Add streaming filesystem triage and German usage guide

src/netscaler_triage/data/filesystem_rules.json

@@ -0,0 +1,102 @@
+{
+  "updated": "2026-10-05",
+  "classification": "review_candidate",
+  "rules": [
+    {
+      "id": "php_nonstandard_handler",
+      "regex": "\\b(?:addhandler|addtype|sethandler)\\b[^\\r\\n]{0,250}application/x-httpd-php[^\\r\\n]{0,100}\\.(?:deb|sig|ico|rpm|tgz|html|dat|png|so|sh)\\b",
+      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
+      "required_any_literal": [
+        "application/x-httpd-php"
+      ]
+    },
+    {
+      "id": "php_engine_enabled",
+      "regex": "\\bphp_(?:flag|admin_flag)\\s+engine\\s+on\\b",
+      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
+      "required_any_literal": [
+        "php_flag",
+        "php_admin_flag"
+      ]
+    },
+    {
+      "id": "web_alias_routing",
+      "regex": "\\b(?:alias|aliasmatch|rewriterule)\\b[^\\r\\n]{0,800}(?:/vpn/(?:media|theme|images)|\\.sig|\\.ctxs\\.receiver|\\.local_journal|receiver\\.min|logonuisimple)",
+      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
+      "required_any_literal": [
+        "alias",
+        "rewriterule"
+      ]
+    },
+    {
+      "id": "css_webshell_alias",
+      "regex": "(?:receiver\\.min(?:\\.[a-f0-9]*)?\\.css|logonuisimple\\.html\\.style\\.min(?:\\.[a-f0-9]+)?\\.css)",
+      "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
+      "required_any_literal": [
+        "receiver.min",
+        "logonuisimple"
+      ]
+    },
+    {
+      "id": "nsmon_cron",
+      "regex": "^[ \\t]*\\*/5[ \\t]+\\*[ \\t]+\\*[ \\t]+\\*[ \\t]+\\*[^\\r\\n]{0,200}\\bperl\\b[^\\r\\n]{0,200}nsmon\\.pl",
+      "source": "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md",
+      "required_any_literal": [
+        "nsmon.pl"
+      ]
+    },
+    {
+      "id": "privileged_monitor_account",
+      "regex": "\\b(?:add|set|bind)\\s+system\\s+user\\s+sec_monitor\\b[^\\r\\n]*",
+      "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
+      "required_any_literal": [
+        "sec_monitor"
+      ]
+    },
+    {
+      "id": "command_channel_header",
+      "regex": "\\b(?:http[_-])?(?:nsc[_-](?:ldap|clienttype)|x[_-]ux(?:[_-][0-9]+)?)\\b",
+      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
+      "required_any_literal": [
+        "ldap",
+        "clienttype",
+        "ux"
+      ]
+    },
+    {
+      "id": "cron_scrubbing_reference",
+      "regex": "(?:preg_replace|sed)[^\\r\\n]{0,800}(?:crontab|/vpn/scripts/linux)",
+      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
+      "required_any_literal": [
+        "preg_replace",
+        "sed"
+      ]
+    },
+    {
+      "id": "shell_privilege_change",
+      "regex": "\\bchmod\\s+(?:u\\+s|[2467][0-7]{3})\\s+/bin/sh\\b",
+      "source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
+      "required_any_literal": [
+        "chmod"
+      ]
+    },
+    {
+      "id": "reverse_shell_reference",
+      "regex": "/dev/tcp/|\\b(?:nc|ncat)\\s+[^\\r\\n]{0,100}-e\\s+/bin/(?:ba)?sh|\\bdup2\\s*\\(",
+      "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
+      "required_any_literal": [
+        "/dev/tcp/",
+        "nc",
+        "dup2"
+      ]
+    },
+    {
+      "id": "configuration_staging_reference",
+      "regex": "\\b(?:tar|cat)\\b[^\\r\\n]{0,500}/(?:flash/)?nsconfig[^\\r\\n]{0,500}(?:/var/netscaler|update_result)",
+      "source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
+      "required_any_literal": [
+        "nsconfig"
+      ]
+    }
+  ]
+}