215 lines
9.0 KiB
JSON
215 lines
9.0 KiB
JSON
{
|
|
"updated": "2026-10-05",
|
|
"classification": "review_candidate",
|
|
"rules": [
|
|
{
|
|
"id": "php_nonstandard_handler",
|
|
"regex": "\\b(?:addhandler|addtype|sethandler)\\b[^\\r\\n]{0,250}application/x-httpd-php[^\\r\\n]{0,100}\\.(?:deb|sig|ico|rpm|tgz|html|dat|png|so|sh)\\b",
|
|
"source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
|
|
"required_any_literal": [
|
|
"application/x-httpd-php"
|
|
]
|
|
},
|
|
{
|
|
"id": "php_engine_enabled",
|
|
"regex": "\\bphp_(?:flag|admin_flag)\\s+engine\\s+on\\b",
|
|
"source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
|
|
"required_any_literal": [
|
|
"php_flag",
|
|
"php_admin_flag"
|
|
]
|
|
},
|
|
{
|
|
"id": "web_alias_routing",
|
|
"regex": "\\b(?:alias|aliasmatch|rewriterule)\\b[^\\r\\n]{0,800}(?:/vpn/(?:media|theme|images)|\\.sig|\\.ctxs\\.receiver|\\.local_journal|receiver\\.min|logonuisimple)",
|
|
"source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
|
|
"required_any_literal": [
|
|
"alias",
|
|
"rewriterule"
|
|
]
|
|
},
|
|
{
|
|
"id": "css_webshell_alias",
|
|
"regex": "(?:receiver\\.min(?:\\.[a-f0-9]*)?\\.css|logonuisimple\\.html\\.style\\.min(?:\\.[a-f0-9]+)?\\.css)",
|
|
"source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
|
|
"required_any_literal": [
|
|
"receiver.min",
|
|
"logonuisimple"
|
|
]
|
|
},
|
|
{
|
|
"id": "nsmon_cron",
|
|
"regex": "^[ \\t]*\\*/5[ \\t]+\\*[ \\t]+\\*[ \\t]+\\*[ \\t]+\\*[^\\r\\n]{0,200}\\bperl\\b[^\\r\\n]{0,200}nsmon\\.pl",
|
|
"source": "https://raw.githubusercontent.com/rtkwlf/wolf-tools/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771/README.md",
|
|
"required_any_literal": [
|
|
"nsmon.pl"
|
|
]
|
|
},
|
|
{
|
|
"id": "privileged_monitor_account",
|
|
"regex": "\\b(?:add|set|bind)\\s+system\\s+user\\s+sec_monitor\\b[^\\r\\n]*",
|
|
"source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
|
|
"required_any_literal": [
|
|
"sec_monitor"
|
|
]
|
|
},
|
|
{
|
|
"id": "command_channel_header",
|
|
"regex": "\\b(?:http[_-])?(?:nsc[_-](?:ldap|clienttype)|x[_-]ux(?:[_-][0-9]+)?)\\b",
|
|
"source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
|
|
"required_any_literal": [
|
|
"ldap",
|
|
"clienttype",
|
|
"ux"
|
|
]
|
|
},
|
|
{
|
|
"id": "cron_scrubbing_reference",
|
|
"regex": "(?:preg_replace|sed)[^\\r\\n]{0,800}(?:crontab|/vpn/scripts/linux)",
|
|
"source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
|
|
"required_any_literal": [
|
|
"preg_replace",
|
|
"sed"
|
|
]
|
|
},
|
|
{
|
|
"id": "shell_privilege_change",
|
|
"regex": "\\bchmod\\s+(?:u\\+s|[2467][0-7]{3})\\s+/bin/sh\\b",
|
|
"source": "https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances",
|
|
"required_any_literal": [
|
|
"chmod"
|
|
]
|
|
},
|
|
{
|
|
"id": "reverse_shell_reference",
|
|
"regex": "/dev/tcp/|\\b(?:nc|ncat)\\s+[^\\r\\n]{0,100}-e\\s+/bin/(?:ba)?sh|\\bdup2\\s*\\(",
|
|
"source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
|
|
"required_any_literal": [
|
|
"/dev/tcp/",
|
|
"nc",
|
|
"dup2"
|
|
]
|
|
},
|
|
{
|
|
"id": "configuration_staging_reference",
|
|
"regex": "\\b(?:tar|cat)\\b[^\\r\\n]{0,500}/(?:flash/)?nsconfig[^\\r\\n]{0,500}(?:/var/netscaler|update_result)",
|
|
"source": "https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators",
|
|
"required_any_literal": [
|
|
"nsconfig"
|
|
]
|
|
},
|
|
{
|
|
"id": "httpd_commented_security_directive",
|
|
"regex": "^[ \\t]*#[ \\t]*(?:Require[ \\t]+all[ \\t]+denied|php_flag[ \\t]+engine[ \\t]+off)\\b",
|
|
"description": "An Apache restriction is commented out. Compare with a trusted configuration of the same build; comments can be vendor defaults.",
|
|
"source": "",
|
|
"required_any_literal": [
|
|
"#"
|
|
],
|
|
"path_regex": "(?:^|/)(?:httpd|nshttpd)\\.conf$"
|
|
},
|
|
{
|
|
"id": "httpd_php_handler_review",
|
|
"regex": "^[ \\t]*AddHandler[ \\t]+application/x-httpd-php\\b",
|
|
"description": "PHP handler declaration. Check the mapped extensions and vendor baseline; a handler alone is not malicious.",
|
|
"source": "",
|
|
"required_any_literal": [
|
|
"addhandler"
|
|
],
|
|
"path_regex": "(?:^|/)(?:httpd|nshttpd)\\.conf$"
|
|
},
|
|
{
|
|
"id": "startup_python_reference",
|
|
"regex": "(?:/flash)?/nsconfig/rc\\.netscaler[^\\r\\n]{0,300}\\bpython(?:[23](?:\\.\\d+)?)?\\b",
|
|
"description": "Python is referenced alongside the startup configuration path. Verify actual file contents and administrative intent.",
|
|
"source": "",
|
|
"required_any_literal": [
|
|
"rc.netscaler"
|
|
]
|
|
},
|
|
{
|
|
"id": "core_file_removal",
|
|
"regex": "\\brm[ \\t]+(?:-[a-z]+[ \\t]+){0,3}[\\x22\\x27]?/var/core/\\*",
|
|
"description": "A command references removal of core files. This can be maintenance or evidence deletion; a logged command alone does not prove execution.",
|
|
"source": "",
|
|
"required_any_literal": [
|
|
"/var/core/"
|
|
],
|
|
"path_regex": "(?:^|/)(?:notice|sh|bash)\\.log(?:\\.|$)"
|
|
},
|
|
{
|
|
"id": "wsfed_request_id_anomaly",
|
|
"regex": "WSFed:[ \\t]*request_id[^\\r\\n]{0,2048}(?:[\\x80-\\xff\\xfe]|\\^[^\\r\\n]{0,256}\\^)",
|
|
"description": "WS-Federation request ID contains unusual characters. Encoding, corruption and malformed input are alternatives; this does not prove memory disclosure.",
|
|
"source": "",
|
|
"required_any_literal": [
|
|
"wsfed:"
|
|
],
|
|
"path_regex": "(?:^|/)ns\\.log(?:\\.|$)"
|
|
},
|
|
{
|
|
"id": "acs_control_marker",
|
|
"regex": "acs=<[^\\r\\n]{0,2048}\\xf0\\^M[^\\r\\n]{0,2048}>,[ \\t]*for",
|
|
"description": "ACS field contains an unusual byte/control representation. Inspect original bytes and authentication context; not proof of memory disclosure.",
|
|
"source": "",
|
|
"required_any_literal": [
|
|
"acs=<"
|
|
],
|
|
"path_regex": "(?:^|/)ns\\.log(?:\\.|$)"
|
|
},
|
|
{
|
|
"id": "web_artifact_response_review",
|
|
"regex": "(?:nsginstaller\\.deb|nsgclient[^\\s\\x22?]*|[0-9a-f]{6}\\.ico)[^\\r\\n\\x22]{0,512}HTTP/1\\.[01]\\x22[ \\t]+(?:404|202)[ \\t]+[0-9]{4}\\b",
|
|
"description": "A candidate artifact returned 202 or 404 with a four-digit response size. Status and size do not establish a web shell; inspect response content and filesystem evidence.",
|
|
"source": "",
|
|
"required_any_literal": [
|
|
"nsginstaller",
|
|
"nsgclient",
|
|
".ico"
|
|
],
|
|
"path_regex": "(?:^|/)httpaccess[^/]*$"
|
|
},
|
|
{
|
|
"id": "web_artifact_error_review",
|
|
"regex": "(?:File does not exist|not found|\\[error\\])[^\\r\\n]{0,1024}(?:nsginstaller\\.deb|nsgclient|[0-9a-f]{6}/\\.sig)",
|
|
"description": "Web server error mentions a candidate artifact. A missing-file error usually supports absence at that moment, not successful installation.",
|
|
"source": "",
|
|
"required_any_literal": [
|
|
"nsginstaller",
|
|
"nsgclient",
|
|
"/.sig"
|
|
],
|
|
"path_regex": "(?:^|/)httperror[^/]*$"
|
|
},
|
|
{
|
|
"id": "packet_engine_open_file_review",
|
|
"regex": "^NSPPE\\S*[ \\t]+\\d+[^\\r\\n]{0,1024}(?:/var/netscaler/|callhome)",
|
|
"description": "A captured open-file listing associates NSPPE with a candidate path. Inspect file type and process context; legitimate open files can match.",
|
|
"source": "",
|
|
"required_any_literal": [
|
|
"nsppe"
|
|
]
|
|
},
|
|
{
|
|
"id": "web_user_process_review",
|
|
"regex": "^(?:nobody|daemon)[ \\t]+\\d+[ \\t]+(?!(?:[^\\r\\n]*)(?:/bin/httpd|/usr/sbin/nshttpd)\\b)[^\\r\\n]{1,2048}$",
|
|
"description": "A captured process listing contains a non-httpd process under a web-service account. Validate the executable and parent; legitimate helper processes can match.",
|
|
"source": "",
|
|
"required_any_literal": [
|
|
"nobody",
|
|
"daemon"
|
|
]
|
|
},
|
|
{
|
|
"id": "startup_python_content",
|
|
"regex": "^[ \\t]*(?!#)[^\\r\\n]{0,512}\\bpython(?:[23](?:\\.\\d+)?)?\\b",
|
|
"path_regex": "(?:^|/)(?:flash/)?nsconfig/rc\\.netscaler$",
|
|
"description": "Python in startup configuration; compare with authorized configuration.",
|
|
"source": "",
|
|
"required_any_literal": [
|
|
"python"
|
|
]
|
|
}
|
|
]
|
|
}
|