6eb722-0be4-581f-bed5-10d8d3b26247", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)\\bid\\s*\\|\\s*base64\\s+-w\\s*0", + "description": "Identity output encoding; corroborate HTTP callback before declaring exfiltration.", + "source": [ + "arctic-wolf" + ], + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "id": "aw-encoded-command-output", + "description": "Identity output encoding; corroborate HTTP callback before declaring exfiltration.", + "status": "experimental", + "confidence": "medium", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "matching": "pattern", + "mapped_from": "aw-encoded-command-output" + } + ] + }, + { + "id": "rapid7-tar-config", + "sigma_rule_id": "156c151e-13b0-5dd7-a22c-07bdb4af9327", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)\\btar(?:\\$\\{?IFS\\}?|\\s)+czf.*?/var/netscaler/gui/vpn/c\\b.*?(?:/flash|nsconfig)", + "description": "Configuration archive staged under web root; command presence is not proof of execution.", + "source": [ + "rapid7" + ], + "source_ids": [ + "rapid7" + ], + "source_urls": [ + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" + ], + "observations": [ + { + "id": "rapid7-tar-config", + "description": "Configuration archive staged under web root; command presence is not proof of execution.", + "status": "experimental", + "confidence": "medium", + "original_command": "tar${IFS}czf$IFS/var/netscaler/gui/vpn/c$IFS-C$IFS/flash${IFS}nsconfig", + "normalized_command": "tar czf /var/netscaler/gui/vpn/c -C /flash nsconfig", + "source_ids": [ + "rapid7" + ], + "source_urls": [ + "https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/" + ], + "matching": "pattern", + "mapped_from": "rapid7-tar-config" + } + ] + }, + { + "id": "sygnia-encoded-loader", + "sigma_rule_id": "9fb8bb55-fb55-535a-9b4c-6344f8b08bfe", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?im)^(?=.*(?:pitboss|NSPPE))(?=.*(?:base64|PD9))(?=.*(?:2N|httpaccess))", + "description": "Heuristic encoded HTTP-log loader chain; decode payload and check context.", + "source": [ + "sygnia" + ], + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "observations": [ + { + "id": "sygnia-encoded-loader", + "description": "Heuristic encoded HTTP-log loader chain; decode payload and check context.", + "status": "experimental", + "confidence": "medium", + "source_ids": [ + "sygnia" + ], + "source_urls": [ + "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/" + ], + "matching": "pattern", + "mapped_from": "sygnia-encoded-loader" + } + ] + }, + { + "id": "elastic-inspired-crash-shell", + "sigma_rule_id": "a0f728c2-6c21-50e7-9909-ae5df3b77538", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?im)^(?=.*pitboss)(?:(?=.*(?:nsppe|\\bppe\\b|core))|(?=(?>.*?packet).*engine))(?=.*(?:;|`|\\$\\(|&&|\\|\\||%3b|%60|%7c|%24%28|%26%26|%3e|%3c))", + "description": "Independently derived raw-log heuristic: crash-like text and shell syntax. Broader than original field-scoped EQL.", + "source": [ + "elastic-toml" + ], + "source_ids": [ + "elastic-toml" + ], + "source_urls": [ + "https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml" + ], + "observations": [ + { + "id": "elastic-inspired-crash-shell", + "description": "Independently derived raw-log heuristic: crash-like text and shell syntax. Broader than original field-scoped EQL.", + "status": "experimental", + "confidence": "medium", + "license_note": "Original Elastic License v2; source rule not copied into product.", + "source_ids": [ + "elastic-toml" + ], + "source_urls": [ + "https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml" + ], + "matching": "pattern", + "mapped_from": "elastic-inspired-crash-shell" + } + ] + }, + { + "id": "aw-platypus-install-prefix", + "sigma_rule_id": "0a8f1d34-83bb-5ade-bfc8-1bd45f221a27", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "https://entretiensol\\.com:443/api/v1/install/", + "description": "Redacted installer URL prefix; no redacted token treated as exact IOC.", + "source": [ + "arctic-wolf" + ], + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "observations": [ + { + "id": "aw-platypus-install-prefix", + "description": "Redacted installer URL prefix; no redacted token treated as exact IOC.", + "status": "experimental", + "confidence": "medium", + "original_value": "hxxps://entretiensol[.]com:443/api/v1/install/", + "source_ids": [ + "arctic-wolf" + ], + "source_urls": [ + "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md" + ], + "matching": "pattern", + "mapped_from": "aw-platypus-install-prefix" + } + ] + }, + { + "id": "historical_startup_obfuscation", + "sigma_rule_id": "742a1576-1923-58ce-801a-813820e41169", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)fnoc\\.dptth|php\\.(?:xedni|xednimt|IUnogoL)|hs/pmt/rav/|tnioPnogoL|gifnocsn|relacsten\\.cr", + "description": "Historical reversed persistence strings; correlate with startup/configuration modifications.", + "source": [ + "deyda-script", + "ncsc-nl-2025" + ], + "source_ids": [ + "deyda-script", + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "observations": [ + { + "id": "historical_startup_obfuscation", + "description": "Historical reversed persistence strings; correlate with startup/configuration modifications.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "deyda-script", + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "matching": "pattern", + "mapped_from": "historical_startup_obfuscation" + } + ] + }, + { + "id": "php_input_execution", + "sigma_rule_id": "3fafb627-665f-5caa-9a4b-229086449433", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?is)<\\?(?:php)?[^\\r\\n]*(?:eval\\s*\\(\\s*\\$_|(?:base64_decode|passthru|shell_exec|array_filter)\\s*\\()", + "description": "PHP text with input evaluation or decoding; adapted content heuristic, not image metadata validation.", + "source": [ + "fox-it", + "ncsc-nl-2025" + ], + "source_ids": [ + "fox-it", + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025", + "https://github.com/fox-it/citrix-netscaler-triage" + ], + "observations": [ + { + "id": "php_input_execution", + "description": "PHP text with input evaluation or decoding; adapted content heuristic, not image metadata validation.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "fox-it", + "ncsc-nl-2025" + ], + "source_urls": [ + "https://github.com/NCSC-NL/citrix-2025", + "https://github.com/fox-it/citrix-netscaler-triage" + ], + "matching": "pattern", + "mapped_from": "php_input_execution" + } + ] + }, + { + "id": "persistence_target_write", + "sigma_rule_id": "b72b1566-d05a-5fca-8cb4-229fcb59cc95", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)(?:\\b(?:echo|printf|cp|mv|sed|tee)\\b[^\\r\\n]*)(?:rc\\.netscaler|nsafter\\.sh|/etc/rc\\.conf\\.defaults)", + "description": "Command text writes or edits startup targets; compare approved configuration.", + "source": [ + "deyda-script", + "poppelgaard" + ], + "source_ids": [ + "deyda-script", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "observations": [ + { + "id": "persistence_target_write", + "description": "Command text writes or edits startup targets; compare approved configuration.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "deyda-script", + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker", + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "matching": "pattern", + "mapped_from": "persistence_target_write" + } + ] + }, + { + "id": "setuid_temporary_shell", + "sigma_rule_id": "67e7c3f5-d648-516e-97fc-79ceb36453fb", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)chmod\\s+(?:[ugoa]*\\+s|[4567][0-7]{3})\\s+(?:/var/tmp/sh|/bin/sh)", + "description": "Command text sets privileged permissions on a shell; corroborate actual file mode.", + "source": [ + "deyda-script" + ], + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "observations": [ + { + "id": "setuid_temporary_shell", + "description": "Command text sets privileged permissions on a shell; corroborate actual file mode.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "deyda-script" + ], + "source_urls": [ + "https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh" + ], + "matching": "pattern", + "mapped_from": "setuid_temporary_shell" + } + ] + }, + { + "id": "trace_removal", + "sigma_rule_id": "5fbd05f0-df10-513d-acfc-e856fa90dd70", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)(?:\\brm\\s+(?:-[A-Za-z]+\\s+)*|\\btruncate\\s+[^\\r\\n]*|/dev/null\\s*>\\s*)(?:/var/(?:log|nslog|core)/|[^\\r\\n]*\\.log\\b)", + "description": "Log/core deletion or truncation command text; maintenance may be legitimate.", + "source": [ + "poppelgaard" + ], + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "id": "trace_removal", + "description": "Log/core deletion or truncation command text; maintenance may be legitimate.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "matching": "pattern", + "mapped_from": "trace_removal" + } + ] + }, + { + "id": "community_credential_access", + "sigma_rule_id": "83dd2ce5-c181-534b-b8b4-0b58dd9501d5", + "origin": { + "provenance_type": "public_source_informed_heuristic", + "scope_not_campaign_specific": false, + "description": "Detection adapted from cited public observations; a match is a review lead, not proof of successful execution." + }, + "pattern": "(?i)(?:\\b(?:cat|cp|tar|openssl|ldapsearch)\\b[^\\r\\n]*)(?:/flash/nsconfig/keys|F[12]\\.key|database\\.php|LDAPTLS_REQCERT)", + "description": "Credential/key access command context; legitimate administration can match.", + "source": [ + "poppelgaard" + ], + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "observations": [ + { + "id": "community_credential_access", + "description": "Credential/key access command context; legitimate administration can match.", + "confidence": "low", + "caveat": "Text or decoded text match is a hunting lead; it does not prove execution, persistence or file existence.", + "source_ids": [ + "poppelgaard" + ], + "source_urls": [ + "https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker" + ], + "matching": "pattern", + "mapped_from": "community_credential_access" + } + ] + } + ], + "external_rule_sets": [ + { + "source": "ncsc-php_webshell_rules.yara", + "format": "yara", + "rule_names": [ + "WEBSHELL_PHP_Generic", + "WEBSHELL_PHP_Generic_Callback", + "WEBSHELL_PHP_Base64_Encoded_Payloads", + "WEBSHELL_PHP_Unknown_1", + "WEBSHELL_PHP_Generic_Eval", + "WEBSHELL_PHP_Double_Eval_Tiny", + "WEBSHELL_PHP_OBFUSC", + "WEBSHELL_PHP_OBFUSC_Encoded", + "WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex", + "WEBSHELL_PHP_OBFUSC_Tiny", + "WEBSHELL_PHP_OBFUSC_Str_Replace", + "WEBSHELL_PHP_OBFUSC_Fopo", + "WEBSHELL_PHP_Gzinflated", + "WEBSHELL_PHP_OBFUSC_3", + "WEBSHELL_PHP_Includer_Eval", + "WEBSHELL_PHP_Includer_Tiny", + "WEBSHELL_PHP_Dynamic", + "WEBSHELL_PHP_Dynamic_Big", + "WEBSHELL_PHP_Encoded_Big", + "WEBSHELL_PHP_Generic_Backticks", + "WEBSHELL_PHP_Generic_Backticks_OBFUSC", + "WEBSHELL_PHP_By_String_Known_Webshell", + "WEBSHELL_PHP_Strings_SUSP", + "WEBSHELL_PHP_In_Htaccess", + "WEBSHELL_PHP_Function_Via_Get", + "WEBSHELL_PHP_Writer", + "WEBSHELL_ASP_Writer", + "WEBSHELL_ASP_OBFUSC", + "WEBSHELL_ASP_Generic_Eval_On_Input", + "WEBSHELL_ASP_Nano", + "WEBSHELL_ASP_Encoded", + "WEBSHELL_ASP_Encoded_AspCoding", + "WEBSHELL_ASP_By_String", + "WEBSHELL_ASP_Sniffer", + "WEBSHELL_ASP_Generic_Tiny", + "WEBSHELL_ASP_Generic", + "WEBSHELL_ASP_Generic_Registry_Reader", + "WEBSHELL_ASPX_Regeorg_CSHARP", + "WEBSHELL_CSHARP_Generic", + "WEBSHELL_ASP_Runtime_Compile", + "WEBSHELL_ASP_SQL", + "WEBSHELL_ASP_Scan_Writable", + "WEBSHELL_JSP_ReGeorg", + "WEBSHELL_JSP_HTTP_Proxy", + "WEBSHELL_JSP_Writer_Nano", + "EXT_WEBSHELL_JSP_Generic_Tiny", + "WEBSHELL_JSP_Generic", + "WEBSHELL_JSP_Generic_Base64", + "WEBSHELL_JSP_Generic_ProcessBuilder", + "WEBSHELL_JSP_Generic_Reflection", + "WEBSHELL_JSP_Generic_Classloader", + "WEBSHELL_JSP_Generic_Encoded_Shell", + "WEBSHELL_JSP_NetSpy", + "WEBSHELL_JSP_By_String", + "WEBSHELL_JSP_Input_Upload_Write", + "WEBSHELL_Generic_OS_Strings", + "WEBSHELL_In_Image", + "WEBSHELL_Mixed_OBFUSC", + "WEBSHELL_Cookie_Post_Obfuscation" + ], + "count": 59, + "enabled_in_log_scanner": false, + "reason": "Rules depend on whole-file byte/offset/string conditions or non-NetScaler platforms. Use their original YARA semantics on acquired files/images; generic PHP content hunting is separately adapted and attributed." + }, + { + "source": "ncsc-thor-webshells.yar", + "format": "yara", + "rule_names": [ + "Weevely_Webshell", + "WEBSHELL_H4ntu_Shell_Powered_Tsoi_3", + "WEBSHELL_H4ntu_Shell_Powered_Tsoi", + "webshell_PHP_sql", + "webshell_PHP_a", + "webshell_iMHaPFtp_2", + "webshell_Jspspyweb", + "webshell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2", + "webshell_SimAttacker_Vrsion_1_0_0_priv8_4_My_friend", + "webshell_phpshell_2_1_pwhash", + "webshell_PHPRemoteView", + "webshell_jsp_12302", + "webshell_caidao_shell_guo", + "webshell_PHP_redcod", + "webshell_remview_fix", + "webshell_asp_cmd", + "webshell_php_sh_server", + "webshell_PH_Vayv_PH_Vayv", + "webshell_caidao_shell_ice", + "webshell_cihshell_fix", + "webshell_asp_shell", + "webshell_Private_i3lue", + "webshell_php_up", + "webshell_Mysql_interface_v1_0", + "webshell_php_s_u", + "webshell_phpshell_2_1_config", + "webshell_asp_EFSO_2", + "webshell_jsp_up", + "webshell_NetworkFileManagerPHP", + "webshell_Server_Variables", + "webshell_caidao_shell_ice_2", + "webshell_caidao_shell_mdb", + "webshell_jsp_guige", + "webshell_phpspy2010", + "webshell_asp_ice", + "webshell_drag_system", + "webshell_DarkBlade1_3_asp_indexx", + "webshell_phpshell3", + "webshell_jsp_hsxa", + "webshell_jsp_utils", + "webshell_asp_01", + "webshell_asp_404", + "webshell_webshell_cnseay02_1", + "webshell_php_fbi", + "webshell_B374kPHP_B374k", + "webshell_cmd_asp_5_1", + "webshell_php_dodo_zip", + "webshell_aZRaiLPhp_v1_0", + "webshell_php_list", + "webshell_ironshell", + "webshell_caidao_shell_404", + "webshell_ASP_aspydrv", + "webshell_jsp_web", + "webshell_mysqlwebsh", + "webshell_jspShell", + "webshell_Dx_Dx", + "webshell_asp_ntdaddy", + "webshell_MySQL_Web_Interface_Version_0_8", + "webshell_elmaliseker_2", + "webshell_ASP_RemExp", + "webshell_jsp_list1", + "webshell_phpkit_1_0_odd", + "webshell_jsp_123", + "webshell_asp_1", + "webshell_ASP_tool", + "webshell_cmd_win32", + "webshell_jsp_jshell", + "webshell_ASP_zehir4", + "webshell_wsb_idc", + "webshell_cpg_143_incl_xpl", + "webshell_mumaasp_com", + "webshell_php_404", + "webshell_webshell_cnseay_x", + "webshell_asp_up", + "webshell_phpkit_0_1a_odd", + "webshell_ASP_cmd", + "webshell_PHP_Shell_x3", + "webshell_PHP_g00nv13", + "webshell_php_h6ss", + "webshell_jsp_zx", + "webshell_Ani_Shell", + "webshell_jsp_k8cmd", + "webshell_jsp_cmd", + "webshell_jsp_k81", + "webshell_ASP_zehir", + "webshell_Worse_Linux_Shell_1", + "webshell_zacosmall", + "webshell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit", + "webshell_redirect", + "webshell_jsp_cmdjsp", + "webshell_Java_Shell", + "webshell_asp_1d", + "webshell_jsp_IXRbE", + "webshell_PHP_G5", + "webshell_PHP_r57142", + "webshell_jsp_tree", + "webshell_C99madShell_v_3_0_smowu", + "webshell_simple_backdoor", + "webshell_PHP_404", + "webshell_Macker_s_Private_PHPShell", + "webshell_Antichat_Shell_v1_3_2", + "webshell_Safe_mode_breaker", + "webshell_Sst_Sheller", + "webshell_jsp_list", + "webshell_PHPJackal_v1_5", + "webshell_customize", + "webshell_s72_Shell_v1_1_Coding", + "webshell_jsp_sys3", + "webshell_jsp_guige02", + "webshell_php_ghost", + "webshell_WinX_Shell", + "webshell_Crystal_Crystal", + "webshell_r57_1_4_0", + "webshell_asp_ajn", + "webshell_php_cmd", + "webshell_asp_list", + "webshell_PHP_co", + "webshell_PHP_150", + "webshell_jsp_cmdjsp_2", + "webshell_PHP_c37", + "webshell_PHP_b37", + "webshell_php_backdoor", + "webshell_asp_dabao", + "webshell_php_2", + "webshell_asp_cmdasp", + "webshell_spjspshell", + "webshell_jsp_action", + "webshell_Inderxer", + "webshell_asp_Rader", + "webshell_c99_madnet_smowu", + "webshell_php_moon", + "webshell_minupload", + "webshell_ELMALISEKER_Backd00r", + "webshell_PHP_bug_1_", + "webshell_caidao_shell_hkmjj", + "webshell_jsp_asd", + "webshell_metaslsoft", + "webshell_asp_Ajan", + "webshell_config_myxx_zend", + "webshell_browser_201_3_ma_download", + "webshell_itsec_itsecteam_shell_jHn", + "webshell_ghost_source_icesword_silic", + "webshell_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_spy2009_m_ma3_xxx", + "webshell_2_520_job_ma1_ma4_2", + "webshell_000_403_807_a_c5_config_css_dm_he1p_JspSpy_JspSpyJDK5_JspSpyJDK51_luci_jsp_xxx", + "webshell_wso2_5_1_wso2_5_wso2", + "webshell_000_403_c5_queryDong_spyjsp2010_t00ls", + "webshell_404_data_suiyue", + "webshell_r57shell_r57shell127_SnIpEr_SA_Shell_EgY_SpIdEr_ShElL_V2_r57_xxx", + "webshell_807_a_css_dm_he1p_JspSpy_xxx", + "webshell_201_3_ma_download", + "webshell_browser_201_3_400_in_JFolder_jfolder01_jsp_leo_ma_warn_webshell_nc_download", + "webshell_shell_phpspy_2006_arabicspy", + "webshell_in_JFolder_jfolder01_jsp_leo_warn", + "webshell_2_520_icesword_job_ma1_ma4_2", + "webshell_phpspy_2005_full_phpspy_2005_lite_PHPSPY", + "webshell_shell_phpspy_2006_arabicspy_hkrkoz", + "webshell_c99_Shell_ci_Biz_was_here_c100_v_xxx", + "webshell_2008_2009lite_2009mssql", + "webshell_shell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_arabicspy_PHPSPY_hkrkoz", + "webshell_807_dm_JspSpyJDK5_m_cofigrue", + "webshell_Dive_Shell_1_0_Emperor_Hacking_Team_xxx", + "webshell_404_data_in_JFolder_jfolder01_xxx", + "webshell_jsp_reverse_jsp_reverse_jspbd", + "webshell_400_in_JFolder_jfolder01_jsp_leo_warn_webshell_nc", + "webshell_2_520_job_JspWebshell_1_2_ma1_ma4_2", + "webshell_shell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz", + "webshell_gfs_sh_r57shell_r57shell127_SnIpEr_SA_xxx", + "webshell_itsec_PHPJackal_itsecteam_shell_jHn", + "webshell_Shell_ci_Biz_was_here_c100_v_xxx", + "webshell_NIX_REMOTE_WEB_SHELL_NIX_REMOTE_WEB_xxx1", + "webshell_c99_c99shell_c99_w4cking_Shell_xxx", + "webshell_2008_2009mssql_phpspy_2005_full_phpspy_2006_arabicspy_hkrkoz", + "webshell_c99_c66_c99_shadows_mod_c99shell", + "webshell_he1p_JspSpy_nogfw_ok_style_1_JspSpy1", + "webshell_000_403_c5_config_myxx_queryDong_spyjsp2010_zend", + "webshell_c99_c99shell_c99_c99shell", + "webshell_r57shell127_r57_iFX_r57_kartal_r57_antichat", + "webshell_NIX_REMOTE_WEB_SHELL_nstview_xxx", + "webshell_000_403_807_a_c5_config_css_dm_he1p_xxx", + "webshell_2_520_icesword_job_ma1", + "webshell_404_data_in_JFolder_jfolder01_jsp_suiyue_warn", + "webshell_phpspy_2005_full_phpspy_2005_lite_phpspy_2006_PHPSPY", + "webshell_c99_locus7s_c99_w4cking_xxx", + "webshell_browser_201_3_ma_ma2_download", + "webshell_000_403_c5_queryDong_spyjsp2010", + "webshell_r57shell127_r57_kartal_r57", + "webshell_webshells_new_con2", + "webshell_webshells_new_make2", + "webshell_webshells_new_aaa", + "webshell_Expdoor_com_ASP", + "webshell_webshells_new_php2", + "webshell_bypass_iisuser_p", + "webshell_sig_404super", + "webshell_webshells_new_JSP", + "webshell_webshell_123", + "webshell_dev_core", + "webshell_webshells_new_pHp", + "webshell_webshells_new_pppp", + "webshell_webshells_new_code", + "webshell_webshells_new_jspyyy", + "webshell_webshells_new_xxxx", + "webshell_webshells_new_JJjsp3", + "webshell_webshells_new_PHP1", + "webshell_webshells_new_JJJsp2", + "webshell_webshells_new_radhat", + "webshell_webshells_new_asp1", + "webshell_webshells_new_php6", + "webshell_webshells_new_xxx", + "webshell_GetPostpHp", + "webshell_webshells_new_php5", + "webshell_webshells_new_PHP", + "webshell_webshells_new_Asp", + "perlbot_pl", + "php_backdoor_php", + "Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_php", + "Nshell__1__php_php", + "shankar_php_php", + "Casus15_php_php", + "small_php_php", + "shellbot_pl", + "fuckphpshell_php", + "ngh_php_php", + "jsp_reverse_jsp", + "Tool_asp", + "NT_Addy_asp", + "SimAttacker___Vrsion_1_0_0___priv8_4_My_friend_php", + "RemExp_asp", + "phvayvv_php_php", + "klasvayv_asp", + "r57shell_php_php", + "rst_sql_php_php", + "wh_bindshell_py", + "lurm_safemod_on_cgi", + "c99madshell_v2_0_php_php", + "backupsql_php_often_with_c99shell", + "uploader_php_php", + "telnet_pl", + "w3d_php_php", + "WebShell_cgi", + "WinX_Shell_html", + "Dx_php_php", + "csh_php_php", + "pHpINJ_php_php", + "sig_2008_php_php", + "ak74shell_php_php", + "Rem_View_php_php", + "Java_Shell_js", + "STNC_php_php", + "aZRaiLPhp_v1_0_php", + "Moroccan_Spamers_Ma_EditioN_By_GhOsT_php", + "zacosmall_php", + "CmdAsp_asp", + "simple_backdoor_php", + "mysql_shell_php", + "Dive_Shell_1_0___Emperor_Hacking_Team_php", + "Asmodeus_v0_1_pl", + "backup_php_often_with_c99shell", + "Reader_asp", + "phpshell17_php", + "myshell_php_php", + "SimShell_1_0___Simorgh_Security_MGZ_php", + "jspshall_jsp", + "webshell_php", + "rootshell_php", + "connectback2_pl", + "DefaceKeeper_0_2_php", + "shells_PHP_wso", + "backdoor1_php", + "elmaliseker_asp", + "indexer_asp", + "DxShell_php_php", + "s72_Shell_v1_1_Coding_html", + "kacak_asp", + "PHP_Backdoor_Connect_pl_php", + "Antichat_Socks5_Server_php_php", + "Antichat_Shell_v1_3_php", + "Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_php", + "mysql_php_php", + "Worse_Linux_Shell_php", + "cyberlords_sql_php_php", + "cmd_asp_5_1_asp", + "pws_php_php", + "PHP_Shell_php_php", + "Ayyildiz_Tim___AYT__Shell_v_2_1_Biz_html", + "EFSO_2_asp", + "lamashell_php", + "Ajax_PHP_Command_Shell_php", + "JspWebshell_1_2_jsp", + "Sincap_php_php", + "Test_php_php", + "Phyton_Shell_py", + "mysql_tool_php_php", + "Zehir_4_asp", + "sh_php_php", + "phpbackdoor15_php", + "phpjackal_php", + "sql_php_php", + "cgi_python_py", + "ru24_post_sh_php_php", + "DTool_Pro_php", + "telnetd_pl", + "php_include_w_shell_php", + "Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php", + "shell_php_php", + "telnet_cgi", + "ironshell_php", + "backdoorfr_php", + "aspydrv_asp", + "cmdjsp_jsp", + "h4ntu_shell__powered_by_tsoi_", + "Ajan_asp", + "PHANTASMA_php", + "MySQL_Web_Interface_Version_0_8_php", + "simple_cmd_html", + "_1_c2007_php_php_c100_php", + "_nst_php_php_img_php_php_nstview_php_php", + "_network_php_php_xinfo_php_php_nfm_php_php", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SpecialShell_99_php_php", + "_r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php", + "_c99shell_v1_0_php_php_c99php_SsEs_php_php_ctt_sh_php_php", + "_r577_php_php_spy_php_php_s_php_php", + "webshell_c99_generic", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php", + "_w_php_php_wacking_php_php_SpecialShell_99_php_php", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php", + "_r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_spy_php_php_s_php_php", + "_r577_php_php_SnIpEr_SA_Shell_php_r57_php_php", + "_r577_php_php_r57_Shell_php_php_spy_php_php_s_php_php", + "_wacking_php_php_1_SpecialShell_99_php_php_c100_php", + "_r577_php_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php", + "_w_php_php_wacking_php_php_SsEs_php_php_SpecialShell_99_php_php", + "multiple_php_webshells", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php", + "_GFS_web_shell_ver_3_1_7___PRiV8_php_nshell_php_php_gfs_sh_php_php", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_SpecialShell_99_php_php", + "_w_php_php_wacking_php_php_c99shell_v1_0_php_php_c99php_SpecialShell_99_php_php", + "_antichat_php_php_Fatalshell_php_php_a_gedit_php_php", + "_c99shell_v1_0_php_php_c99php_SsEs_php_php", + "_Crystal_php_nshell_php_php_load_shell_php_php", + "_nst_php_php_cybershell_php_php_img_php_php_nstview_php_php", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_dC3_Security_Crew_Shell_PRiV_php_SpecialShell_99_php_php", + "_c99shell_v1_0_php_php_c99php_1_c2007_php_php_c100_php", + "multiple_php_webshells_2", + "_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_1_SpecialShell_99_php_php", + "_r577_php_php_r57_php_php_spy_php_php_s_php_php", + "_nixrem_php_php_c99shell_v1_0_php_php_c99php_NIX_REMOTE_WEB_SHELL_v_0_5_alpha_Lite_Public_Version_php", + "DarkSecurityTeam_Webshell", + "PHP_Cloaked_Webshell_SuperFetchExec", + "WebShell_RemExp_asp_php", + "WebShell_dC3_Security_Crew_Shell_PRiV", + "WebShell_simattacker", + "WebShell_DTool_Pro", + "WebShell_IronShell_4", + "WebShell_indexer_asp_php", + "WebShell_toolaspshell", + "WebShell_b374k_mini_shell_php_php", + "WebShell_Sincap_1_0", + "WebShell_b374k_php", + "WebShell_SimAttacker___Vrsion_1_0_0___priv8_4_My_friend", + "WEBSHELL_H4ntu_Shell_Powered_Tsoi_2", + "WebShell_php_webshells_MyShell", + "WebShell_php_webshells_pws", + "WebShell_reader_asp_php", + "WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_3", + "WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_2", + "WebShell_PHP_Backdoor_2", + "WebShell_Worse_Linux_Shell_2", + "WebShell_php_webshells_pHpINJ", + "WebShell_php_webshells_NGH", + "WebShell_php_webshells_matamu", + "WebShell_ru24_post_sh", + "WebShell_hiddens_shell_v1", + "WebShell_c99_madnet", + "WebShell_c99_locus7s", + "WebShell_JspWebshell_1_2", + "WebShell_safe0ver", + "WebShell_Uploader", + "WebShell_php_webshells_kral", + "WebShell_cgitelnet", + "WebShell_simple_backdoor_2", + "WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_2", + "WebShell_NTDaddy_v1_9", + "WebShell_lamashell", + "WebShell_Simple_PHP_backdoor_by_DK", + "WebShell_Moroccan_Spamers_Ma_EditioN_By_GhOsT", + "WebShell_C99madShell_v__2_0_madnet_edition", + "WebShell_CmdAsp_asp_php", + "WebShell_NCC_Shell", + "WebShell_php_webshells_README", + "WebShell_backupsql", + "WebShell_AK_74_Security_Team_Web_Shell_Beta_Version", + "WebShell_php_webshells_cpanel", + "WebShell_accept_language", + "WebShell_php_webshells_529", + "WebShell_STNC_WebShell_v0_8", + "WebShell_php_webshells_tryag", + "WebShell_dC3_Security_Crew_Shell_PRiV_2", + "WebShell_qsd_php_backdoor", + "WebShell_php_webshells_spygrup", + "WebShell_Web_shell__c_ShAnKaR", + "WebShell_Ayyildiz_Tim___AYT__Shell_v_2_1_Biz", + "WebShell_Gamma_Web_Shell", + "WebShell_php_webshells_aspydrv", + "WebShell_JspWebshell_1_2_2", + "WebShell_g00nshell_v1_3", + "WebShell_WinX_Shell_2", + "WebShell_PHANTASMA", + "WebShell_php_webshells_cw", + "WebShell_php_include_w_shell", + "WebShell_mysql_tool", + "WebShell_PhpSpy_Ver_2006", + "WebShell_ZyklonShell", + "WebShell_php_webshells_myshell_2", + "WebShell_php_webshells_lolipop", + "WebShell_simple_cmd", + "WebShell_go_shell", + "WebShell_aZRaiLPhp_v1_0_2", + "WebShell_webshells_zehir4", + "WebShell_zehir4_asp_php", + "WebShell_php_webshells_lostDC", + "WebShell_CasuS_1_5", + "WebShell_ftpsearch", + "WebShell__Cyber_Shell_cybershell_Cyber_Shell__v_1_0_", + "WebShell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_soldierofallah", + "WebShell_Generic_PHP_7", + "WebShell__Small_Web_Shell_by_ZaCo_small_zaco_zacosmall", + "WebShell_Generic_PHP_8", + "WebShell__PH_Vayv_PHVayv_PH_Vayv_klasvayv_asp_php", + "WebShell_Generic_PHP_9", + "WebShell__PH_Vayv_PHVayv_PH_Vayv", + "WebShell_Generic_PHP_1", + "WebShell_Generic_PHP_2", + "WebShell__CrystalShell_v_1_erne_stres", + "WebShell_Generic_PHP_3", + "WebShell_Generic_PHP_4", + "WebShell_GFS", + "WebShell__CrystalShell_v_1_sosyete_stres", + "WebShell_Generic_PHP_10", + "WebShell_Generic_PHP_11", + "WebShell__findsock_php_findsock_shell_php_reverse_shell", + "WebShell_Generic_PHP_6", + "Unpack_Injectt", + "HYTop_DevPack_fso", + "FeliksPack3___PHP_Shells_ssh", + "Debug_BDoor", + "bin_Client", + "ZXshell2_0_rar_Folder_ZXshell", + "RkNTLoad", + "binder2_binder2", + "thelast_orice2", + "FSO_s_sincap", + "PhpShell", + "HYTop_DevPack_config", + "sendmail", + "FSO_s_zehir4", + "hkshell_hkshell", + "iMHaPFtp", + "Unpack_TBack", + "DarkSpy105", + "EditServer_EXE", + "FSO_s_reader", + "ASP_CmdAsp", + "KA_uShell", + "PHP_Backdoor_v1", + "svchostdll", + "HYTop_DevPack_server", + "vanquish", + "winshell", + "FSO_s_remview", + "saphpshell", + "HYTop2006_rar_Folder_2006Z", + "admin_ad", + "FSO_s_casus15", + "BIN_Client", + "shelltools_g0t_root_uptime", + "Simple_PHP_BackDooR", + "sig_2005Gray", + "DllInjection", + "Mithril_v1_45_Mithril", + "hkshell_hkrmv", + "WEBSHELL_PHP_1", + "FSO_s_cmd", + "FeliksPack3___PHP_Shells_phpft", + "FSO_s_indexer", + "r57shell", + "bdcli100", + "HYTop_DevPack_2005Red", + "HYTop2006_rar_Folder_2006X2", + "rdrbs084", + "HYTop_CaseSwitch_2005", + "eBayId_index3", + "FSO_s_phvayv", + "byshell063_ntboot", + "FSO_s_casus15_2", + "installer", + "FSO_s_remview_2", + "FeliksPack3___PHP_Shells_r57", + "HYTop2006_rar_Folder_2006X", + "FSO_s_phvayv_2", + "elmaliseker", + "shelltools_g0t_root_resolve", + "FSO_s_RemExp", + "FSO_s_tool", + "FeliksPack3___PHP_Shells_2005", + "byloader", + "shelltools_g0t_root_Fport", + "BackDooR__fr_", + "FSO_s_ntdaddy", + "nstview_nstview", + "HYTop_DevPack_upload", + "PasswordReminder", + "Pack_InjectT", + "FSO_s_RemExp_2", + "FSO_s_c99", + "rknt_zip_Folder_RkNT", + "dbgntboot", + "PHP_shell", + "hxdef100", + "rdrbs100", + "Mithril_Mithril", + "hxdef100_2", + "Release_dllTest", + "webadmin", + "commands", + "hkdoordll", + "r57shell_2", + "Mithril_v1_45_dllTest", + "dbgiis6cli", + "remview_2003_04_22", + "FSO_s_test", + "Debug_cress", + "webshell", + "FSO_s_EFSO_2", + "thelast_index3", + "adjustcr", + "FeliksPack3___PHP_Shells_xIShell", + "HYTop_AppPack_2005", + "xssshell", + "FeliksPack3___PHP_Shells_usr", + "FSO_s_phpinj", + "xssshell_db", + "PHP_sh", + "xssshell_default", + "EditServer_2", + "by064cli", + "Mithril_dllTest", + "peek_a_boo", + "fmlibraryv3", + "Debug_dllTest_2", + "connector", + "shelltools_g0t_root_HideRun", + "PHP_Shell_v1_7", + "xssshell_save", + "screencap", + "FSO_s_phpinj_2", + "ZXshell2_0_rar_Folder_zxrecv", + "FSO_s_ajan", + "c99shell", + "phpspy_2005_full", + "FSO_s_zehir4_2", + "FSO_s_indexer_2", + "HYTop_DevPack_2005", + "_root_040_zip_Folder_deploy", + "by063cli", + "icyfox007v1_10_rar_Folder_asp", + "byshell063_ntboot_2", + "u_uay", + "bin_wuaus", + "pwreveal", + "shelltools_g0t_root_xwhois", + "vanquish_2", + "down_rar_Folder_down", + "cmdShell", + "ZXshell2_0_rar_Folder_nc", + "portlessinst", + "SetupBDoor", + "phpshell_3", + "BIN_Server", + "HYTop2006_rar_Folder_2006", + "r57shell_3", + "HDConfig", + "FSO_s_ajan_2", + "Webshell_and_Exploit_CN_APT_HK", + "JSP_Browser_APT_webshell", + "JSP_jfigueiredo_APT_webshell", + "JSP_jfigueiredo_APT_webshell_2", + "Webshell_Insomnia", + "HawkEye_PHP_Panel", + "SoakSoak_Infected_Wordpress", + "Pastebin_Webshell", + "ASPXspy2", + "Webshell_27_9_c66_c99", + "Webshell_acid_AntiSecShell_3", + "Webshell_c99_4", + "Webshell_r57shell_2", + "Webshell_27_9_acid_c99_locus7s", + "Webshell_Backdoor_PHP_Agent_r57_mod_bizzz_shell_r57", + "Webshell_c100", + "Webshell_AcidPoison", + "Webshell_acid_FaTaLisTiCz_Fx_fx_p0isoN_sh3ll_x0rg_byp4ss_256", + "Webshell_Ayyildiz", + "Webshell_zehir", + "UploadShell_98038f1efa4203432349badabad76d44337319a6", + "DKShell_f0772be3c95802a2d1e7a4a3f5a45dcdef6997f3", + "Unknown_8af033424f9590a15472a23cc3236e68070b952e", + "DkShell_4000bd83451f0d8501a9dfad60dce39e55ae167d", + "WebShell_5786d7d9f4b0df731d79ed927fb5a124195fc901", + "webshell_e8eaf8da94012e866e51547cd63bb996379690bf", + "Unknown_0f06c5d1b32f4994c3b3abf8bb76d5468f105167", + "WSOShell_0bbebaf46f87718caba581163d4beed56ddf73a7", + "WebShell_Generic_1609_A", + "Nishang_Webshell", + "PHP_Webshell_1_Feb17", + "Webshell_Tiny_JSP_2", + "Wordpress_Config_Webshell_Preprend", + "PAS_Webshell_Encoded", + "ALFA_SHELL", + "Webshell_FOPO_Obfuscation_APT_ON_Nov17_1", + "WebShell_JexBoss_JSP_1", + "WebShell_JexBoss_WAR_1", + "webshell_tinyasp", + "WEBSHELL_ASPX_Mar21_1" + ], + "count": 624, + "enabled_in_log_scanner": false, + "reason": "Rules depend on whole-file byte/offset/string conditions or non-NetScaler platforms. Use their original YARA semantics on acquired files/images; generic PHP content hunting is separately adapted and attributed." + } + ], + "excluded_patterns": [ + { + "id": "mandiant_log_scrubbing", + "pattern": "(?is)(?:crontab|/etc/crontab|sed).*(?:/vpn/scripts/linux|httpaccess|/vpn/media)", + "description": "Candidate installer log/crontab cleanup.", + "caveat": "Broad contextual rule: require delete/filter/write operation and adjacent installation artifacts.", + "source_ids": [ + "mandiant" + ], + "source_urls": [ + "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances" + ], + "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances", + "correlation": null, + "reason": "Generic sed/crontab/path co-occurrence does not establish deletion; use a compound cleanup rule instead." + }, + { + "id": "levelblue_customsnmpd", + "pattern": "(?is)(?:write|open|>|python|kill).*?/var/python/bin/customsnmpd", + "description": "Unexpected replacement or execution of customsnmpd may indicate reverse-shell implant.", + "caveat": "File path alone is legitimate; validate modified content and connection to reported callback.", + "source_ids": [ + "levelblue" + ], + "source_urls": [ + "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators" + ], + "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators", + "correlation": null, + "reason": "Generic operation and legitimate component path are insufficient; file-content/network corroboration required." + } + ], + "excluded_observables": [ + { + "type": "literal", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.112 Safari/537.36", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "python3 -c", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "base64.b85decode", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "base64.b64decode", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "zlib.decompress", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "touch -t", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "apachectl graceful", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "1245184", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "\"nsroot\", \"actions\":", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "literal", + "value": "/nf/auth/doDialogue.do", + "source": "ncsc-nl-2025", + "reason": "Historical generic hunting string; not enabled as a standalone attack IOC. Contextual behavior checks or external core/image inspection required." + }, + { + "type": "sha256", + "value": "60a9b62d59f1e025b9d1b413ec7c926dbe02134d82e8dea902fcb087c2d81879", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "a5366bdf12ecdd7ff4c87d34ec238717b0c1864598ace0fbd94a5f73f151060f", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "747d21f81f78d55435bc3857cc201f716979f3422d91427ae1355deda1826b5e", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "ee4203c88bd3de082bc67f1de694d93edca795e1106f9f1dbe2e891b3873f83c", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "8fc91bd3436bc6f958ba2f2897956fb3a24c068f55008adb01f3cb32869fec20", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "735e1b0e6ac42ea647198836ec1da79043342596806f83b24584abe79e437405", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "4ff2bdcc36c70c2a8cf298a8b92dc536a14e3fe655aa6de3ac9c1eafb27b4ac4", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "e0898d41e8c5e0b3b4174307be81ad908c23b3b11180083f4252e5b06d8e23b1", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "847d7fc0724470578d4ef8548a2b0eedef54da9ea61c964986e32ae74d90de73", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "10a1acb645b3a4a7cbc1135088429ac3214643facc3f3c783c909446c4142379", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "e1076b3642968044149abe2aabcf681dd22bf3dfb6c1d144f8f3f32a2f12b422", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "77417011220bf8e1d1e51d26c780875cbc51593275ff4080d73bb1da2016fbbb", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "type": "sha256", + "value": "2c1310d7c4d7dfb1ef47b137be1eb572cc743cc609898ae38320963cc0578665", + "source": "deyda-script", + "reason": "Author-specific known-good baseline, not malicious sample hash; must not be imported as an attack IOC." + }, + { + "source": "ncsc-nl-2025", + "rule": "NCSCNL_CitrixIncident2025_ropchain", + "reason": "Binary wildcard byte sequence requires core-memory YARA; not truthfully equivalent to line-oriented Sigma." + } + ], + "limitations": [ + "Reference matches do not prove local compromise. Shared infrastructure and testing markers require context.", + "Unavailable registered collections and undisclosed vendor rules are not reproduced.", + "Public reports describe attempts and successful intrusions separately; preserve original role and confidence." + ] +} diff --git a/src/netscaler_triage/decoding.py b/src/netscaler_triage/decoding.py new file mode 100644 index 0000000..401cf55 --- /dev/null +++ b/src/netscaler_triage/decoding.py @@ -0,0 +1,328 @@ +"""Bounded, non-executing text transforms. A decoded command is not execution evidence.""" + +import base64 +import binascii +import hashlib +import re +from collections import deque +from itertools import islice +from typing import Any +from urllib.parse import unquote + +MAX_RECORDS = 64 +_TOKEN = re.compile(r"(? bool: + """Cheap gate for encoded fields/blobs without treating every word as Base64.""" + if re.search(r"%[0-9a-fA-F]{2}|\bbase64\b|(? bool: + """Validate a bounded whole field or assigned value, never arbitrary ordinary words.""" + if not re.fullmatch(r"[A-Za-z0-9_+/-]{4,4096}={0,2}", value): + return False + normalized = value.replace("-", "+").replace("_", "/") + try: + data = base64.b64decode(normalized + "=" * (-len(normalized) % 4), validate=True) + decoded = data.decode("utf-8") + except binascii.Error, UnicodeDecodeError: + return False + return ( + base64.b64encode(data).decode("ascii").rstrip("=") == normalized.rstrip("=") + and bool(decoded) + and all(char.isprintable() or char in "\t\r\n" for char in decoded) + ) + + +def observations(text: str) -> list[str]: + tokens = sorted({m.group().lower() for m in _COMMANDS.finditer(text)}) + result = ( + ["Command text contains: " + ", ".join(tokens) + "; execution is not established."] + if tokens + else [] + ) + semantics = { + "curl": ( + "curl requests a URL; its arguments determine whether this downloads " + "data, sends a callback or transfers data." + ), + "wget": ( + "wget requests a URL and can save its response to a file; a successful " + "request is not established." + ), + "chmod": ( + "chmod changes file permissions. The target and mode determine its " + "effect; an actual change is not established." + ), + "mkdir": "mkdir creates directories; -p can also create missing parent directories.", + "tar": ( + "tar processes archives; -c creates and -x extracts an archive. Assess " + "file names and flags together." + ), + "id": "id would print user and group identities and may be used as an execution probe.", + "hostname": "hostname can print the system name; arguments may also change it.", + "passthru": ( + "PHP passthru can execute an operating-system command; whether " + "execution reached this call is not established." + ), + "eval": ( + "eval can evaluate an expression or program text; its effect depends on " + "the language and reached control flow." + ), + "base64": ( + "base64 encodes or decodes data depending on its options; decoding " + "alone does not execute the content." + ), + "sleep": ( + "sleep would delay processing for the specified duration and may be " + "used as a timing-based execution probe." + ), + "perl": ( + "perl can interpret code from arguments, files or standard input; " + "options such as -i can modify files." + ), + "sh": "sh can execute shell commands from files, arguments or standard input.", + "bash": "bash can execute shell commands from files, arguments or standard input.", + "python": "python can interpret code from files, arguments or standard input.", + } + result.extend(semantics[t] for t in tokens if t in semantics) + if re.search(r"\bkill\s+-(?:HUP|1)\b", text, re.I): + result.append( + "kill -HUP sends a HUP signal to the target process. Some services " + "reload configuration in response; verify the target and service " + "behavior." + ) + if re.search(r"\|\s*(?:sh|bash|perl|python)(?:\s|[;&)]|$)", text): + result.append( + "A pipe forwards preceding output to an interpreter; if reached " + "successfully, the received code would be processed." + ) + if "$_COOKIE" in text and "passthru" in tokens: + result.append( + "Cookie access and passthru occur in the same text. Inspect the data " + "flow to determine whether cookies supply commands; this does not " + "establish use." + ) + return result + + +def decode_layers(text: str, max_depth: int = 4, max_bytes: int = 1048576) -> list[dict[str, Any]]: + """Original and URL/Base64 branches with parent indexes and exact candidate spans. + + URL decoding never changes '+' to space. Base64 candidates are hypotheses; + binary output is recorded as hex and never recursively treated as text. + Total transformed bytes and records are bounded, not just each layer. + """ + if not isinstance(text, str): + raise TypeError("text must be str") + if not 0 <= max_depth <= 16 or not 1 <= max_bytes <= 16777216: + raise ValueError("invalid decoding limits") + raw = text.encode("utf-8", errors="surrogatepass") + original: dict[str, Any] = dict( + transformation="original", + scope="all_text", + parent=None, + depth=0, + input=text, + output=text, + output_encoding="utf-8", + sha256=hashlib.sha256(raw).hexdigest(), + observations=observations(text[:max_bytes]), + error=None, + ) + records = [original] + if len(raw) > max_bytes: + original["error"] = "input_limit_exceeded; original preserved, decoding skipped" + return records + queue = deque([(0, text, 0)]) + seen = {text} + remaining = max_bytes + + def add( + parent: int, + depth: int, + transform: str, + source: str, + output: str | None, + data: bytes, + scope: str, + start: int, + error: str | None = None, + ) -> None: + nonlocal remaining + if len(records) >= MAX_RECORDS or len(data) > remaining: + original["error"] = "transformation_budget_exhausted; results incomplete" + return + remaining -= len(data) + record = dict( + transformation=transform, + scope=scope, + parent=parent, + depth=depth, + input=source, + output=output, + output_encoding="utf-8" if output is not None else "hex", + sha256=hashlib.sha256(data).hexdigest(), + start=start, + end=start + len(source), + observations=observations(output or ""), + error=error, + ) + if output is None: + record["output"] = data.hex() + records.append(record) + if output is not None and output not in seen and not error: + seen.add(output) + queue.append((len(records) - 1, output, depth)) + + while queue and len(records) < MAX_RECORDS: + parent, current, depth = queue.popleft() + if depth >= max_depth: + records[parent]["limit"] = "max_depth_reached; further transformations not inspected" + continue + if re.search(r"%(?![0-9a-fA-F]{2})", current): + records[parent]["observations"].append( + "Incomplete or invalid percent sequence; possibly a literal percent " + "sign. Complete URL decoding is not established." + ) + records[parent]["error"] = "malformed_percent_candidate; original preserved" + if re.search(r"%[0-9a-fA-F]{2}", current): + try: + decoded = unquote(current, encoding="utf-8", errors="strict") + add( + parent, + depth + 1, + "url_percent", + current, + decoded, + decoded.encode(), + "all_text", + 0, + ) + except UnicodeDecodeError: + add( + parent, + depth + 1, + "url_percent", + current, + None, + b"", + "all_text", + 0, + "invalid_utf8_in_percent_encoding; original preserved", + ) + stripped = current.strip() + for explicit in islice(re.finditer(r"\bbase64\s*[:=]\s*([^\s\"'<>]+)", current, re.I), 32): + value = explicit.group(1) + if not re.fullmatch(r"[A-Za-z0-9_+/-]+={0,2}", value): + add( + parent, + depth + 1, + "base64", + value, + None, + b"", + "candidate", + explicit.start(1), + "invalid_base64_alphabet_or_padding; original preserved", + ) + candidates = ( + [(stripped, current.find(stripped), "all_text")] + if re.fullmatch(r"[A-Za-z0-9_+/-]{3,}={0,2}", stripped) + else [] + ) + for match in _TOKEN.finditer(current): + value = match.group() + prefix = current[max(0, match.start() - 80) : match.start()] + # Bare ordinary words are not evidence of encoding. Small tokens require context. + contextual = re.search(r"(?:[?&][\w.-]+=|base64\s*[:=(]\s*['\"]?)$", prefix, re.I) + assigned_text = re.search(r"[\w.-]+[ \t]*[:=][ \t]*['\"]?$", prefix) and ( + _encoded_field_text(value) + ) + marked_blob = (len(value) >= 24 and re.search(r"[\w.-]+:$", prefix)) or re.fullmatch( + r"[\w.-]+:", prefix + ) + if ( + contextual + or assigned_text + or marked_blob + or ( + len(value) >= 24 + and ( + "=" in value or (re.search(r"[A-Z]", value) and re.search(r"[a-z]", value)) + ) + ) + ): + candidates.append((value, match.start(), "candidate")) + if len(candidates) >= 32: + original["observations"].append( + "Candidate limit reached; additional Base64 candidates at this depth " + "were not inspected." + ) + break + unique = set() + for value, start, scope in candidates[:32]: + if (value, start) in unique: + continue + unique.add((value, start)) + if len(value) % 4 == 1: + add( + parent, + depth + 1, + "base64", + value, + None, + b"", + scope, + start, + "invalid_base64_candidate_length; original preserved", + ) + continue + try: + decoded_bytes = base64.b64decode( + value + "=" * (-len(value) % 4), altchars=b"-_", validate=True + ) + except binascii.Error, ValueError: + add( + parent, + depth + 1, + "base64", + value, + None, + b"", + scope, + start, + "invalid_base64_candidate; original preserved", + ) + continue + try: + candidate_text = decoded_bytes.decode("utf-8") + decoded_text = ( + None + if any(ord(c) < 32 and c not in "\t\r\n" for c in candidate_text) + else candidate_text + ) + except UnicodeDecodeError: + decoded_text = None + add(parent, depth + 1, "base64", value, decoded_text, decoded_bytes, scope, start) + if queue and len(records) >= MAX_RECORDS: + original["error"] = "record_limit_exceeded; results incomplete" + return records diff --git a/src/netscaler_triage/engine.py b/src/netscaler_triage/engine.py new file mode 100644 index 0000000..23779d8 --- /dev/null +++ b/src/netscaler_triage/engine.py @@ -0,0 +1,449 @@ +"""Single-pass scanning with an on-disk evidence index and explicit coverage.""" + +from __future__ import annotations + +import csv +import json +import platform +import sqlite3 +import time +from collections import Counter +from contextlib import suppress +from datetime import UTC, datetime +from functools import lru_cache +from pathlib import Path +from typing import Any + +from . import __version__ +from .decoding import decode_layers, has_encoding_candidate +from .indicators import extract_indicators +from .ingest import inventory, iter_records +from .matching import Matcher +from .parsing import parse_record +from .sigma_rules import SigmaEvaluationLimit + + +def dump(path: Path, value: Any) -> None: + path.write_text(json.dumps(value, ensure_ascii=False, indent=2) + "\n", encoding="utf-8") + + +def make_database(path: Path) -> sqlite3.Connection: + db = sqlite3.connect(path) + db.executescript(""" + PRAGMA cache_size=-8192; + PRAGMA temp_store=FILE; + PRAGMA mmap_size=0; + PRAGMA threads=1; + CREATE TABLE events(id INTEGER PRIMARY KEY, appliance TEXT, source TEXT, + line INTEGER, timestamp TEXT, kind TEXT, data TEXT); + CREATE TABLE event_keys(event_id INTEGER, appliance TEXT, key_type TEXT, + key_value TEXT, timestamp TEXT); + CREATE TABLE iocs(type TEXT,value TEXT,defanged TEXT,count INTEGER, + first_event INTEGER,PRIMARY KEY(type,value)); + CREATE TABLE indicator_hits(event_id INTEGER,type TEXT,value TEXT,status TEXT); + CREATE INDEX key_lookup ON event_keys(appliance,key_type,key_value,timestamp); + """) + return db + + +def validate_output(output: Path, inputs: list[tuple[str, Path]]) -> None: + resolved = output.resolve() + if output.exists() or output.is_symlink(): + raise ValueError("Output already exists; choose a new directory") + if any(p.is_symlink() for p in output.parents): + raise ValueError("Output path contains a symbolic link") + for _, root in inputs: + if resolved == root.resolve() or root.resolve() in resolved.parents: + raise ValueError("Output must not be inside an input directory") + if len({name for name, _ in inputs}) != len(inputs): + raise ValueError("Appliance names must be unique") + if len({root.resolve() for _, root in inputs}) != len(inputs): + raise ValueError("Duplicate input root") + + +def scan( + inputs: list[tuple[str, Path]], + output: Path, + configs: list[dict[str, Any]], + *, + year: int | None = None, + timezones: dict[str, str] | None = None, + file_years: dict[str, int] | None = None, + defaults: bool = True, + extract_all: bool = False, + regex_timeout: float = 0.05, + window: int = 120, + max_line_bytes: int = 1048576, + max_file_bytes: int = 536870912, + max_links: int = 1000000, +) -> dict[str, Any]: + validate_output(output, inputs) + matcher = Matcher(configs, regex_timeout, defaults) + sha256_indicators: dict[str, list[dict[str, Any]]] = {} + for indicator in matcher.indicators: + if indicator.get("type") == "sha256": + sha256_indicators.setdefault(indicator["value"].lower(), []).append(indicator) + output.mkdir(parents=True) + start = time.perf_counter() + db = make_database(output / "evidence.sqlite") + stats: Counter[str] = Counter() + kinds: Counter[str] = Counter() + warnings: Counter[str] = Counter() + coverage: dict[tuple[str, str], Counter[str]] = {} + before: list[dict[str, Any]] = [] + file_hash_hits: list[dict[str, Any]] = [] + timezones, file_years = timezones or {}, file_years or {} + config = { + "appliances": [name for name, _ in inputs], + "year": year, + "timezones": timezones, + "file_years": file_years, + "configs": matcher.configs, + "defaults": defaults, + "extract_all": extract_all, + "regex_timeout": regex_timeout, + "window": window, + "max_line_bytes": max_line_bytes, + "max_file_bytes": max_file_bytes, + "max_links": max_links, + } + dump(output / "configuration.json", config) + + @lru_cache(maxsize=128) + def decode_cached(value: str) -> list[dict[str, Any]]: + return decode_layers(value, max_bytes=min(max_line_bytes, 16384)) + + try: + for name, root in inputs: + files = inventory(root) + before.extend({"appliance": name, **row} for row in files) + for row in files: + file_hash_hits.extend( + { + "appliance": name, + "source": row["source"], + "sha256": row["sha256"], + "indicator": indicator, + "basis": "SHA-256 of original file bytes; not a text occurrence", + } + for indicator in sha256_indicators.get(row.get("sha256") or "", []) + ) + for record in iter_records(root, name, max_line_bytes, max_file_bytes): + stats["records"] += 1 + ref = (name, record["source"]) + coverage.setdefault(ref, Counter())["records"] += 1 + if record.get("error"): + stats["read_errors"] += 1 + coverage[ref]["read_errors"] += 1 + event = parse_record( + record, timezones.get(name), file_years.get(f"{name}/{record['source']}", year) + ) + kinds[event["kind"]] += 1 + warnings.update(event["warnings"]) + if event["kind"] == "unknown": + coverage[ref]["unparsed"] += 1 + if not event["timestamp"]: + stats["without_timestamp"] += 1 + text = record["raw"] + analysis_errors: list[str] = [] + + def search( + value: str, + errors: list[str] = analysis_errors, + record_ref: tuple[str, str] = ref, + ) -> tuple[list[str], list[dict[str, Any]], list[dict[str, Any]]]: + try: + return matcher.search_with_details(value, include_sigma=False) + except TimeoutError: + errors.append("regex_timeout; matching incomplete") + stats["matching_errors"] += 1 + coverage[record_ref]["matching_errors"] += 1 + return [], [], [] + + rules, hits, rule_details = search(text) + fields = event["fields"] + candidates = [ + fields[key] for key in ("user_agent", "uri", "referer") if fields.get(key) + ] + # Decode actual fields and encoding-shaped text, not every timestamp/IP hit. + residual = text + for candidate in dict.fromkeys(candidates): + # Tiny delimiters are not encoded fields and must not erase other headers. + if len(candidate) >= 8: + residual = residual.replace(candidate, " ") + if has_encoding_candidate(residual): + # The residual is a gate only: decode original bytes/text and preserve spans. + candidates.append(text) + layers: list[dict[str, Any]] = [] + if ( + rules + or hits + or any(any(char in c for char in "%:=?") for c in candidates) + or any(has_encoding_candidate(candidate) for candidate in candidates) + or (not fields.get("uri") and bool(candidates)) + ): + for candidate_id, candidate in enumerate(dict.fromkeys(candidates)): + # Cache repeated small headers only; large payloads must not accumulate. + decoded = ( + decode_cached(candidate) + if len(candidate) <= 4096 + else decode_layers(candidate, max_bytes=min(max_line_bytes, 16777216)) + ) + # Keep originals only when an actual transformation/error exists. + if len(decoded) > 1 or any(layer.get("error") for layer in decoded): + layers.extend( + {**layer, "candidate_id": candidate_id} for layer in decoded + ) + for layer in decoded[1:]: + if not layer.get("error") and layer.get("sha256"): + hits.extend( + {**indicator, "basis": "decoded_bytes_sha256"} + for indicator in sha256_indicators.get(layer["sha256"], []) + ) + value = layer.get("output") + if value and layer.get("output_encoding") != "hex": + extra_rules, extra_hits, extra_details = search(value) + rules.extend(extra_rules) + hits.extend(extra_hits) + rule_details.extend(extra_details) + decoded_views = [ + (index, layer["output"]) + for index, layer in enumerate(layers) + if layer.get("transformation") != "original" + and layer.get("output") + and layer.get("output_encoding") != "hex" + and not layer.get("error") + ] + event["sha256"] = sorted( + { + layer["sha256"] + for layer in layers + if layer.get("transformation") != "original" + and layer.get("sha256") + and not layer.get("error") + } + ) + event["sigma_decoded_views"] = [index for index, _ in decoded_views] + try: + sigma_details = matcher.search_sigma( + event, [value for _, value in decoded_views] + ) + rules.extend(str(detail["id"]) for detail in sigma_details) + rule_details.extend(sigma_details) + except (TimeoutError, SigmaEvaluationLimit) as exc: + analysis_errors.append(f"{type(exc).__name__}; Sigma matching incomplete") + stats["matching_errors"] += 1 + coverage[ref]["matching_errors"] += 1 + decoding_errors = sum(bool(layer.get("error")) for layer in layers) + stats["decoding_errors"] += decoding_errors + rules = sorted(set(rules)) + selected = bool( + rules + or hits + or event["categories"] + or record.get("error") + or decoding_errors + or analysis_errors + or extract_all + ) + if not selected: + continue + event.update( + rules=rules, + rule_details=list( + { + json.dumps(detail, sort_keys=True): detail for detail in rule_details + }.values() + ), + indicator_matches=hits, + decoding=layers, + analysis_errors=analysis_errors, + ) + indicators = extract_indicators(text) + for layer in layers: + if layer.get("output") and layer.get("output_encoding") != "hex": + indicators.extend(extract_indicators(layer["output"])) + if ( + layer.get("transformation", "").startswith("base64") + and layer.get("sha256") + and not layer.get("error") + and layer.get("output") + ): + value = layer["sha256"] + indicators.append( + { + "type": "sha256", + "value": value, + "defanged": value, + "role": "decoded_payload", + } + ) + # Deduplicate within an event; distinct log events stay distinct. + indicators = list({(i["type"], i["value"]): i for i in indicators}.values()) + event["indicators"] = indicators + cur = db.execute( + "INSERT INTO events VALUES(NULL,?,?,?,?,?,?)", + ( + name, + record["source"], + record["line"], + event["timestamp"], + event["kind"], + json.dumps(event, ensure_ascii=False), + ), + ) + event_id = cur.lastrowid + stats["selected"] += 1 + stats["findings"] += bool(rules or hits) + stats["update_records"] += bool(event["categories"]) + for item in indicators: + db.execute( + """INSERT INTO iocs VALUES(?,?,?,?,?) ON CONFLICT(type,value) + DO UPDATE SET count=count+1""", + (item["type"], item["value"], item["defanged"], 1, event_id), + ) + for hit in hits: + db.execute( + "INSERT INTO indicator_hits VALUES(?,?,?,?)", + ( + event_id, + hit.get("type", "literal"), + hit["value"], + hit.get("status", "reference_only"), + ), + ) + keys = set() + for key in ( + "src", + "source_ip", + "client_ip", + "uri", + "session_id", + "transaction_id", + "request_id", + ): + if fields.get(key): + keys.add( + ("source_ip" if key in {"src", "client_ip"} else key, str(fields[key])) + ) + for item in indicators: + if item["type"] in {"path", "sha256"}: + keys.add((item["type"], item["value"])) + if event["timestamp"]: + db.executemany( + "INSERT INTO event_keys VALUES(?,?,?,?,?)", + [(event_id, name, key, value, event["timestamp"]) for key, value in keys], + ) + if stats["selected"] % 1000 == 0: + db.commit() + db.commit() + after = [{"appliance": name, **row} for name, root in inputs for row in inventory(root)] + if before != after: + raise ValueError("Original files changed during analysis") + inventory_errors = sum(bool(row.get("error")) for row in before) + stats["inventory_errors"] = inventory_errors + dump(output / "input_manifest.json", before) + dump(output / "file_hash_hits.json", file_hash_hits) + stats["file_hash_hits"] = len(file_hash_hits) + from .correlation import correlate_database + + correlation = correlate_database(db, window_seconds=window, max_links=max_links) + db.commit() + export(db, output) + summary = { + "status": "partial" + if ( + stats["read_errors"] + or stats["decoding_errors"] + or stats["matching_errors"] + or inventory_errors + or correlation["incomplete"] + ) + else "complete", + "tool_version": __version__, + "python": platform.python_version(), + "created_utc": datetime.now(UTC).isoformat(), + "duration_seconds": round(time.perf_counter() - start, 3), + "counts": dict(stats), + "kinds": dict(kinds), + "warnings": dict(warnings), + "files": len(before), + "input_bytes": sum(f["size"] for f in before), + "integrity": "not_fully_verified" if inventory_errors else "unchanged", + "resources": { + "scan_workers": 1, + "sqlite_cache_kib": 8192, + "sqlite_temporary_storage": "disk", + "decode_cache_entries": 128, + "decode_cache_max_candidate_characters": 4096, + }, + "correlation": correlation, + } + dump(output / "summary.json", summary) + dump( + output / "coverage.json", + [{"appliance": a, "source": s, **dict(c)} for (a, s), c in sorted(coverage.items())], + ) + # Assessment reports are written separately from the extracted data. + return summary + except (Exception, KeyboardInterrupt) as exc: + with suppress(sqlite3.Error): + db.commit() + with suppress(OSError): + dump( + output / "summary.json", + { + "status": "failed", + "error_type": type(exc).__name__, + "counts": dict(stats), + "integrity": "not_verified", + }, + ) + raise + finally: + db.close() + + +def export(db: sqlite3.Connection, output: Path) -> None: + with ( + (output / "findings.jsonl").open("w", encoding="utf-8") as findings, + (output / "updates.jsonl").open("w", encoding="utf-8") as updates, + ): + for event_id, data in db.execute("SELECT id,data FROM events ORDER BY id"): + event = json.loads(data) + event["id"] = event_id + line = json.dumps(event, ensure_ascii=False) + "\n" + findings.write(line) + if event["categories"]: + updates.write(line) + with (output / "IOCS.csv").open("w", newline="", encoding="utf-8") as handle: + writer = csv.writer(handle) + writer.writerow(["type", "value", "defanged", "event_count", "first_event", "status"]) + labels: dict[str, set[str]] = {} + for value, status in db.execute("SELECT DISTINCT value,status FROM indicator_hits"): + labels.setdefault(value, set()).add(status) + for row in db.execute("SELECT * FROM iocs ORDER BY type,value"): + statuses = labels.get(row[1], set()) + status = ( + "authorized_test" + if "authorized_test" in statuses + else ( + "context_only" + if "context_only" in statuses + else ";".join(sorted(statuses)) or "observed_candidate" + ) + ) + writer.writerow([*row, status]) + with (output / "indicator_hits.csv").open("w", newline="", encoding="utf-8") as handle: + writer = csv.writer(handle) + writer.writerow(["event_id", "type", "value", "status"]) + writer.writerows( + db.execute("SELECT DISTINCT * FROM indicator_hits ORDER BY event_id,type,value") + ) + cursor = db.execute("SELECT * FROM correlations") + columns = [column[0] for column in cursor.description] + with (output / "correlations.jsonl").open("w", encoding="utf-8") as handle: + for row in cursor: + handle.write( + json.dumps(dict(zip(columns, row, strict=True)), ensure_ascii=False) + "\n" + ) diff --git a/src/netscaler_triage/indicators.py b/src/netscaler_triage/indicators.py new file mode 100644 index 0000000..9fccaad --- /dev/null +++ b/src/netscaler_triage/indicators.py @@ -0,0 +1,94 @@ +"""Extract observables, not verdicts. Original values remain suitable for exact matching.""" + +import ipaddress +import re +from typing import Any +from urllib.parse import urlsplit + + +def defang(value: str, indicator_type: str) -> str: + if indicator_type in {"url", "domain", "ipv4", "ipv6", "ip"}: + value = re.sub(r"^https:", "hxxps:", value, flags=re.I) + value = re.sub(r"^http:", "hxxp:", value, flags=re.I) + value = value.replace(".", "[.]").replace(":", "[:]") + return value + + +def extract_indicators(text: str) -> list[dict[str, Any]]: + if len(text) > 16777216: + raise ValueError("indicator input exceeds 16 MiB; process log lines individually") + found: dict[tuple[str, str], dict[str, Any]] = {} + + def add(kind: str, value: str, role: str = "observable", start: int | None = None) -> None: + key = (kind, value) + if key not in found: + found[key] = dict( + type=kind, + value=value, + defanged=defang(value, kind), + role=role, + observation="Text occurrence; not evidence of a connection or execution.", + start=start, + ) + + urls = list(re.finditer(r"\bhttps?://[^\s<>\"'`]+", text, re.I)) + for match in urls: + value = match.group().rstrip("),;}") + add("url", value, "url_in_text", match.start()) + try: + hostname = urlsplit(value).hostname + if hostname: + try: + parsed = ipaddress.ip_address(hostname) + add( + "ipv4" if parsed.version == 4 else "ipv6", + hostname, + "url_host", + match.start(), + ) + except ValueError: + if "." in hostname and re.fullmatch(r"[A-Za-z0-9.-]+", hostname): + add("domain", hostname, "url_host", match.start()) + except ValueError: + pass + for match in re.finditer( + r"(?|;{}()]+", text): + while url_index < len(urls) and urls[url_index].end() <= match.start(): + url_index += 1 + if ( + url_index < len(urls) + and urls[url_index].start() <= match.start() < urls[url_index].end() + ): + continue + add("path", match.group(), "path_in_text", match.start()) + return list(found.values()) diff --git a/src/netscaler_triage/ingest.py b/src/netscaler_triage/ingest.py new file mode 100644 index 0000000..8b60c3a --- /dev/null +++ b/src/netscaler_triage/ingest.py @@ -0,0 +1,392 @@ +"""Read-only log ingestion and bounded, non-overwriting archive extraction.""" + +from __future__ import annotations + +import gzip +import hashlib +import io +import os +import re +import shutil +import stat +import tarfile +import zipfile +import zlib +from collections.abc import Buffer, Iterator +from pathlib import Path, PurePosixPath +from typing import NotRequired, TypedDict + +from py7zr.io import Py7zIO + + +class InventoryEntry(TypedDict): + source: str + size: int + sha256: str | None + error: NotRequired[str] + + +class ArchiveProvenance(TypedDict): + archive: str + sha256: str + depth: int + + +class ArchiveEntry(InventoryEntry): + archives: list[ArchiveProvenance] + + +class RecordSource(TypedDict): + appliance: str + source: str + + +class LogRecord(RecordSource): + line: int + raw: str + warnings: list[str] + error: NotRequired[str] + + +class InputError(ValueError): + pass + + +class ArchiveError(InputError): + """Unreadable archive or unavailable password; safe to skip this input unit.""" + + +def _files(root: Path) -> Iterator[tuple[Path, OSError | None]]: + root = Path(root) + if root.is_symlink() or not root.is_dir(): + raise InputError("Input must be a real directory") + walk_errors: list[OSError] = [] + for directory, dirs, files in os.walk(root, followlinks=False, onerror=walk_errors.append): + while walk_errors: + error = walk_errors.pop(0) + yield Path(error.filename) if error.filename else root, error + for name in sorted(dirs + files): + if (Path(directory) / name).is_symlink(): + raise InputError("Symbolic link found in input") + dirs.sort() + for name in sorted(files): + path = Path(directory) / name + try: + mode = path.stat().st_mode + except OSError as exc: + yield path, exc + continue + if not stat.S_ISREG(mode): + raise InputError("Not a regular file") + yield path, None + for error in walk_errors: + yield Path(error.filename) if error.filename else root, error + + +def inventory(root: Path) -> list[InventoryEntry]: + root = Path(root) + result: list[InventoryEntry] = [] + for path, error in _files(root): + row: InventoryEntry = { + "source": path.relative_to(root).as_posix(), + "size": 0, + "sha256": None, + } + try: + if error: + raise error + row["size"] = path.stat().st_size + with path.open("rb") as handle: + row["sha256"] = hashlib.file_digest(handle, "sha256").hexdigest() + except OSError as exc: + row["error"] = type(exc).__name__ + result.append(row) + return result + + +def iter_records( + root: Path, appliance: str, max_line_bytes: int = 1048576, max_file_bytes: int = 536870912 +) -> Iterator[LogRecord]: + """Yield lines, including explicit error records; limits count expanded bytes.""" + if min(max_line_bytes, max_file_bytes) < 1: + raise ValueError("Invalid read limit") + root = Path(root) + for path, error in _files(root): + base: RecordSource = {"appliance": appliance, "source": path.relative_to(root).as_posix()} + number = 0 + try: + if error: + raise error + with path.open("rb") as original: + magic = original.read(8) + original.seek(0) + if magic.startswith( + (b"7z\xbc\xaf\x27\x1c", b"PK\x03\x04", b"\x7fELF") + ) or path.name.lower().endswith((".tar", ".tgz", ".tar.gz", ".zip", ".7z")): + yield { + **base, + "line": 0, + "raw": "", + "error": "UnsupportedInput", + "warnings": ["Archive or binary file; not processed as text"], + } + continue + handle = ( + gzip.GzipFile(fileobj=original) if magic.startswith(b"\x1f\x8b") else original + ) + try: + total = 0 + while True: + chunk = handle.readline(min(max_line_bytes + 1, max_file_bytes - total + 1)) + if not chunk: + break + number += 1 + total += len(chunk) + if b"\x00" in chunk: + raise InputError("Binary data encountered; text processing stopped") + if len(chunk) > max_line_bytes or total > max_file_bytes: + raise InputError( + "Line or file size limit exceeded; processing stopped for this file" + ) + warnings = [] + try: + raw = chunk.decode("utf-8") + except UnicodeDecodeError: + raw = chunk.decode("utf-8", errors="replace") + warnings.append( + "Invalid UTF-8; unmodified original bytes remain in the source file" + ) + yield { + "appliance": appliance, + "source": base["source"], + "line": number, + "raw": raw.rstrip("\r\n"), + "warnings": warnings, + } + finally: + if handle is not original: + handle.close() + except (OSError, EOFError, InputError, zlib.error) as exc: + yield { + **base, + "line": number, + "raw": "", + "error": type(exc).__name__, + "warnings": [ + str(exc) + if isinstance(exc, InputError) + else "Read error; file processing is incomplete" + ], + } + + +def _member(name: str) -> Path: + if not name or "\x00" in name or "\\" in name or re.match(r"^[A-Za-z]:", name): + raise InputError("Unsafe archive path") + p = PurePosixPath(name) + if p.is_absolute() or ".." in p.parts or ":" in name: + raise InputError("Unsafe archive path") + if not p.parts or any(part in {"", "."} for part in name.rstrip("/").split("/")): + raise InputError("Ambiguous archive path") + if any( + part.endswith((".", " ")) + or re.fullmatch(r"(?i)(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?", part) + for part in p.parts + ): + raise InputError("Non-portable reserved archive path") + return Path(*p.parts) + + +def extract_archive( + source: Path, + destination: Path, + max_bytes: int = 2147483648, + max_files: int = 100000, + max_depth: int = 3, + *, + password: str | None = None, +) -> list[ArchiveEntry]: + """Extract 7z/ZIP/TAR recursively; gzip logs remain intact. Destination must be new. + + Quotas apply across all nested archives and to bytes actually written. On error + only the newly created destination is removed. Returned inventory is relative. + The optional password also applies to nested archives, is never returned, + and is encoded as UTF-8 for ZIP encryption. ZIP supports ZipCrypto and AES. + """ + source, destination = Path(source), Path(destination) + if ( + source.is_symlink() + or not source.is_file() + or min(max_bytes, max_files) < 1 + or max_depth < 0 + ): + raise InputError("Invalid archive input or limits") + if any(p.is_symlink() for p in (destination, *destination.parents)): + raise InputError("Destination contains a symbolic link") + destination.mkdir(parents=False, exist_ok=False) + budget = {"bytes": 0, "files": 0, "entries": 0} + provenance: list[ArchiveProvenance] = [] + + class Sink(io.BufferedIOBase, Py7zIO): + def __init__(self, path: Path) -> None: + path.parent.mkdir(parents=True, exist_ok=True) + self.handle = path.open("x+b") + self.length = 0 + budget["files"] += 1 + if budget["files"] > max_files: + self.handle.close() + raise InputError("File count limit exceeded") + + def write(self, data: Buffer) -> int: + if self.handle.tell() != self.length: + raise InputError("Archive requests overwriting previously extracted data") + budget["bytes"] += memoryview(data).nbytes + if budget["bytes"] > max_bytes: + raise InputError("Extraction size limit exceeded") + written = self.handle.write(data) + self.length += written + return written + + def read(self, size: int | None = None) -> bytes: + return self.handle.read(65536 if size is None or size < 0 else min(size, 65536)) + + def seek(self, offset: int, whence: int = 0) -> int: + target = offset + ( + self.handle.tell() if whence == 1 else self.length if whence == 2 else 0 + ) + if whence not in (0, 1, 2) or not 0 <= target <= self.length: + raise InputError("Archive requests an invalid write offset") + return self.handle.seek(target) + + def flush(self) -> None: + if not self.handle.closed: + self.handle.flush() + + def size(self) -> int: + return self.length + + def close(self) -> None: + self.handle.close() + + def unpack(archive: Path, folder: Path, depth: int) -> None: + if depth > max_depth: + raise InputError("Archive nesting depth exceeded") + with archive.open("rb") as handle: + archive_hash = hashlib.file_digest(handle, "sha256").hexdigest() + provenance.append( + { + "archive": source.name + if archive == source + else archive.relative_to(destination).as_posix(), + "sha256": archive_hash, + "depth": depth, + } + ) + written: list[Path] = [] + + def target(name: str, is_dir: bool = False) -> Path: + path = folder / _member(name) + if is_dir: + path.mkdir(parents=True, exist_ok=True) + else: + written.append(path) + return path + + if zipfile.is_zipfile(archive): + with zipfile.ZipFile(archive) as probe: + aes = any(info.compress_type == 99 for info in probe.infolist()) + zip_class: type[zipfile.ZipFile] | type[pyzipper.AESZipFile] = zipfile.ZipFile + if aes: + import pyzipper + + zip_class = pyzipper.AESZipFile + with zip_class(archive) as z: + members = z.infolist() + budget["entries"] += len(members) + if budget["entries"] > max_files: + raise InputError("Too many archive entries") + for info in members: + mode = info.external_attr >> 16 + if stat.S_ISLNK(mode) or ( + stat.S_IFMT(mode) and not (stat.S_ISREG(mode) or stat.S_ISDIR(mode)) + ): + raise InputError("Link or special file found in archive") + path = target(info.filename, info.is_dir()) + if not info.is_dir(): + with ( + z.open( + info, pwd=password.encode("utf-8") if password is not None else None + ) as src, + Sink(path) as dst, + ): + shutil.copyfileobj(src, dst, 65536) + elif archive.suffix.lower() == ".7z": + import py7zr + from py7zr.io import WriterFactory + + sinks: list[Sink] = [] + + class Factory(WriterFactory): + def create(self, filename: str) -> Py7zIO: + sink = Sink(target(filename)) + sinks.append(sink) + return sink + + try: + # File objects make py7zr extraction sequential, keeping global quotas atomic. + with ( + archive.open("rb") as archive_stream, + py7zr.SevenZipFile(archive_stream, "r", password=password) as z, + ): + budget["entries"] += len(z.files) + if budget["entries"] > max_files: + raise InputError("Too many archive entries") + for item in z.files: + _member(item.filename) + if ( + item.is_symlink + or getattr(item, "is_junction", False) + or getattr(item, "is_socket", False) + ): + raise InputError("Link or special file found in archive") + if item.is_directory: + target(item.filename, True) + z.extractall(factory=Factory()) + finally: + for sink in sinks: + sink.close() + elif tarfile.is_tarfile(archive): + with tarfile.open(archive) as tar_archive: + for tar_info in tar_archive: + budget["entries"] += 1 + if budget["entries"] > max_files or not (tar_info.isdir() or tar_info.isfile()): + raise InputError("Unsupported TAR entry") + path = target(tar_info.name, tar_info.isdir()) + if tar_info.isfile(): + member_stream = tar_archive.extractfile(tar_info) + if member_stream is None: + raise ArchiveError("TAR file contents unavailable") + with member_stream as tar_source, Sink(path) as dst: + shutil.copyfileobj(tar_source, dst, 65536) + else: + raise ArchiveError("Unknown or damaged archive format") + for path in written: + if path.name.lower().endswith((".7z", ".zip", ".tar", ".tar.gz", ".tgz")): + nested = path.with_name(path.name + ".extracted") + nested.mkdir(exist_ok=False) + unpack(path, nested, depth + 1) + + try: + unpack(source, destination, 0) + items = inventory(destination) + if any(item.get("error") for item in items): + raise InputError("Extracted evidence could not be fully verified") + return [{**item, "archives": provenance} for item in items] + except BaseException as exc: + shutil.rmtree(destination) + if isinstance(exc, Exception) and not isinstance(exc, InputError): + raise ArchiveError( + "Archive extraction failed: missing or incorrect password, damaged archive, " + "or unsupported encryption" + ) from None + raise diff --git a/src/netscaler_triage/matching.py b/src/netscaler_triage/matching.py new file mode 100644 index 0000000..495269e --- /dev/null +++ b/src/netscaler_triage/matching.py @@ -0,0 +1,254 @@ +"""Configurable, bounded regular-expression and literal matching.""" + +from __future__ import annotations + +import ipaddress +import json +import math +from collections.abc import Mapping, Sequence +from importlib.resources import files +from typing import Any +from urllib.parse import urlsplit + +import regex + +from .config_loading import load_config as load_config +from .sigma_rules import SigmaMatcher + + +def public_config() -> dict[str, Any]: + """Load bundled public references offline, including their source metadata.""" + resource = files("netscaler_triage").joinpath("data", "threat_intel.json") + data = json.loads(resource.read_text(encoding="utf-8")) + if not isinstance(data, dict): + raise ValueError("Bundled public configuration must be an object") + return data + + +def _literal_matches(text: str, start: int, value: str, kind: str) -> bool: + end = start + len(value) + before = text[start - 1 : start] if start else "" + after = text[end : end + 1] + actual = text[start:end] + if kind in {"ip", "ipv4", "ipv6"}: + forbidden = "0123456789." if ":" not in value else "0123456789abcdefABCDEF:." + return not any(c and (c.isalnum() or c in forbidden + "_") for c in (before, after)) + if kind in {"sha256", "sha1", "md5"}: + return not any(c and (c.isalnum() or c == "_") for c in (before, after)) + if kind == "domain": + return not (before and (before.isalnum() or before in "_-")) and not ( + after and (after.isalnum() or after in "_.-") + ) + if kind == "path": + if actual != value: + return False + # A root-relative artifact also occurs after the authority in a full URL. + if ( + before + and (before.isalnum() or before in "_.-" or (before == "/" and value.startswith("/"))) + and ( + not value.startswith("/") + or not regex.search( + r"https?://[^/\s]+$", text[max(0, start - 4096) : start], regex.I + ) + ) + ): + return False + return value.endswith("/") or not (after and (after.isalnum() or after in "_.-/\\%+")) + if kind == "url": + expected, observed = urlsplit(value), urlsplit(actual) + if (expected.scheme.casefold(), expected.netloc.casefold()) != ( + observed.scheme.casefold(), + observed.netloc.casefold(), + ) or (expected.path, expected.query, expected.fragment) != ( + observed.path, + observed.query, + observed.fragment, + ): + return False + return not (before and (before.isalnum() or before in "_+.-")) and not ( + after and (after.isalnum() or after in "_.-/%?&=+#") + ) + return True + + +class Matcher: + """Raise timeouts so callers can record incomplete matching explicitly.""" + + def __init__( + self, configs: list[dict[str, Any]], timeout: float = 0.05, defaults: bool = True + ) -> None: + if not math.isfinite(timeout) or timeout <= 0: + raise ValueError("Regex timeout must be positive") + self.timeout = timeout + patterns: list[dict[str, Any]] = [] + self.indicators: list[dict[str, Any]] = [] + self.sigma_matchers: list[SigmaMatcher] = [] + self.configs = list(configs) + if defaults: + public = public_config() + rules = files("netscaler_triage").joinpath("data", "public_sigma.yml").read_text() + self.configs = [ + { + **public, + "patterns": [], + "sigma_rules": [{"source": "public_sigma.yml", "yaml": rules}], + } + ] + [config for config in configs if config != public] + identifiers: set[str] = set() + for config in self.configs: + for section in ("patterns", "indicators", "sigma_rules"): + rows = config.get(section, []) + if not isinstance(rows, list) or any(not isinstance(row, dict) for row in rows): + raise ValueError(f"Rule pack {section} must be a list of objects") + patterns.extend(config.get("patterns", [])) + self.indicators.extend(config.get("indicators", [])) + for pack in config.get("sigma_rules", []): + sigma_matcher = SigmaMatcher.from_yaml( + pack["yaml"], timeout=timeout, source=pack.get("source", "") + ) + for rule in sigma_matcher.rules: + if rule.identifier in identifiers: + raise ValueError( + f"Duplicate rule identifier across packs: {rule.identifier}" + ) + identifiers.add(rule.identifier) + self.sigma_matchers.append(sigma_matcher) + # Sigma catalog metadata must not bypass its detection conditions. + self.indicators = list( + {json.dumps(row, sort_keys=True): row for row in self.indicators}.values() + ) + self.rules: list[tuple[str, regex.Pattern[str]]] = [] + self.rule_metadata: list[list[dict[str, Any]]] = [] + seen_rules: dict[tuple[str, str], int] = {} + + def add_rule(name: str, pattern: str, row: dict[str, Any]) -> None: + identity = (name, pattern) + details: dict[str, Any] = { + "id": name, + "pattern": pattern, + **{ + key: row[key] + for key in ("description", "source", "source_id", "sources") + if key in row + }, + } + if identity not in seen_rules: + if name in identifiers: + raise ValueError(f"Conflicting rule identifier across packs: {name}") + seen_rules[identity] = len(self.rules) + self.rules.append((name, regex.compile(pattern))) + self.rule_metadata.append([]) + metadata = self.rule_metadata[seen_rules[identity]] + if details not in metadata: + metadata.append(details) + + for row in patterns: + pattern = row.get("pattern", row.get("regex")) + if not isinstance(pattern, str) or not pattern: + raise ValueError("Empty or invalid regex pattern") + add_rule(str(row.get("id", row.get("name", pattern))), pattern, row) + literal_groups: dict[str, list[dict[str, Any]]] = {} + for indicator in self.indicators: + value = indicator.get("value", "") + if not isinstance(value, str) or not value: + raise ValueError("Empty or invalid indicator") + kind = indicator.get("type", "literal") + if kind not in { + "ip", + "ipv4", + "ipv6", + "domain", + "url", + "path", + "sha256", + "sha1", + "md5", + "literal", + "regex", + }: + raise ValueError(f"Unsupported indicator type: {kind}") + if kind == "url": + parsed = urlsplit(value) + if not parsed.scheme or not parsed.netloc: + raise ValueError(f"Invalid URL indicator: {value}") + if kind in {"ip", "ipv4", "ipv6"}: + address = ipaddress.ip_address(value) + if kind != "ip" and kind != f"ipv{address.version}": + raise ValueError(f"Address family does not match indicator type: {value}") + if kind in {"sha256", "sha1", "md5"} and not regex.fullmatch( + rf"[0-9a-fA-F]{{{ {'sha256': 64, 'sha1': 40, 'md5': 32}[kind] }}}", value + ): + raise ValueError(f"Invalid {kind} indicator: {value}") + if kind == "regex": + add_rule(value, value, indicator) + continue + literal_groups.setdefault(value.casefold(), []).append(indicator) + self.literal_groups = literal_groups + # Preserve shorter indicators at the same start as the longest regex alternative. + self.literal_prefixes: dict[str, tuple[str, ...]] = {} + parents: list[str] = [] + for value in sorted(literal_groups): + while parents and not value.startswith(parents[-1]): + parents.pop() + parents.append(value) + self.literal_prefixes[value] = tuple(parents) + # One compiled alternation avoids one scan per IOC per log record. + self.literals = ( + regex.compile( + "|".join(regex.escape(v) for v in sorted(literal_groups, key=len, reverse=True)), + regex.IGNORECASE, + ) + if literal_groups + else None + ) + + def search(self, text: str) -> tuple[list[str], list[dict[str, Any]]]: + rules, hits, _ = self.search_with_details(text) + return rules, hits + + def search_with_details( + self, + text: str, + *, + event: Mapping[str, Any] | None = None, + include_sigma: bool = True, + ) -> tuple[list[str], list[dict[str, Any]], list[dict[str, Any]]]: + """Return metadata only for regex rules that actually matched this text.""" + details = [ + detail.copy() + for (_, pattern), metadata in zip(self.rules, self.rule_metadata, strict=True) + if pattern.search(text, timeout=self.timeout) + for detail in metadata + ] + rules = [row["id"] for row in details] + if include_sigma: + sigma_details = self.search_sigma(event if event is not None else {"raw": text}) + details.extend(sigma_details) + rules.extend(str(row["id"]) for row in sigma_details) + hits: list[dict[str, Any]] = [] + if self.literals: + for match in self.literals.finditer(text, timeout=self.timeout, overlapped=True): + for key in self.literal_prefixes.get(match.group().casefold(), ()): + hits.extend( + indicator + for indicator in self.literal_groups[key] + if _literal_matches( + text, + match.start(), + indicator["value"], + indicator.get("type", "literal"), + ) + ) + return list(dict.fromkeys(rules)), hits, details + + def search_sigma( + self, + event: Mapping[str, Any], + decoded: Sequence[str] = (), + ) -> list[dict[str, Any]]: + return [ + hit + for matcher in self.sigma_matchers + for hit in matcher.search_with_details(event, decoded) + ] diff --git a/src/netscaler_triage/parsing.py b/src/netscaler_triage/parsing.py new file mode 100644 index 0000000..10c096e --- /dev/null +++ b/src/netscaler_triage/parsing.py @@ -0,0 +1,197 @@ +"""Conservative NetScaler log classification and explicitly sourced UTC times.""" + +from __future__ import annotations + +import re +from collections.abc import Mapping +from datetime import UTC, datetime +from typing import Any +from zoneinfo import ZoneInfo + +_ACCESS = re.compile( + r"^(?P\S+)(?:\s+->\s+(?P\S+))? \S+ \S+ \[(?P