-
Potential NetScaler Log Poisoning Command Injection Attempt
Sep 28, 2026 · Domain: Network Platform: Citrix Use Case: Network Security Monitoring Use Case: Threat Detection Use Case: Vulnerability Tactic: Initial Access Tactic: Execution Data Source: Citrix ADC Resources: Investigation Guide Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Vuln: CVE-2026-88771 ·Detects shell syntax in NetScaler Pitboss records or in Citrix records that combine Pitboss, packet-engine, or core terminology with shell syntax. This may indicate that attacker-controlled data poisoned an appliance log consumed by a privileged script. The behavior includes CVE-2026-88771, but the detection is intended to identify similar NetScaler log-poisoning command-injection attempts without requiring a specific vulnerability, failure phrase, or command.
Read More