PUBLIC THREAT INTELLIGENCE INVENTORY Review date: 2026-10-01 52 source records; all 37 distinct URLs supplied for this review checked. 246 unique indicator values; 41 behavior patterns; 47 Sigma rules. CANONICAL DATA AND TRACEABILITY config/threat_intel.json is the complete inventory in the source release. The installed package includes identical data/threat_intel.json and public_sigma.yml. Each IOC has a stable ID, literal type/value and all source observations. Those observations retain reporting context, confidence, source dates and roles. MISP attribute types, comments and to_ids flags are retained even when they conflict. Each source links to the indicator IDs and Sigma rule IDs derived from it. Raw articles, downloaded source files and private evidence are not release data. The exact requested URLs and subsequent alternate/raw URLs are distinct records. HTTP 200 alone does not mean content was accessible: the VirusTotal collection returned an application shell. The GreyNoise live tag was blocked. Neither was used to infer additional collection membership. The original Deyda script URL returned 404; the current filename was discovered from its repository tree. Citrix/ACSC direct retrieval errors are recorded alongside successful rendered page reviews. Undisclosed Citrix/Nextron matching logic is not reproduced. MATCHING AND INTERPRETATION Public references load automatically. Private packs remain explicitly opt-in under gitignored private/ and are excluded from release archives. URL and Base64 decoding, including nested/padding-free candidates, feeds the same Sigma/IOC matches. Raw events, transformation chains and hash evidence remain available. Encoding detection is bounded and heuristic, not exhaustive. Shared WARP infrastructure, scanner/test markers, historical 2025 indicators and tentative C2 associations keep their original qualifications. These are investigation leads, not automatic firewall blocks or proof of compromise. The legitimate customsnmpd path is inventoried but excluded from the standalone Sigma path selector; a literal catalog occurrence remains contextual evidence. Known-good baseline hashes are excluded from threat matching. The 683 generic webshell YARA rules referenced by the historical NCSC tools are indexed in external_rule_sets, with their original names and source hashes. They require their original whole-file/byte/offset semantics or concern other platforms. They are not advertised as equivalent line-oriented Sigma rules. A separate historical core-memory ROP signature likewise needs binary evidence. Generic PHP and configuration-text hunting adaptations are labeled separately. No malware payload URL was contacted and no fetched scanner or PoC was executed. SOURCE INDEX cisa-direct CISA: Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway Published: 2026-09-27; retrieved: 2026-10-01 Requested URL: False; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Direct retrieval unavailable; the official mailing-list publication was reviewed as an alternative source. cisa CISA bulletin distributed through GovDelivery https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42cc465 Published: 2026-09-27; retrieved: 2026-10-01 Requested URL: False; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Full text reviewed. mandiant Mandiant: Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances Published: 2026-09-29; retrieved: 2026-10-01 Requested URL: True; detection use: True Linked IOC IDs: 12; linked Sigma rule IDs: 11 Direct HTTP article verified. watchtowr watchTowr command injection analysis https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ Published: 2026-09-28; retrieved: 2026-10-01 Requested URL: True; detection use: True Linked IOC IDs: 0; linked Sigma rule IDs: 2 Read as technical evidence only; no PoC execution. Delayed processing means request status alone is inconclusive. levelblue LevelBlue: Observed Exploitation Artifacts and Hunt Indicators https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators Published: 2026-09-30; retrieved: 2026-10-01 Requested URL: True; detection use: True Linked IOC IDs: 24; linked Sigma rule IDs: 3 Direct HTTP article verified. truesec Truesec: Multiple Critical Vulnerabilities https://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway Published: 2026-09-28; retrieved: 2026-10-01 Requested URL: True; detection use: True Linked IOC IDs: 3; linked Sigma rule IDs: 0 Direct HTTP403; article independently readable through web retrieval, including detection section. virustotal-mandiant virustotal-mandiant https://www.virustotal.com/gui/collection/c794f2e5d051c46cd2ff5e429128d7e68954ba78e66735fc69362ec726e63ee4 Published: not established; retrieved: 2026-10-01T19:36:45.064779+00:00 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 HTTP200 JavaScript application shell; web retrieval failed. Collection contents not verified; registered access needed. No indicators inferred from collection. cert-eu cert-eu https://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771 Published: 2026-09-28T19:30:00+02:00; retrieved: 2026-10-01T19:36:45.064857+00:00 Requested URL: True; detection use: True Linked IOC IDs: 0; linked Sigma rule IDs: 2 Direct HTTP403; article independently readable through web retrieval, including detection section. unit42 unit42 https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/ Published: 2026-09-30; retrieved: 2026-10-01T19:36:45.064965+00:00 Requested URL: True; detection use: True Linked IOC IDs: 31; linked Sigma rule IDs: 4 Direct HTTP article verified. Page states updates Sep27 and Sep30 15:00 PT; current HTML published metadata Sep30, modification 2026-09-30T22:15:51Z. greynoise greynoise https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation Published: 2026-09-28; retrieved: 2026-10-01T19:36:45.065290+00:00 Requested URL: True; detection use: True Linked IOC IDs: 4; linked Sigma rule IDs: 0 Direct HTTP article verified. greynoise-tag greynoise-tag https://viz.greynoise.io/tag/citrix-netscaler-cve-2026-88771-login-command-injection-rce-attempt Published: not established; retrieved: 2026-10-01T19:36:45.276736+00:00 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 HTTP403 and web retrieval failed. Dynamic tag membership unavailable; no IP inferred from tag. esentire esentire https://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772 Published: 2026-09-29; retrieved: 2026-10-01T19:36:45.424617+00:00 Requested URL: True; detection use: True Linked IOC IDs: 16; linked Sigma rule IDs: 1 Direct HTTP article verified. beazley beazley https://labs.beazley.security/advisories/BSL-A1216 Published: 2026-09-26; retrieved: 2026-10-01T19:36:45.510941+00:00 Requested URL: True; detection use: True Linked IOC IDs: 10; linked Sigma rule IDs: 0 Direct HTTP article verified. Updated Sep29; secondary consolidation, attribution to originating reporters preserved. ifin-event ifin-event https://misp.ifin.network/feed/63670851-a19e-4fc4-8fe5-c89bebc8e921.json Published: 2026-09-28; retrieved: 2026-10-01T19:44:37.039091+00:00 Requested URL: True; detection use: True Linked IOC IDs: 68; linked Sigma rule IDs: 1 Direct HTTP retrieval successful; attacker resources were not requested. ifin-manifest ifin-manifest https://misp.ifin.network/feed/manifest.json Published: not established; retrieved: 2026-10-01T19:44:37.039380+00:00 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Direct HTTP retrieval successful; attacker resources were not requested. ifin-thread ifin-thread https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867 Published: not established; retrieved: 2026-10-01T19:44:37.039382+00:00 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Direct HTTP retrieval successful; attacker resources were not requested. elastic-toml elastic-toml https://raw.githubusercontent.com/elastic/detection-rules/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml Published: 2026-09-28; retrieved: 2026-10-01T19:44:37.039384+00:00 Requested URL: False; detection use: True Linked IOC IDs: 0; linked Sigma rule IDs: 1 Direct HTTP retrieval successful; attacker resources were not requested. rapid7 rapid7 https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/ Published: 2026-09-28; retrieved: 2026-10-01T19:44:37.039385+00:00 Requested URL: True; detection use: True Linked IOC IDs: 4; linked Sigma rule IDs: 1 Direct HTTP retrieval successful; attacker resources were not requested. arctic-wolf arctic-wolf https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md Published: 2026-09-30; retrieved: 2026-10-01T19:44:37.039386+00:00 Requested URL: False; detection use: True Linked IOC IDs: 37; linked Sigma rule IDs: 5 Direct HTTP retrieval successful; attacker resources were not requested. sygnia sygnia https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/ Published: 2026-09-30; retrieved: 2026-10-01T19:44:37.039387+00:00 Requested URL: True; detection use: True Linked IOC IDs: 15; linked Sigma rule IDs: 3 Direct HTTP retrieval successful; attacker resources were not requested. CITRIX-CTX697096 NetScaler security bulletin CTX697096 https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscaler-gateway-security-bulletin-for-cve202688771-and-cve202688772.html Published: not established; retrieved: 2026-10-01 Requested URL: False; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Canonical article accessible; attachment query-form URL failed. Authoritative fixed builds and exposure preconditions; no public attack IOC list. CVE-88778 additionally requires the Enhanced ISN configuration change. Configuration exposure is not compromise evidence. CITRIX-SECURITY-BLOG-20260930 NetScaler security guidance, updated September 30 https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/ Published: 2026-09-27; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Official article updated 2026-09-30. IOC logic available via Console/Support, not published here. Patching does not establish cleanup; rebuild when compromise is suspected. 13.1-64.24 avoids the documented 64.23 reboot issue where NS variables exist. Reader comments are not vendor IOC statements and are excluded. CITRIX-CTX694799 Steps after suspected NetScaler compromise https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html Published: 2025-06-25; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Preserve disk, logs and memory; record timezone/NTP; isolate; rotate exposed credentials and revoke certificates/private keys; investigate connected systems; rebuild. Packet-engine core generation triggers warm restart. Not a passive log-detection signature. Canonical support listing records modification 2026-05-13. NETSCALER-CONSOLE-IOC Console indicators-of-compromise detection https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/ioc.html Published: not established; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Telemetry required; BLX unsupported. Scan history and detection-logic updates are retained. No Compromise Detected is limited to current checks; failed/skipped scans are not negative findings. Detection internals absent; no invented equivalent rules. NETSCALER-FIM File integrity monitoring https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/file-integrity-monitoring.html Published: 2026-09-07; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Compares same-build vendor hashes against appliance files; distinguishes modified and added files and scan errors. BLX unsupported. A local log archive cannot reproduce vendor binary-baseline verification, exclusions, ownership/runtime checks or live device signatures. NETSCALER-CONSOLE-RELEASES Console service release notes https://docs.netscaler.com/en-us/netscaler-console-service/release-notes/whats-new.html Published: 2026-09-27; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 September 27 entry identifies CVE-88771 exposure through version scanning and recommends upgrade. Version-based exposure detection is separate from compromise detection and exact historical patch timing. NEXTRON-20260929 THOR NetScaler detection coverage https://www.nextron-systems.com/2026/09/29/new-thor-detection-coverage-for-citrix-netscaler-cve-2026-88771-and-cve-2026-88772/ Published: 2026-09-29; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Article explicitly withholds rule matching strings/implementation. Its filesystem IOC subset covers 12 checks consolidated into four definitions; 22 checks requiring logs/config/process/ownership/permissions/runtime context are omitted. PoC file detection is not proof of exploitation. No undisclosed rules reconstructed. CERTFR-2026-ALE-011 CERT-FR NetScaler alert https://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/ Published: 2026-09-28; retrieved: 2026-10-01 Requested URL: True; detection use: True Linked IOC IDs: 0; linked Sigma rule IDs: 3 Updated September 30. Reproduces Google DTLS/packet-engine hunting patterns and links YARA. Explicitly says ANSSI has not independently qualified them. Preserve original Google provenance and avoid counting duplicated patterns as independent confirmations. CIRCL-TR100 CIRCL NetScaler critical vulnerabilities https://circl.lu/pub/tr-100/ Published: not established; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Accessible public advisory. Configuration prerequisites, version recommendations, forensic preservation, external SIEM logs and investigation of outbound/internal activity. No additional concrete attack addresses/hashes or detection implementation imported. ACSC-NETSCALER-20260930 ACSC NetScaler advisory https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/critical-vulnerabilities-in-citrix-netscaler-adc-and-citrix-netscaler-gateway-products Published: 2026-09-28; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Updated September 30: investigate back to at least September 4, 2026. This is a minimum lookback, not proof earlier compromise was impossible. Updated introduction reports Australian exploitation; older background wording still says none reported, so retain update precedence. No public literal IOC table. watchtowr-dtls watchTowr DTLS analysis https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/ Published: not established; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Packet fragmentation/ROP and memory corruption need packet/core evidence; no packet exploit logic is converted to a log success verdict. watchtowr-repo watchTowr artifact generator repository https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 Published: not established; retrieved: 2026-10-01 Requested URL: True; detection use: True Linked IOC IDs: 2; linked Sigma rule IDs: 1 Read source only. Active command injection generator, not a passive scanner. Example output paths classified as PoC markers. poppelgaard Community CTX697096 checker https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker Published: not established; retrieved: 2026-10-01 Requested URL: True; detection use: True Linked IOC IDs: 143; linked Sigma rule IDs: 3 Read script only. Retain attributed infrastructure and scanner lists separately; community compromise labels are not adopted as local verdicts. technion Community NetScaler scanner https://github.com/technion/netscaler_scanner Published: not established; retrieved: 2026-10-01 Requested URL: True; detection use: True Linked IOC IDs: 3; linked Sigma rule IDs: 0 Read source only. Adds author-reported theme webshell paths. Mandiant-derived checks keep original attribution. Build-only CVE-88778 conclusion is not imported. deyda-guide Community assessment guide https://www.deyda.net/index.php/en/2026/08/28/netscaler-cve-checklist-updates-security-assessment-and-incident-response/ Published: not established; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Guide and corrected current script reviewed; no script executed. Known-clean platform hashes and normal diagnostic paths are not attack IOCs. deyda-requested-script Requested community script path https://github.com/Deyda/Security/blob/main/netscaler-ioc-check.sh Published: not established; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Requested path unavailable (raw equivalent HTTP404). Repository tree identifies deyda-netscaler-ioc-check.sh as current filename. deyda-script Current community assessment script https://raw.githubusercontent.com/Deyda/Security/main/deyda-netscaler-ioc-check.sh Published: not established; retrieved: 2026-10-01 Requested URL: False; detection use: True Linked IOC IDs: 7; linked Sigma rule IDs: 3 Corrected filename discovered from repository tree. Read source only; no copied scanner execution or known-good hash import. ncsc-nl-2025 NCSC-NL historical forensic checks https://github.com/NCSC-NL/citrix-2025 Published: 2025-08-06; retrieved: 2026-10-01 Requested URL: True; detection use: True Linked IOC IDs: 22; linked Sigma rule IDs: 2 2025 campaign, not evidence of 2026 CVE coverage. Extracted string observables; binary ROP, image metadata, timestomping, permissions and live checks remain external. fox-it Fox-IT forensic image triage https://github.com/fox-it/citrix-netscaler-triage Published: not established; retrieved: 2026-10-01 Requested URL: True; detection use: True Linked IOC IDs: 0; linked Sigma rule IDs: 1 Read implementation. Core utility needs disk and RAM-disk evidence; string heuristics adapted with PHP context only. Expected SUID binaries are not attack IOCs. poppelgaard-script Reviewed source component: poppelgaard-script https://raw.githubusercontent.com/ThomasPoppelgaard/netscaler-ctx697096-checker/main/ctx697096_check.sh Published: not established; retrieved: 2026-10-01 Requested URL: False; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Read-only source supporting parent repository review. technion-script Reviewed source component: technion-script https://raw.githubusercontent.com/technion/netscaler_scanner/main/mandiant-scanner.sh Published: not established; retrieved: 2026-10-01 Requested URL: False; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Read-only source supporting parent repository review. fox-ioc Reviewed source component: fox-ioc https://raw.githubusercontent.com/fox-it/citrix-netscaler-triage/main/iocitrix.py Published: not established; retrieved: 2026-10-01 Requested URL: False; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Read-only source supporting parent repository review. ncsc-checks Reviewed source component: ncsc-checks https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/checks.yaml Published: not established; retrieved: 2026-10-01 Requested URL: False; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Read-only source supporting parent repository review. ncsc-core-yara Reviewed source component: ncsc-core-yara https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/core-dump-checks/iocs.yar Published: not established; retrieved: 2026-10-01 Requested URL: False; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Read-only source supporting parent repository review. ncsc-live Reviewed source component: ncsc-live https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/live-host-bash-check/TLPCLEAR_check_script_cve-2025-6543-v1.8.sh Published: not established; retrieved: 2026-10-01 Requested URL: False; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Read-only source supporting parent repository review. watch-poc Reviewed source component: watch-poc https://raw.githubusercontent.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py Published: not established; retrieved: 2026-10-01 Requested URL: False; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Read-only source supporting parent repository review. ncsc-php_webshell_rules.yara NCSC-referenced general webshell YARA collection https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/yara/php_webshell_rules.yara Published: not established; retrieved: 2026-10-01 Requested URL: False; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Generic multi-platform historical webshell library, not campaign-specific NetScaler log rules. Indexed for external file/core scanning; no misleading line-by-line Sigma conversion. ncsc-thor-webshells.yar NCSC-referenced general webshell YARA collection https://raw.githubusercontent.com/NCSC-NL/citrix-2025/main/disk-image-checks/yara/thor-webshells.yar Published: not established; retrieved: 2026-10-01 Requested URL: False; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Generic multi-platform historical webshell library, not campaign-specific NetScaler log rules. Indexed for external file/core scanning; no misleading line-by-line Sigma conversion. requested-77a190a3 requested-77a190a3 https://github.com/elastic/detection-rules/blob/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml Published: not established; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Exact requested URL retained for audit; see linked alternate retrievals. requested-7e6e5286 requested-7e6e5286 https://github.com/rtkwlf/wolf-tools/blob/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md Published: not established; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Exact requested URL retained for audit; see linked alternate retrievals. requested-f8052bbe requested-f8052bbe https://support.citrix.com/external/article?articleNumber=CTX697096 Published: not established; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Exact requested URL retained for audit; see linked alternate retrievals. requested-6c93ceb2 requested-6c93ceb2 https://www.elastic.co/guide/en/security/8.19/potential-netscaler-log-poisoning-command-injection-attempt.html Published: not established; retrieved: 2026-10-01 Requested URL: True; detection use: False Linked IOC IDs: 0; linked Sigma rule IDs: 0 Unavailable or not verified; no indicator invented. REPRODUCIBLE CHECKS uv run python -W error -m unittest discover -s tests uv run mypy uv run ruff check src tests typing_stubs The tests verify catalog uniqueness and source links, raw and decoded matches, IP boundaries and preservation of encoding evidence. They do not establish the truth of every vendor attribution or successful exploitation of a device.