---
id: c1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
title: Potential Citrix NetScaler RCE via Shell Spawn
status: experimental
description: Detects potential exploitation of CVE-2023-3519 on Citrix NetScaler ADC and Gateway appliances. The vulnerability allows unauthenticated remote code execution. This rule identifies the parent web server process spawning a shell or interpreter, a common TTP for this vulnerability.
references:
    - https://support.citrix.com/article/CTX579475
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3519
author: Security Arsenal
date: 2026/04/06
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith:
            - '/nshttpd'
            - '/nsdhcpd'
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/perl'
            - '/python'
            - '/nc'
            - '/telnet'
    condition: selection
falsepositives:
    - Legitimate administrative troubleshooting (rare)
level: critical
tags:
    - attack.initial_access
    - attack.execution
    - cve.2023.3519
---
id: d2e3f4a5-b6c7-4d5e-9f0a-1b2c3d4e5f6a
title: Citrix Bleed Memory Leak via Large HTTP Response
status: experimental
description: Detects potential exploitation of CVE-2023-4966 ("Citrix Bleed") on Citrix NetScaler ADC and Gateway. This vulnerability allows sensitive information disclosure (session tokens) via a buffer overflow/leak. This rule identifies unusually large HTTP responses from the management interface, indicative of memory content leakage.
references:
    - https://support.citrix.com/article/CTX581492
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4966
author: Security Arsenal
date: 2026/04/06
logsource:
    category: webserver
detection:
    selection:
        cs-method|startswith: 'GET'
        sc-status: 200
        sc-bytes: > 1000000 # Threshold set to 1MB as normal web GUI responses are typically much smaller (KBs)
    filter_legitimate_download:
        c-uri|contains: '/downloads/'
    condition: selection and not filter_legitimate_download
falsepositives:
    - Legitimate large file downloads from the Gateway portal (if applicable)
level: high
tags:
    - attack.initial_access
    - attack.credential_access
    - cve.2023.4966

// Hunt for exploitation of CVE-2023-3519 (RCE) and CVE-2023-4966 (Citrix Bleed) on Citrix NetScaler ADC/Gateway
// Detects active scanning, attempts to trigger the memory leak (Bleed), NITRO API abuse (RCE), and webshell upload indicators
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor =~ "Citrix" 
| where DeviceProduct has_any ("NetScaler", "ADC", "Gateway")
| where DeviceEventClassID =~ "HTTP"
| where RequestURL has_any (
    "/oauth/idp/.well-known/openid-configuration", // Specific path triggering CVE-2023-4966 (Citrix Bleed)
    "/nitro/v1/config/",                           // NITRO API targeted in CVE-2023-3519 RCE exploits
    "/vpns/portal/scripts/",                       // Common directory for webshell drops
    "/vpns/cfg/smb.conf"                           // Reconnaissance activity
    )
    or RequestURL matches regex @"\.(jsp|php|pl|py|sh|cgi)$" // Suspicious file extensions indicative of webshells
// Exclude standard static asset requests to reduce false positives
| where not (RequestURL has @".js" or RequestURL has @".css" or RequestURL has @".gif" or RequestURL has @".ico")
| summarize 
    RequestCount = count(), 
    StartTime = min(TimeGenerated), 
    EndTime = max(TimeGenerated),
    UniqueURLs = dcount(RequestURL),
    SampleURLs = makeset(RequestURL),
    SampleUserAgents = makeset(UserAgent),
    ResponseCodes = makeset(ReasonCode) 
    by SourceIP, DestinationIP, DestinationPort
| where RequestCount > 3 // Threshold to identify scanning behavior vs one-off failures
| order by RequestCount desc

name: Hunt.Citrix.Netscaler.CVE20233519.Exploitation
description: |
  This artifact hunts for indicators of compromise associated with the active exploitation 
  of CVE-2023-3519 (RCE) and CVE-2023-4966 (Citrix Bleed) on Citrix NetScaler ADC/Gateway.
  It scans for webshells dropped in known directories, suspicious process execution (Perl/Python)
  typical of post-exploitation, and unauthorized outbound network connections.

sources:
- name: FileSystem/Webshells
  description: |
    -- Hunt for suspicious file artifacts in known vulnerable paths.
    -- Threat actors often drop .php, .pl, or .sh webshells in /netscaler/ns_gui, /var/vpn, or /var/tmp.
    -- We look for recently created or modified script files.
  query: |
    SELECT FullPath, Size, Mode, Mtime.Sys.Milliseconds AS MTime, Atime.Sys.Milliseconds AS ATime
    FROM glob(globs=[
        "/netscaler/ns_gui/**/*.php",
        "/netscaler/ns_gui/**/*.pl",
        "/netscaler/ns_gui/**/*.sh",
        "/var/vpn/**/*.php",
        "/var/vpn/**/*.pl",
        "/var/netscaler/logon/**/*.php",
        "/var/tmp/**/*.pl",
        "/var/tmp/**/*.sh",
        "/var/netscaler/logon/index.html"
    ])
    WHERE Mtime.Sys.Milliseconds > now() - 30 * 86400 
      OR Size < 50000 
      OR Mode.String =~ '^.*x.*$'

- name: Processes/SuspiciousExecution
  description: |
    -- Hunt for suspicious processes.
    -- Exploitation of CVE-2023-3519 often results in spawning Perl or Python shells 
    -- or the 'sh' process running as the 'nobody' or 'nsroot' user unexpectedly.
  query: |
    SELECT Pid, Ppid, Name, Username, Cmdline, CreateTime
    FROM pslist()
    WHERE Name IN ("perl", "python", "python3", "sh", "bash")
      AND Username NOT IN ("root", "nsroot") 
       OR Cmdline =~ "httpd"

- name: Network/C2Connections
  description: |
    -- Hunt for network indicators of Command and Control (C2).
    -- Identifies established outbound connections initiated by the appliance to external IPs.
    -- Filters for connections from suspicious shells (perl/sh) or non-standard ports.
  query: |
    SELECT Family, RemoteAddr, RemotePort, State, Pid, Uid, Name
    FROM netstat()
    LEFT JOIN pslist() ON Pid = Pid
    WHERE State = "ESTABLISHED"
      AND (
        Name =~ "perl" OR Name =~ "python" OR Name =~ "sh" OR
        (RemotePort NOT IN (80, 443, 22, 53, 123, 161, 67, 68) AND Family =~ "TCP")
      )

#!/bin/bash

case $ver in
    "13.1")
        if [ "$build" -lt 49 ]; then VULNERABLE=true; fi
        if [ "$build" -eq 49 ] && [ "$build_sub" -lt 15 ]; then VULNERABLE=true; fi
        ;;
    "13.0")
        if [ "$build" -lt 91 ]; then VULNERABLE=true; fi
        if [ "$build" -eq 91 ] && [ "$build_sub" -lt 21 ]; then VULNERABLE=true; fi
        ;;
    "12.1")
        if [ "$build" -lt 66 ]; then VULNERABLE=true; fi
        if [ "$build" -eq 66 ] && [ "$build_sub" -lt 18 ]; then VULNERABLE=true; fi
        ;;
esac

# Pattern 1: Specific endpoint targeted by the exploit
# Threat actors request /oauth/idp/.well-known/openid-configuration
ENDPOINT_HITS=$(grep -c "/oauth/idp/.well-known/openid-configuration" "$LOG_DIR" 2>/dev/null)

if [ "$ENDPOINT_HITS" -gt 0 ]; then
    echo "    [!] Found $ENDPOINT_HITS requests to the OIDC endpoint."
    echo "    Extracting User-Agents and IPs associated with these requests..."
    grep "/oauth/idp/.well-known/openid-configuration" "$LOG_DIR" | awk -F'"' '{print $6, $1}' | tail -n 20
else
    echo "    [OK] No hits on the OIDC endpoint found in current log."
fi

# Pattern 2: Abnormal Accept-Encoding headers (The vulnerability triggers on specific headers)
# While the specific high-byte header is binary, the request often results in a 400 or specific malformed HTTP logs
# We look for a high volume of requests to this endpoint resulting in 400/500 errors.
echo "    Checking for 400/500 errors on OIDC endpoint..."
grep "/oauth/idp/.well-known/openid-configuration" "$LOG_DIR" | grep -E "HTTP/\" (400|499|500)" > /tmp/citrix_bleed_ioc.txt
if [ -s /tmp/citrix_bleed_ioc.txt ]; then
    echo "    [!] Potential exploit attempts detected (Errors on OIDC endpoint):"
    cat /tmp/citrix_bleed_ioc.txt
else
    echo "    [OK] No error-based exploitation patterns found."
fi
rm -f /tmp/citrix_bleed_ioc.txt