title: NetScaler Encoded Diagnostic Command In Request Context
id: 34bd2f41-877e-4e16-91a5-4aeb62dddc21
name: example_decoded_diagnostic_command
status: experimental
description: >-
  Synthetic example matching a decoded identity command in an HTTP request.
  A match does not prove execution and authorized diagnostics can match.
author: NetScaler Triage contributors
references:
  - https://sigmahq.io/sigma-specification/specification/sigma-rules-specification.html
logsource:
  product: netscaler
  service: http_access
detection:
  selection:
    uri|startswith: /vpn/
    raw|re: '^id$'
  excluded:
    uri|contains: /health
  condition: selection and not excluded
falsepositives:
  - Authorized security tests and administrative diagnostics.
level: low