CVE-2025-5777: Anubis Ransomware Exploiting Citrix Bleed 2 — Detection and Defense

---
title: Citrix ADC Shell Spawn via CVE-2025-5777
id: 8d4c2e1a-9b3f-4c1d-8e2a-1a2b3c4d5e6f
status: experimental
description: Detects potential exploitation of Citrix Bleed 2 by identifying the Citrix parent process spawning a shell or command line utility.
references:
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/netscaler/nshttpd'
      - '/netscaler/nsppe'
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/python'
  condition: selection
falsepositives:
  - Administrative debugging (Rare in production)
level: critical
---
title: Unauthorized RMM Tool Execution
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the execution of common RMM tools potentially installed by Anubis affiliates for lateral movement.
references:
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - 'AnyDesk'
      - 'ScreenConnect'
      - 'Splashtop'
      - 'ConnectWise'
      - 'Atera'
      - 'RemotePC'
  filter_legit_admin:
    ParentImage|contains:
      - 'Program Files'
      - 'Program Files (x86)'
    User|contains:
      - 'ADMIN'
      - 'SYSTEM'
  condition: selection | not filter_legit_admin
falsepositives:
  - Authorized IT support activities
level: high
---
title: LSASS Memory Access by Non-System Account
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects potential credential dumping activity by non-system processes accessing LSASS memory, a common Anubis tradecraft.
references:
  - https://attack.mitre.org/techniques/T1003/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess:
      - '0x1010'
      - '0x1410'
      - '0x143A'
      - '0x101a'
      - '0x410'
      - '0x430'
    SourceImage|notcontains:
      - '\System32\'
      - '\SysWOW64\'
      - 'lsass.exe'
  condition: selection
falsepositives:
  - Legitimate antivirus scanning
  - Backup software
level: high

// Hunt for Citrix Bleed 2 exploitation signs: Process execution on ADC or unexpected RMM traffic
// Note: Requires CEF or Syslog ingestion for Citrix logs, and DeviceProcessEvents for endpoints

let RMMTools = dynamic(['AnyDesk', 'ScreenConnect', 'Splashtop', 'ConnectWise', 'Atera', 'RemotePC', 'GoToMyPC']);
// Detect RMM processes spawning from suspicious parents (cmd, powershell, explorer)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FolderPath has_any (RMMTools) or FileName has_any (RMMTools)
| where InitiatingProcessFileName in ('cmd.exe', 'powershell.exe', 'powershell_ise.exe', 'wscript.exe', 'cscript.exe')
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, SHA256
| order by Timestamp desc

-- Hunt for suspicious RMM tools and unusual process parentage on endpoints
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username, 
  Parent.Pid AS ParentPid,
  Parent.Name AS ParentName,
  Parent.Cmdline AS ParentCmdline
FROM pslist()
WHERE Name IN ('AnyDesk.exe', 'RemotePC.exe', 'ScreenConnect.WindowsClient.exe', 'SplashtopStreamer.exe')
   AND Parent.Name NOT IN ('services.exe', 'explorer.exe', 'svchost.exe')
-- Also hunt for processes accessing LSASS suspiciously

# Script to identify and optionally stop common unauthorized RMM tools associated with Anubis activity
# Requires Administrator privileges

$UnauthorizedRMMs = @("AnyDesk", "ScreenConnect", "Splashtop", "Atera", "RemotePC")
$DetectedThreats = @()

Write-Host "Scanning for active RMM processes..." -ForegroundColor Cyan

foreach ($tool in $UnauthorizedRMMs) {
    $processes = Get-Process -Name "*$tool*" -ErrorAction SilentlyContinue
    
    if ($processes) {
        foreach ($proc in $processes) {
            Write-Host "[ALERT] Found process: $($proc.ProcessName) (PID: $($proc.Id))" -ForegroundColor Red
            Write-Host "  Path: $($proc.Path)"
            Write-Host "  User: $($proc.GetOwner().User)"
            
            $DetectedThreats += $proc
            
            # REMEDIATION ACTION: Uncomment the line below to kill the process automatically
            # Stop-Process -Id $proc.Id -Force
        }
    }
}

if ($DetectedThreats.Count -eq 0) {
    Write-Host "No unauthorized RMM processes detected." -ForegroundColor Green
} else {
    Write-Host "Total suspicious processes found: $($DetectedThreats.Count)" -ForegroundColor Yellow
    Write-Host "Please review and investigate the parent processes."
}

# Check for recent installation of RMM services
Write-Host "\nChecking for recently installed RMM services..." -ForegroundColor Cyan
Get-WmiObject Win32_Service | Where-Object { 
    $UnauthorizedRMMs -contains $_.Name -or 
    $UnauthorizedRMMs -contains $_.DisplayName -or 
    $_.PathName -match "AnyDesk|ScreenConnect|Splashtop|Atera|RemotePC"
} | Select-Object Name, DisplayName, State, StartMode, PathName, InstallDate | Format-Table -AutoSize