Potential NetScaler Log Poisoning Command Injection Attempt

  1[metadata]
  2creation_date = "2026/09/28"
  3integration = ["citrix_adc"]
  4maturity = "production"
  5updated_date = "2026/09/28"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects shell syntax in NetScaler Pitboss records or in Citrix records that combine Pitboss, packet-engine, or core
 11terminology with shell syntax. This may indicate that attacker-controlled data poisoned an appliance log consumed by a
 12privileged script. The behavior includes CVE-2026-88771, but the detection is intended to identify similar NetScaler
 13log-poisoning command-injection attempts without requiring a specific vulnerability, failure phrase, or command.
 14"""
 15false_positives = [
 16    """
 17    Authorized security testing may deliberately write a harmless forged Pitboss or PPE record to validate exposure or
 18    detection. Confirm the source and testing window. Normal Pitboss and packet-engine records should not contain shell
 19    separators, command substitution, pipes, or redirection.
 20    """,
 21]
 22from = "now-9m"
 23index = ["logs-citrix_adc.log-*"]
 24language = "eql"
 25license = "Elastic License v2"
 26name = "Potential NetScaler Log Poisoning Command Injection Attempt"
 27note = """## Triage and analysis
 28
 29### Investigating Potential NetScaler Log Poisoning Command Injection Attempt
 30
 31NetScaler emits Pitboss records for packet-engine process monitoring and recovery. Shell separators, command
 32substitution, pipes, or redirection are not expected in these records. Their presence can indicate that
 33attacker-controlled request or authentication data was written into an appliance log in a form that may later be
 34interpreted by a privileged log-processing, diagnostic, or core-handling script.
 35
 36CVE-2026-88771 is one example of this behavior. Its public exploit family forges a Pitboss/PPE failure record containing
 37an `NSPPE` token and shell syntax that can later be processed by the root-running `ns_monuploadd_err.pl` script. This
 38rule does not require that CVE's failure phrase, endpoint, parameter, filename, token ordering, or injected command.
 39
 40> **CVE-2026-88771 indicator note**:
 41> During triage, specifically look for `pitboss PPE` followed by `unexpectedly died` or
 42> `missed too many heartbeats`, a malformed `NSPPE` value, and shell syntax. Also review requests to
 43> `/nf/auth/doAuthentication.do`, attacker-controlled `login` values, execution by `ns_monuploadd_err.pl`, and
 44> suspicious `/var/core/NSPPE-*` artifacts. No single endpoint, path, or filename is sufficient to confirm exploitation.
 45
 46### Possible investigation steps
 47
 48- Preserve the complete `event.original`, remote syslog records, rotated logs, NetScaler Console results, support
 49  bundles, packet-engine cores, snapshots, and relevant flow data before patching or rebooting.
 50- Identify the source address and the targeted NetScaler or virtual server. In native `CONN_DELINK` records,
 51  `destination.ip` can represent a backend service rather than the public virtual-server address; review the raw
 52  `Vserver`, `NatIP`, and `Destination` values when present.
 53- Review adjacent AAA/AAAD, authentication, login, and WAF records for the submitted username or login value, selected
 54  request headers, action, response, and request or session identifiers. The `/nf/auth/doAuthentication.do` path is
 55  useful context but is not proof of exploitation without the forged PPE structure.
 56- Determine whether the value contains a shell separator (`;`, `&&`, `||`), command substitution (backticks or `$()`),
 57  a pipe, or redirection, and repeatedly URL-decode percent-encoded values while preserving the original bytes.
 58- Search remote and rotated NetScaler logs for the same value and source for at least 48 hours. A match can represent
 59  an attempt even if `ns_monuploadd_err.pl` has not processed the poisoned record yet.
 60- From the first poisoned-log timestamp, hunt forward at least 24–48 hours for root shell activity, unexpected
 61  commands, file creation, configuration or startup changes, new listeners, packet-engine failure, restart, or HA
 62  failover.
 63- Review DNS, proxy, firewall, NetFlow/IPFIX, and Zeek telemetry for first-seen internet egress, payload retrieval,
 64  long-lived outbound connections, or new internal SSH, SMB, RDP, WinRM, database, or management traffic from every
 65  appliance identity, including NSIPs, SNIPs, HA peers, and translated egress addresses.
 66- If the record resembles CVE-2026-88771, verify the exact NetScaler branch and build. Fixed versions include
 67  14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1-37.279 FIPS/NDcPP or later, subject to current Citrix upgrade
 68  guidance.
 69
 70### False positive analysis
 71
 72- Confirm whether an authorized scanner, penetration test, synthetic log fixture, or incident-response exercise
 73  generated the record.
 74- Broad internet scanners and vulnerability probes can submit POST requests to `/nf/auth/doAuthentication.do` without
 75  carrying the CVE-2026-88771 payload. Do not classify the endpoint path, request method, or source reputation alone as
 76  exploitation.
 77- A legitimate packet-engine crash or Pitboss recovery event can contain `PPE`, `NSPPE`, core-file terminology, and a
 78  failure phrase, but should not contain the shell syntax required by this rule. Do not suppress genuine crashes
 79  broadly.
 80- If a benign test is confirmed, scope any exception to the controlled source and maintenance window rather than
 81  excluding a failure phrase or shell token globally.
 82
 83### Response and remediation
 84
 85- Treat a match on an unpatched appliance as a potential root-compromise precursor. Preserve evidence, then isolate or
 86  tightly restrict the appliance while maintaining an evidence-preserving management path.
 87- Upgrade to a fixed build using current Citrix guidance. Patching prevents future exploitation but does not establish
 88  that the appliance was not already compromised.
 89- Run current NetScaler Console IOC and file-integrity checks. A clean scan does not prove absence of compromise.
 90- If command execution is confirmed, rebuild from a trusted image and rotate administrative credentials, secrets,
 91  certificates, tokens, and backend trust material stored on or transiting the appliance.
 92- Restrict appliance egress and management access, and retain remote logs so a compromised appliance cannot erase the
 93  only copy of the evidence.
 94"""
 95references = [
 96    "https://support.citrix.com/external/article/CTX697096",
 97    "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/",
 98    "https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway",
 99    "https://www.elastic.co/docs/reference/integrations/citrix_adc",
100]
101risk_score = 47
102rule_id = "afaece21-6631-440b-87d3-1d0a2013576e"
103setup = """## Setup
104
105This rule requires the Elastic Citrix ADC integration with the `citrix_adc.log` data stream enabled. Configure NetScaler
106to forward native syslog records to an Elastic Agent by TCP or UDP, or collect the corresponding log files. RFC 5424
107syslog is recommended where supported. Include system/PPE and AAA/AAAD or authentication-related records so analysts
108can recover the poisoned failure text and surrounding request context.
109
110The integration stores the parsed inner Citrix record in `citrix.detail` and unmatched Pitboss message content in
111`citrix_adc.log.message`; the rule checks both because poisoned text can appear inside another Citrix event or as a
112Pitboss-class record. Enable **Preserve original event** for investigation, forward logs to a remote collector, and
113retain rotated records for at least 48 hours because local evidence can be altered after root compromise and
114some log consumers process records asynchronously. CVE-2026-88771 command execution can be delayed by up to 24 hours.
115
116This rule analyzes appliance logs rather than encrypted request payloads. It can detect the poisoned record without TLS
117decryption after the attacker-controlled value is logged, but it cannot prove that the vulnerable script executed the
118injected command.
119"""
120severity = "medium"
121tags = [
122    "Domain: Network",
123    "Platform: Citrix",
124    "Use Case: Network Security Monitoring",
125    "Use Case: Threat Detection",
126    "Use Case: Vulnerability",
127    "Tactic: Initial Access",
128    "Tactic: Execution",
129    "Data Source: Citrix ADC",
130    "Resources: Investigation Guide",
131    "Threat: Vulnerability Exploit",
132    "Rule Type: Event Correlation (EQL)",
133    "Vuln: CVE-2026-88771",
134]
135timestamp_override = "event.ingested"
136type = "eql"
137
138query = '''
139any where
140  data_stream.dataset == "citrix_adc.log" and
141  (
142    (
143      citrix.detail regex~ """.*pitboss.*(nsppe|ppe|packet.*engine|core).*""" and
144      citrix.detail like~ (
145        "*;*", "*`*", "*$(*", "*&&*", "*||*",
146        "*%3b*", "*%60*", "*%7c*", "*%24%28*", "*%26%26*", "*%3e*", "*%3c*"
147      )
148    ) or
149    (
150      citrix.device_event_class_id == "PITBOSS" and
151      citrix_adc.log.message like~ (
152        "*;*", "*`*", "*$(*", "*|*", "*>*", "*<*", "*&&*", "*||*",
153        "*%3b*", "*%60*", "*%7c*", "*%24%28*", "*%26%26*", "*%3e*", "*%3c*"
154      )
155    )
156  )
157'''
158
159
160[[rule.threat]]
161framework = "MITRE ATT&CK"
162[[rule.threat.technique]]
163id = "T1190"
164name = "Exploit Public-Facing Application"
165reference = "https://attack.mitre.org/techniques/T1190/"
166
167
168[rule.threat.tactic]
169id = "TA0001"
170name = "Initial Access"
171reference = "https://attack.mitre.org/tactics/TA0001/"
172[[rule.threat]]
173framework = "MITRE ATT&CK"
174[[rule.threat.technique]]
175id = "T1059"
176name = "Command and Scripting Interpreter"
177reference = "https://attack.mitre.org/techniques/T1059/"
178[[rule.threat.technique.subtechnique]]
179id = "T1059.004"
180name = "Unix Shell"
181reference = "https://attack.mitre.org/techniques/T1059/004/"
182
183
184
185[rule.threat.tactic]
186id = "TA0002"
187name = "Execution"
188reference = "https://attack.mitre.org/tactics/TA0002/"