CVE-2026-88771 & CVE-2026-88772: NetScaler Attacks Against Government and Finance — Detection and Remediation Guide

---
title: NetScaler Edge Exploit Pattern - Suspicious URI Commands or Traversal
id: 8d6c2f3e-4b71-4a0c-9f55-0a7b6c5d4e3f
status: experimental
description: Detects exploit-like command injection, traversal, or shell artifact strings in requests to NetScaler Gateway/ADC virtual servers. Use on proxy/WAF/CEF/Syslog logs that contain RequestURL or Message fields for Citrix NetScaler traffic.
references:
  - https://attack.mitre.org/techniques/T1190/
  - https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/
author: Security Arsenal
date: 2026/04/25
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_vendor:
    DeviceVendor|contains:
      - 'Citrix'
      - 'NetScaler'
  selection_uri:
    cs-uri|contains:
      - '/bin/'
      - 'whoami'
      - 'id;'
      - 'cat /etc'
      - '/etc/passwd'
      - '/flash/'
      - '/netscaler/'
      - 'ns.conf'
      - '../../'
      - '..%2f'
      - '%2e%2e'
      - 'cmd.exe'
      - 'powershell'
      - 'curl '
      - 'wget '
  condition: selection_vendor and selection_uri
falsepositives:
  - Scanner and vulnerability assessment traffic; still investigate source and outcome.
  - Poorly coded health checks sending encoded paths.
level: high
---
title: NetScaler Management Plane Exposed or Changed From Untrusted Source
id: 6a9e0b41-7c2d-4c8a-93d2-1f0e9a8b7c65
status: experimental
description: Detects logons, configuration saves, or admin changes to NetScaler management interfaces from non-management networks. Map fields for source IP, destination service, user, and message in Syslog/CEF/CommonSecurityLog.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/04/25
tags:
  - attack.persistence
  - attack.t1078
  - attack.t1098
logsource:
  category: network_connection
detection:
  selection_dest:
    DestinationPort:
      - 80
      - 443
      - 22
      - 3010
      - 3008
      - 3009
  selection_msg:
    Message|contains:
      - 'login'
      - 'logout'
      - 'add system user'
      - 'bind system global'
      - 'save ns config'
      - 'set aaa'
      - 'add vpn vserver'
      - 'set system user'
      - 'sshkey'
      - 'certificate'
      - 'ldap'
      - 'saml'
  filter_known_mgmt:
    SourceIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_dest and selection_msg and not filter_known_mgmt
falsepositives:
  - RFC1918 ranges may include attacker-controlled internal segments after compromise; replace with exact approved management subnets.
  - Automation platforms and config backup jobs.
level: high
---
title: Downstream Credential or Session Abuse After NetScaler Alert
id: 2f7a9d60-5c44-4e19-8a21-9b0c1d2e3f40
status: experimental
description: Detects Windows credential access or remote execution shortly after NetScaler edge exploitation signals. Use when ADC/Gateway source IPs or newly observed admin accounts appear in internal authentication telemetry.
references:
  - https://attack.mitre.org/techniques/T1003/
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/04/25
tags:
  - attack.credential_access
  - attack.t1003
  - attack.lateral_movement
  - attack.t1021
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\procdump.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\psexec.exe'
      - '\psexesvc.exe'
  selection_cli:
    CommandLine|contains:
      - 'lsass'
      - 'sekurlsa'
      - 'comsvcs.dll'
      - 'MiniDump'
      - 'ntdsutil'
      - 'vssadmin delete shadows'
      - 'winrm'
      - 'wmi '
      - '/node:'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate admin tools from approved management hosts.
  - EDR/backup products that use VSS or memory capture for defense.
level: high

let Lookback = 14d;
let NetScalerTerms = dynamic(["Citrix","NetScaler","Citrix ADC","Citrix Gateway","nshttp","aaa","vpn vserver"]);
let ExploitPatterns = dynamic(["/bin/","whoami","cat /etc","/etc/passwd","../../","..%2f","%2e%2e","ns.conf","/netscaler/","powershell","cmd.exe","curl ","wget "]);
union isfuzzy=true
(CommonSecurityLog
| where TimeGenerated >= ago(Lookback)
| where DeviceVendor has_any (NetScalerTerms) or DeviceProduct has_any (NetScalerTerms) or Message has_any (NetScalerTerms)
| extend Url = coalesce(RequestURL, extract(@"(?i)(GET|POST|PUT|DELETE)\s+([^\s]+)", 2, Message), Message)
| extend Matched = tostring(set_union(dynamic([]), ExploitPatterns))
| where Url has_any (ExploitPatterns) or Message has_any ("save ns config","add system user","set system user","add vpn vserver","bind system global","saml","ldap","sshkey","certificate")
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceVendor, DeviceProduct, Activity, ApplicationProtocol, RequestMethod, Url, Message, DeviceAction
),
(Syslog
| where TimeGenerated >= ago(Lookback)
| where HostName has_any (NetScalerTerms) or ProcessName has_any (NetScalerTerms) or SyslogMessage has_any (NetScalerTerms)
| where SyslogMessage has_any (ExploitPatterns) or SyslogMessage has_any ("save ns config","add system user","set system user","add vpn vserver","bind system global","login failed","login succeeded","saml","ldap","sshkey","certificate")
| project TimeGenerated, Computer, HostName, HostIP, Facility, SeverityLevel, ProcessName, SyslogMessage
)
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by tostring(coalesce(SourceIP, HostIP)), tostring(coalesce(DestinationIP, Computer)), bin(TimeGenerated, 1h)
| order by LastSeen desc;

// Correlate edge hits with downstream identity/process execution in Defender XDR.
let SuspiciousEdge =
CommonSecurityLog
| where TimeGenerated >= ago(Lookback)
| where DeviceVendor has_any (NetScalerTerms) or DeviceProduct has_any (NetScalerTerms) or Message has_any (NetScalerTerms)
| where Message has_any (ExploitPatterns) or RequestURL has_any (ExploitPatterns)
| summarize by SourceIP, bin(TimeGenerated, 5m);
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where ProcessCommandLine has_any ("lsass","comsvcs.dll","MiniDump","sekurlsa","ntdsutil","vssadmin delete shadows","psexec","winrm","/node:")
| join kind=inner (SuspiciousEdge) on $left.TimeGenerated >= $right.TimeGenerated and $left.TimeGenerated <= datetime_add("minute", 10, $right.TimeGenerated)
| project DeviceName, AccountName, ProcessCommandLine, FileName, FolderPath, InitiatingProcessCommandLine, TimeGenerated, SourceIP
| order by TimeGenerated desc;

-- Hunt managed endpoints for credential dumping, remote execution, and tooling seen after edge-device compromise.
-- Run across DMZ servers, jump hosts, finance/app servers, and systems reachable from NetScaler service IPs.
LET suspicious_proc <= SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(lsass|comsvcs\.dll|minidump|sekurlsa|ntdsutil|vssadmin delete shadows|psexec|winrm|/node:|mimikatz|procdump)'
   OR Exe =~ '(?i)(psexec|procdump|rundll32|regsvr32|wmic|powershell)'

LET suspicious_conns <= SELECT Pid, Name, RemoteAddr, RemotePort, LocalAddr, LocalPort, Status
FROM netstat()
WHERE RemotePort in (22, 80, 135, 139, 443, 445, 3389, 5985, 5986, 3010, 3008, 3009)
  AND Status =~ 'ESTABLISHED'

LET suspect_files <= SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs=['C:/Windows/Temp/**', 'C:/ProgramData/**', '/tmp/**', '/var/tmp/**', '/flash/**', '/netscaler/**'])
WHERE FullPath =~ '(?i)(\.jsp|\.war|\.php|\.aspx|\.sh|\.py|ns\.conf|id_rsa|authorized_keys|\.bak|dump|lsass|sam|system|security)'

SELECT 'process' AS ArtifactType, Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime, NULL AS RemoteAddr, NULL AS RemotePort, NULL AS FullPath, NULL AS Mtime FROM suspicious_proc
UNION ALL
SELECT 'netstat' AS ArtifactType, Pid, NULL, Name, NULL, NULL, NULL, NULL, RemoteAddr, RemotePort, NULL, NULL FROM suspicious_conns
UNION ALL
SELECT 'file' AS ArtifactType, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, FullPath, Mtime FROM suspect_files

#!/usr/bin/env bash
# NetScaler ADC/Gateway emergency evidence and exposure check.
# Run from an approved admin workstation with SSH access to NSIP. Prefer read-only commands first; do not clean before imaging.
set -euo pipefail
NSIP="${1:-}"; NSUSER="${2:-nsroot}"
if [[ -z "$NSIP" ]]; then echo "Usage: $0 <NSIP> [user]"; exit 2; fi
OUT="netscaler_ir_${NSIP}_$(date -u +%Y%m%dT%H%M%SZ)"; mkdir -p "$OUT"
ssh -o StrictHostKeyChecking=accept-new "${NSUSER}@${NSIP}" 'shell date -u; show ns version; show ns license; show ns runningConfig; show ns config; show system user; show system sshkey; show ns connectiontable; show audit messages; show techsupport -scope brief' > "$OUT/nscli_show.txt" 2>&1 || true
ssh "${NSUSER}@${NSIP}" 'shell uname -a; shell uptime; shell ps auxww; shell sockstat -46l; shell find /var /tmp /flash /netscaler -type f -mtime -21 -ls 2>/dev/null; shell ls -la /var/log /var/tmp /tmp /nsconfig /netscaler 2>/dev/null; shell grep -R "add system user\|save ns config\|bind system global\|saml\|ldap\|sshkey\|certificate" /var/log /nsconfig 2>/dev/null | tail -1000' > "$OUT/shell_collect.txt" 2>&1 || true
echo "Collected $OUT. Next: snapshot VM/hardware state, copy ns.conf/backups securely, confirm fixed build against Citrix advisory for CVE-2026-88771/CVE-2026-88772, then patch, rotate all reachable secrets, and invalidate sessions."