Citrix NetScaler Post-Exploitation Campaign: Web Shells Hidden as CSS Files, Rogue Superusers — Detection and Remediation Guide

---
title: NetScaler Web Server Process Spawning Shell or Interpreter
id: 3f8c2a91-7b4e-4d2a-9c61-8e5f0a1b2c3d
status: experimental
description: Detects NetScaler web server processes (nshttpd, httpd, nginx, php) spawning command interpreters or scripting engines — a strong indicator of web shell execution on the appliance following command injection.
references:
  - https://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/nshttpd'
      - '/httpd'
      - '/nginx'
      - '/php'
      - '/php-cgi'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/nsenter'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate NetScaler maintenance scripts are typically spawned by cron or CLI sessions, not the web server process
level: critical
---
title: NetScaler Suspicious File Written to Web-Served Directory
id: 8a1d4e52-3c9f-4b7a-a5d2-6f0e1c8b9a4d
status: experimental
description: Detects creation of new files in NetScaler web content directories, including files with CSS-style names that may be web shells masquerading as static assets, as observed in this campaign.
references:
  - https://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/netscaler/ns_gui/'
      - '/var/netscaler/gui/'
      - '/netscaler/portal/'
      - '/var/vpn/'
      - '/vpn/'
  filter_known_static:
    TargetFilename|contains:
      - '/netscaler/ns_gui/eb/'
      - '.log'
  condition: selection_paths and not filter_known_static
falsepositives:
  - Firmware upgrades and customization packages legitimately write to these paths; correlate against change windows and recent builds
level: high
---
title: NetScaler Privileged System User Creation
id: 5c7e9b13-2d4a-4f8c-b1e7-9a3d5f6c8e2b
status: experimental
description: Detects creation or privilege binding of system users on NetScaler appliances via audit log patterns — attackers in this campaign created superuser accounts for persistent administrative access.
references:
  - https://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html
  - https://attack.mitre.org/techniques/T1136/
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.persistence
  - attack.t1136
  - attack.privilege_escalation
  - attack.t1098
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'add system user'
      - 'bind system user'
      - 'set system user'
      - 'add ns user'
  condition: selection
falsepositives:
  - Legitimate administrator provisioning; alert on any execution outside documented change windows or from unexpected source sessions
level: high

// Hunt for NetScaler post-exploitation: shell execution, web shell file writes, and rogue user creation
// Ingest NetScaler syslog/audit logs into Sentinel via CEF or Syslog connector
let Lookback = 14d;
union isfuzzy=true
    // 1) Command injection / shell execution patterns in NetScaler syslog
    (Syslog
    | where TimeGenerated > ago(Lookback)
    | where Computer has_any ("netscaler", "ns", "adc") or ProcessName has_any ("nshttpd", "httpd")
    | where SyslogMessage has_any ("/bin/sh", "/bin/bash", "python", "perl", "curl http", "wget http", "chmod +x", "/tmp/", "/var/tmp/")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP),
    // 2) Rogue system user creation and privilege binding from NetScaler audit messages
    (CommonSecurityLog
    | where TimeGenerated > ago(Lookback)
    | where DeviceVendor == "Citrix" or DeviceProduct has "NetScaler"
    | where Message has_any ("add system user", "bind system user", "superuser", "add ns user", "CMD_EXECUTED")
    | project TimeGenerated, DeviceName, SourceIP, SourceUserName, Message),
    // 3) Anomalous requests to CSS-looking URLs carrying POST bodies or shell indicators
    (CommonSecurityLog
    | where TimeGenerated > ago(Lookback)
    | where DeviceVendor == "Citrix" or DeviceProduct has "NetScaler"
    | where RequestURL endswith ".css" or RequestURL contains ".css?"
    | where RequestMethod == "POST"
       or RequestURL has_any ("cmd=", "exec", "shell", "%3B", "%24%28", "${", "|base64")
    | project TimeGenerated, DeviceName, SourceIP, RequestMethod, RequestURL, RequestPayload)
| order by TimeGenerated desc

-- Velociraptor hunt: NetScaler web shell artifacts and rogue superuser accounts
-- Targets: unexpected files in web-served directories, modified ns.conf users, and suspicious processes

-- 1) Recently modified files in NetScaler web content directories (potential CSS-masqueraded shells)
SELECT FullPath, Size, Mtime, Ctime,
       parse_string_with_regex(string=FullPath, regex='\.(?P<Ext>[^.]+)$').Ext AS Extension
FROM glob(globs=['/netscaler/ns_gui/**/*.css', '/netscaler/ns_gui/**/*.php',
                 '/var/netscaler/gui/**/*.css', '/var/netscaler/gui/**/*.php',
                 '/var/vpn/**/*.php', '/netscaler/portal/**/*.css'])
WHERE Mtime > now() - 60*60*24*30
ORDER BY Mtime DESC

-- 2) Shells or interpreters running with web server parentage
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '^(sh|bash|dash|python|perl|php|nc)$'
   OR CommandLine =~ 'cmd=|/bin/sh|base64 -d|curl http|wget http'

-- 3) Enumerate configured system users from ns.conf for rogue superuser review
SELECT FullPath, Size, Mtime,
       read_file(filename=FullPath) AS ConfigContent
FROM glob(globs=['/flash/nsconfig/ns.conf'])

#!/bin/bash
# NetScaler compromise assessment & hardening verification script
# Run via shell access on the appliance (drop to shell from the CLI)
# Review output off-box; do not pipe anything to sh on the appliance itself.

echo "===== [1] Current build — verify against Citrix Security Bulletin ====="
cat /flash/nsconfig/.build_version 2>/dev/null
nsversion 2>/dev/null || echo "Run 'show ns version' from the NetScaler CLI"

echo "===== [2] Recently modified files in web-served directories (last 30 days) ====="
find /netscaler/ns_gui /var/netscaler/gui /var/vpn /netscaler/portal \
  -type f \( -name '*.css' -o -name '*.php' -o -name '*.js' -o -name '*.xml' \) \
  -mtime -30 -exec ls -la {} \; 2>/dev/null

echo "===== [3] Files with CSS names containing non-CSS content (shell masquerade check) ====="
for f in $(find /netscaler/ns_gui /var/netscaler/gui -name '*.css' -type f 2>/dev/null); do
  if head -c 512 "$f" | grep -qiE '<\?php|eval\(|system\(|/bin/sh|passthru|shell_exec|exec\('; then
    echo "SUSPICIOUS: $f"
    head -c 256 "$f"; echo
  fi
done

echo "===== [4] Configured system users — look for accounts you did not provision ====="
grep -E 'add system user|bind system user' /flash/nsconfig/ns.conf 2>/dev/null

echo "===== [5] Processes spawned by web server (web shell activity) ====="
ps aux | grep -E 'nshttpd|httpd' | grep -v grep
ps aux | awk '$3 ~ /sh|bash|python|perl/ {print}' 2>/dev/null

echo "===== [6] Outbound connections from the appliance (exfil/C2 review) ====="
netstat -an 2>/dev/null | grep ESTABLISHED | grep -vE '127\.0\.0\.1|::1'

echo "===== [7] New or unexpected files in /tmp and /var/tmp (last 14 days) ====="
find /tmp /var/tmp -type f -mtime -14 -exec ls -la {} \; 2>/dev/null

echo "===== [8] Recent authentication log review (unexpected admin logins) ====="
grep -iE 'login|authentication' /var/log/ns.log 2>/dev/null | tail -n 50

echo ""
echo "NEXT STEPS: (a) If any suspicious artifacts found, preserve /flash/nsconfig and logs before remediation."
echo "(b) Upgrade to the fixed build per the Citrix Security Bulletin for your release train."
echo "(c) After patching: delete rogue system users, rotate ALL credentials referenced in ns.conf"
echo "    (LDAP bind accounts, service accounts), revoke and reissue certificates, and invalidate sessions."
echo "(d) Restrict management interface (NSIP) exposure to a dedicated management network / jump host."