Initial release: offline NetScaler triage with Sigma rules and MIT license

examples/rules.yml

@@ -0,0 +1,23 @@
+title: NetScaler Encoded Diagnostic Command In Request Context
+id: 34bd2f41-877e-4e16-91a5-4aeb62dddc21
+name: example_decoded_diagnostic_command
+status: experimental
+description: >-
+  Synthetic example matching a decoded identity command in an HTTP request.
+  A match does not prove execution and authorized diagnostics can match.
+author: NetScaler Triage contributors
+references:
+  - https://sigmahq.io/sigma-specification/specification/sigma-rules-specification.html
+logsource:
+  product: netscaler
+  service: http_access
+detection:
+  selection:
+    uri|startswith: /vpn/
+    raw|re: '^id$'
+  excluded:
+    uri|contains: /health
+  condition: selection and not excluded
+falsepositives:
+  - Authorized security tests and administrative diagnostics.
+level: low