Weekly Threat Recap: NetScaler and FortiMail Zero-Days Under Active Attack — Detection, Hardening, and Response Guide

---
title: NetScaler Appliance Suspicious Shell or File Write Activity
id: 3f7a1c52-8b4d-4e91-a2c6-9d0e5f7b2134
status: experimental
description: Detects webshell creation or unexpected shell/command execution patterns reported in NetScaler syslog, consistent with post-exploitation of ADC/Gateway zero-days.
references:
  - https://thehackernews.com/2026/10/weekly-recap-netscaler-and-fortimail-0.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/12
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial_access
  - attack.t1190
logsource:
  product: linux
  service: syslog
detection:
  selection_paths:
    Message|contains:
      - '/netscaler/portal/scripts/'
      - '/netscaler/ns_gui/'
      - '/var/vpn/'
      - '/tmp/'
  selection_exec:
    Message|contains:
      - 'sh -c'
      - '/bin/bash'
      - 'curl '
      - 'wget '
      - 'chmod +x'
      - 'python '
      - 'perl '
  filter_routine:
    Message|contains:
      - 'nsconmsg'
      - 'nsconfig'
  condition: (selection_paths and selection_exec) and not filter_routine
falsepositives:
  - Legitimate NetScaler firmware upgrade or scripted administration
level: high
---
title: FortiMail Suspicious Command Execution or Admin Plane Anomaly
id: 8c2e4d71-5a90-4f36-b7d1-2e6a9c3f8057
status: experimental
description: Detects unexpected command execution, config export, or admin-session anomalies in FortiMail logs, consistent with exploitation of FortiMail zero-days or hijacked admin access.
references:
  - https://thehackernews.com/2026/10/weekly-recap-netscaler-and-fortimail-0.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/12
tags:
  - attack.initial_access
  - attack.t1190
  - attack.collection
  - attack.t1114
logsource:
  product: linux
  service: syslog
detection:
  selection_device:
    DeviceName|contains:
      - 'fortimail'
      - 'fml'
  selection_behavior:
    Message|contains:
      - 'execute backup'
      - 'execute factoryreset'
      - 'diagnose sniffer'
      - 'config system admin'
      - 'webmail'
      - '/bin/sh'
      - 'unexpected child process'
  condition: selection_device and selection_behavior
falsepositives:
  - Scheduled configuration backups performed by administrators
level: high
---
title: Developer Workstation Secret Exfiltration to Public Code or AI Platform
id: 61b3f9a8-2d47-4e85-c1a9-7f0d3e6b4290
status: experimental
description: Detects bulk outbound transfers from developer tools or browsers to public code hosting or AI assistant endpoints, a pattern associated with AI coding assistant data leakage and accidental public repo commits.
references:
  - https://thehackernews.com/2026/10/weekly-recap-netscaler-and-fortimail-0.html
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/10/12
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  category: network_connection
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\git.exe'
      - '\gh.exe'
      - '\code.exe'
      - '\node.exe'
      - '\python.exe'
  selection_dst:
    DestinationHostname|contains:
      - 'github.com'
      - 'gitlab.com'
      - 'pastebin.com'
      - 'api.openai.com'
      - 'claude.ai'
      - 'copilot.github.com'
  filter_corp:
    DestinationHostname|contains:
      - '.corp.example.com'
  condition: selection_img and selection_dst and not filter_corp
falsepositives:
  - Normal developer workflow; tune with egress volume baselines and DLP context
level: medium

// Hunt 1: NetScaler / FortiMail post-exploitation artifacts in forwarded Syslog
let lookback = 7d;
let suspicious_paths = dynamic(["/netscaler/portal/scripts/", "/netscaler/ns_gui/", "/var/vpn/", "/tmp/." ]);
let suspicious_cmds = dynamic(["/bin/sh", "/bin/bash", "curl ", "wget ", "chmod +x", "python", "perl", "nc -", "base64 -d"]);
Syslog
| where TimeGenerated > ago(lookback)
| where HostName has_any ("netscaler", "ns", "fortimail", "fml") or Computer has_any ("netscaler", "fortimail")
| where SyslogMessage has_any (suspicious_paths) or SyslogMessage has_any (suspicious_cmds)
| project TimeGenerated, HostName, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc;

// Hunt 2: New or rare admin sessions on FortiMail / NetScaler management interfaces
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor in ("Citrix", "Fortinet")
| where DeviceProduct has_any ("NetScaler", "FortiMail")
| where Activity has_any ("login", "admin", "config") 
| summarize SessionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by SourceIP, SourceUserName, DestinationHostName, Activity
| where SessionCount < 5  // rare sources — investigate IPs with no prior baseline
| order by FirstSeen asc;

// Hunt 3: Developer endpoint egress to AI platforms and public code hosts
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ ("git.exe", "gh.exe", "code.exe", "node.exe", "python.exe", "curl.exe")
| where RemoteUrl has_any ("github.com", "gitlab.com", "pastebin.com", "api.openai.com", "claude.ai", "copilot")
| summarize Connections = count(), DistinctRemoteIPs = dcount(RemoteIP)
  by DeviceName, InitiatingProcessFileName, RemoteUrl, InitiatingProcessAccountName
| order by Connections desc;

-- Hunt for recently created script files in web directories and suspicious listeners
-- Deploy against DMZ web servers and hosts reachable from NetScaler/FortiMail segments

LET shell_paths = {
  SELECT FullPath, Mtime, Size
  FROM glob(globs=[
    "/netscaler/portal/scripts/*.php",
    "/netscaler/ns_gui/**/*.php",
    "/var/www/html/**/*.php",
    "/tmp/*.sh",
    "/tmp/.*"
  ])
  WHERE Mtime > (now() - 604800)  -- created/modified in last 7 days
};

LET listeners = {
  SELECT Pid, Name, Address, Port, Status
  FROM netstat()
  WHERE Status =~ "LISTEN"
    AND NOT Port in (22, 80, 443, 25, 587, 161, 514)
};

SELECT * FROM shell_paths
UNION ALL
SELECT FullPath=NULL, Mtime=NULL, Size=NULL, Pid, Name, Address, Port, Status
FROM listeners

-- Suspicious child processes spawned by email clients (thread-hijack reply attacks)
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'outlook|thunderbird'
   OR CommandLine =~ 'powershell|cmd.exe|wscript|cscript|mshta|rundll32'
ORDER BY CreateTime DESC

#!/bin/bash
# NetScaler / FortiMail zero-day exposure and compromise assessment
# Run from a trusted admin host. Requires SSH access to appliances.

NETSCALER_HOSTS="ns01.example.com ns02.example.com"
FORTIMAIL_HOSTS="fml01.example.com"

# --- 1. NetScaler: verify build version and patch level ---
for host in $NETSCALER_HOSTS; do
  echo "=== NetScaler: $host ==="
  ssh admin@$host "shell uname -a; shell nsver -v 2>/dev/null; show ns version"

  # Check for webshell artifacts in known drop paths
  ssh admin@$host "shell find /netscaler/portal/scripts /netscaler/ns_gui /var/vpn -name '*.php' -mtime -30 -ls 2>/dev/null"

  # Check for unexpected cron jobs and recently modified system files
  ssh admin@$host "shell crontab -l 2>/dev/null; shell ls -lat /tmp | head -20"

done

# --- 2. FortiMail: verify firmware and recent admin/config activity ---
for host in $FORTIMAIL_HOSTS; do
  echo "=== FortiMail: $host ==="
  ssh admin@$host "get system status"
  ssh admin@$host "execute log display" | grep -iE "login|config|admin" | tail -50
done

# --- 3. Local host: verify Spectre v2 mitigation status (Linux) ---
echo "=== Spectre v2 mitigation status ==="
if [ -d /sys/devices/system/cpu/vulnerabilities ]; then
  for f in /sys/devices/system/cpu/vulnerabilities/*; do
    echo "$(basename $f): $(cat $f)"
  done
else
  echo "Vulnerability sysfs not present (VM or non-Linux host)"
fi

# --- 4. Scan local git repos for accidentally committed secrets ---
echo "=== Scanning for secrets in public-facing repos ==="
which gitleaks >/dev/null 2>&1 && gitleaks detect --source /srv/repos --report-path /tmp/gitleaks-report.json \
  || echo "Install gitleaks/trufflehog and scan all repos before pushing to public remotes"

echo "=== Assessment complete. Review findings before patching; preserve forensic images of any suspect appliance. ==="