How to detect Citrix NetScaler compromise

CERT-EU hunting patterns Passive

• base64 strings in the User-Agent header that start with INDEX:.
• PPE missed too many heartbeats entries in authentication logs.
• Check that httpd.conf is intact, for example by looking for the AliasMatch in the IoC table.

Source: CERT-EU writeup

CIRCL TR-100 Config check

For each CVE, CIRCL gives CLI commands that check whether your appliance's configuration exposes it. Run them on appliances you administer.

Source: CIRCL TR-100

Citrix Console IoC checker Limits per Beaumont Validated

• Available only through support or under NDA. ^[45]
• Incomplete: it does not check for suid on /bin/sh. ^[48]
• Citrix's own documentation says the IoC information "might be of limited forensic value and might fail to identify actual compromises", and advises retaining experienced forensic investigators. ^[4]
• In the field, the Console scanner has flagged base64 content referencing the .ctxs.receiver webshell, "Certificate digest verification failed" (possibly tampered certificate or key files) and "Binary Fingerprinting detected", according to one practitioner's notes. ^[72]
• Misses earlier semi-successful attempts once logs have rotated. ^[46]

The missing suid check and the log-rotation gap were validated independently on 29 September. The NDA point has not been verified.

Beaumont also says Some really big orgs are backdoored after patching still. That claim is not independently verified. He has asked national CSIRTs (NCSCs) to publish a detection script. ^[48]

GTIG/Mandiant artefacts and YARA Passive

Successful CVE-2026-88772 exploitation left two log artefacts:

• In syslog, an SSL_HANDSHAKE_FAILURE with ClientVersion DTLSv1.0 and Reason "Handshake failure-Internal Error".
• In /var/log/messages, an NSPPE termination logged by pitboss, the watchdog daemon that restarts crashed processes.

Also look for httpd.conf changes that make the web server treat other file types as PHP, such as AddHandler application/x-httpd-php .deb.

GTIG publishes five YARA rules: G_APT_Backdoorwebshell_WHIPSHOT_1, G_APT_Tunneler_SLAPSHOT_1, G_Hunting_Backdoorwebshell_NetScaler_C2Headers_1, G_Hunting_Config_NetScaler_PHP_1 and G_Hunting_Script_NetScaler_Persistence_1. This page links to them rather than copying them.

Source: GTIG/Mandiant advisory

Nextron THOR Scanner rules

As of 29 September, Nextron has three rules in the THOR Preview channel:

• LOG_SUSP_EXPL_CVE_2026_88771_Sep26
• WEBSHELL_CSS_PassThrough_Sep26, which detects the webshell's behaviour, not only its filename
• EXPL_CVE_2026_88772_POC_Sep26, which detects PoC artefacts, not attacks on an appliance

Nextron also published a YAML filesystem IoC set derived from Citrix's scanner script. It covers 12 of the script's checks, consolidated into four file rules. It leaves out the 22 checks that depend on logs, configuration or runtime state.

Preview-channel rules have not finished manual QA, so expect more false positives than with stable rules. A match is a lead for investigation, not proof of compromise.

Source: Nextron Systems

Community detection rules Rules

• Elastic: "Potential NetScaler Log Poisoning Command Injection Attempt", an EQL rule on Citrix ADC logs. Merged on 28 September.
• Sigma pull request #6352: shell metacharacters sent to the NetScaler authentication endpoint. Not yet merged.
• Corelight: Zeek hunting queries, including a search for the reverse-shell IP in the IoC table.
• Nuclei pull request #17336: an active injection probe, not a version check. It writes to the target's logs, so run it only on systems you own or administer. Not yet merged.
• Lupovis suggests two hunts: POST /nf/auth/doAuthentication.do requests whose body contains pitboss PPE unexpectedly died NSPPE, and DNS lookups from a NetScaler ending in instances.httpworkbench.com. ^[65]

Beazley Security Labs checks Passive

Beazley's BSL-A1216 advisory lists read-only shell checks. It splits them into those to run before patching (the web-server config, /bin/sh permissions and NX-CVE-OK test markers, which a reboot rebuilds) and those that persist across upgrades (hidden files under /var/netscaler/logon). It also recommends comparing /etc/httpd.conf with a clean appliance on the same build.

Source: Beazley Security Labs BSL-A1216