CitrixBleed: Active NetScaler Memory Disclosure Attacks - Detection and Response Guide

---
title: CitrixBleed - Suspicious NetScaler Memory Disclosure Attempts
id: a4f7c2e1-9b8d-4f3a-a1c5-d7e8f9a0b1c2
status: experimental
description: Detects potential CitrixBleed exploitation attempts characterized by repeated requests with unusual URL patterns or headers targeting NetScaler appliances. Attacks may involve crafted requests designed to trigger memory disclosure.
references:
  - https://www.securityweek.com/new-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: netscaler
detection:
  selection:
    c-product|contains: 'netscaler'
  selection_suspicious_uri:
    cs-uri-query|contains:
      - 'offset='
      - 'mem='
      - 'ptr='
  selection_repeated:
    count() > 10
    timeframe: 2m
  condition: selection and (selection_suspicious_uri or selection_repeated)
falsepositives:
  - Legitimate API testing
  - Misconfigured monitoring probes
level: high
---
title: CitrixBleed - NetScaler Data Exfiltration via Outbound Connections
id: b5g8d3f2-a0c9-4b5e-b2d6-e8f9a1b0c2d3
status: experimental
description: Detects potential data exfiltration from NetScaler appliances following CitrixBleed exploitation. Compromised appliances may establish unusual outbound connections to attacker infrastructure.
references:
  - https://www.securityweek.com/new-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: netscaler
detection:
  selection:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
    dst_port|notin:
      - 80
      - 443
      - 22
      - 53
  filter_known:
    dst_ip|cidr:
      - '192.168.0.0/16'
      - '172.16.0.0/12'
      - '10.0.0.0/8'
  condition: selection and not filter_known
falsepositives:
  - Legitimate management connections
  - Known backend server communications
level: high
---
title: CitrixBleed - Unusual HTTP Response Sizes from NetScaler
id: c6h9e4g3-b1d0-5c6f-c3e7-f9a0b1c2d3e4
status: experimental
description: Detects potential memory disclosure via anomalous HTTP response sizes from NetScaler appliances. CitrixBleed exploitation often results in responses containing unexpected memory dumps.
references:
  - https://www.securityweek.com/new-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: webserver
  product: netscaler
detection:
  selection:
    sc-status: 200
    cs-method: 'GET'
  filter_normal:
    sc-bytes:
      - '< 5000'
      - '> 1000000'
  condition: selection and not filter_normal
falsepositives:
  - Large legitimate file downloads
  - API responses with data payloads
level: medium

// Hunt for CitrixBleed exploitation attempts in web proxy/ firewall logs
let TimeRange = ago(24h);
let NetScalerIPs = materialize(
    DeviceNetworkEvents 
    | where Timestamp > ago(7d)
    | where DeviceName contains "netscaler" or DeviceName contains "adc" or DeviceName contains "gateway"
    | distinct LocalIP
);
CommonSecurityLog
| where TimeGenerated > TimeRange
| where DeviceVendor in ("Citrix", "Citrix Systems")
| where DestinationIP in (NetScalerIPs)
| extend QueryString = extract("(\?.*)", 1, RequestURL)
| where isnotempty(QueryString)
| where QueryString contains "offset" or QueryString contains "ptr" or QueryString contains "mem"
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, RequestURL, RequestMethod, SentBytes, ReceivedBytes, Reason
| order by TimeGenerated desc
;

// Detect unusual outbound connections from NetScaler appliances
let SuspiciousDestinations = materialize(
    CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where DeviceVendor in ("Citrix", "Citrix Systems")
    | where DeviceAction == "Allowed"
    | where DestinationPort !in (80, 443, 22, 53)
    | summarize ConnectionCount = count() by DestinationIP, DestinationPort
    | where ConnectionCount < 5  // New/unusual destinations
    | distinct DestinationIP
);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where DeviceName contains "netscaler" or DeviceName contains "adc"
| where RemoteIP in (SuspiciousDestinations)
| project Timestamp, DeviceName, LocalIP, RemoteIP, RemotePort, Protocol, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
;

-- Hunt for suspicious network connections from NetScaler appliance
-- Note: This assumes Velociraptor client deployed or equivalent endpoint visibility
SELECT Timestamp, Family, RemoteAddr, RemotePort, State, Pid, Username, Cmdline
FROM netstat(pid=pid)
WHERE RemoteAddr NOT IN ('127.0.0.1', '::1', '0.0.0.0')
  AND RemotePort NOT IN (80, 443, 22, 53, 161, 3010, 3008)
  AND State =~ 'ESTABLISHED'
  AND Timestamp > now() - 24h
ORDER BY Timestamp DESC
;

-- Check for NetScaler-related processes and unusual parent-child relationships
SELECT Pid, Ppid, Name, Username, CommandLine, Exe, CreateTime
FROM pslist()
WHERE Name =~ 'ns'
   OR Name =~ 'citrix'
   OR Name =~ 'netscaler'
   OR Exe =~ '/netscaler/'
   OR Exe =~ '/flash/nsconfig/'
ORDER BY CreateTime DESC
;

#!/bin/bash
# CitrixBleed NetScaler Remediation Check and Hardening Script
# Run on NetScaler shell or via management console

echo "=== CitrixBleed Remediation Check ==="
echo "Date: $(date)"
echo "Hostname: $(hostname)"

# Check NetScaler version
echo "\n[1] Checking NetScaler version..."
SHOW_VERSION | grep "Build Version"

# Check if affected builds are present (adjust based on vendor advisory)
echo "\n[2] Checking for vulnerable builds..."
# Add specific vulnerable build checks from vendor advisory
# This is a placeholder - replace with actual vulnerable version checks

# Check for NSIP access from unrestricted sources
echo "\n[3] Checking NSIP access restrictions..."
SHOW NSIP | grep -E "IPADDRESS|NETMASK"

# Check management interface access
echo "\n[4] Checking management interface configuration..."
SHOW NSCONFIG | grep -E "enable_ns|mgmt"

# Review system logs for exploitation indicators
echo "\n[5] Checking for exploitation indicators in logs..."
grep -i "memory\|bleed\|disclosure" /var/log/ns.log | tail -20

# Check for unusual outbound connections
echo "\n[6] Checking current network connections..."
netstat -ant | grep ESTABLISHED | head -20

# Hardening recommendations
echo "\n=== HARDENING RECOMMENDATIONS ==="
echo "1. Apply the latest Citrix NetScaler build immediately"
echo "2. Restrict NSIP and management interface access to trusted networks only"
echo "3. Implement WAF rules to block suspicious request patterns"
echo "4. Review and rotate all credentials, certificates, and session tokens"
echo "5. Monitor for data exfiltration via outbound connection analysis"
echo "\nScript complete. Review output and take action based on findings."


---