Inferlume

title: Citrix NetScaler CVE-2026-88771/88772 Exploitation — pitboss Command Artifact
id: cti-2026-09-28-netscaler-pitboss-http
status: experimental
description: >
  Detects post-exploitation command artifacts observed in NetScaler HTTP logs
  following zero-day exploitation of CVE-2026-88771 / CVE-2026-88772.
  Based on published forensic indicators (pitboss + IFS / b64decode).
  Treat as a hunting rule pending vendor IOC publication.
references:
  - hxxps://support.citrix[.]com/external/article/CTX697096
logsource:
  category: webserver
  product: citrix_netscaler
  service: http
detection:
  selection_pitboss:
    - '|raw|contains': 'pitboss'
  selection_sub:
    '|raw|contains':
      - 'IFS'
      - 'b64decode'
  condition: selection_pitboss and 1 of selection_sub*
falsepositives:
  - Legitimate admin scripts referencing IFS or b64decode (rare on appliance HTTP logs)
level: critical

title: NetScaler HTTP Log — Base64 Payload Appended After User-Agent Field
id: cti-2026-09-28-netscaler-ua-b64
status: experimental
description: >
  Detects 60+ character base64 payloads appended directly after the User-Agent
  header with no separating space in Citrix NetScaler HTTP logs.
logsource:
  category: webserver
  product: citrix_netscaler
detection:
  selection:
    '|raw|re': 'User-Agent[^\r\n]*[A-Za-z0-9+/]{60,}={0,2}'
  condition: selection
falsepositives:
  - Unusually long legitimate User-Agent tokens (tune length threshold to environment)
level: high

title: Citrix NetScaler Appliance Process Spawning Shell or Interpreter
id: 9c4d6b21-7a38-4e2d-9f10-2b7c8d91a456
status: experimental
description: >
  Detects high-risk child processes spawned by NetScaler web, AAA, VPN, or
  packet-processing components consistent with post-exploitation after RCE.
logsource:
  category: process_creation
  product: freebsd_linux
detection:
  selection:
    parent_image|endswith:
      - '/nsd'
      - '/ns'
      - '/aaa'
      - '/vpn'
    image|endswith:
      - '/sh'
      - '/bash'
      - '/powershell'
      - '/cmd.exe'
  condition: selection
falsepositives:
  - Authorized maintenance or support scripts on appliances
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004

title: Suspicious NetScaler Configuration Change or Command Execution
id: cti-2026-09-28-netscaler-audit-config
status: experimental
logsource:
  product: citrix_netscaler
  category: audit
detection:
  selection_config:
    event_type:
      - configuration_change
      - command_execution
    command|contains:
      - 'add vpn vserver'
      - 'add lb vserver'
      - 'add cs vserver'
      - 'set vpn vserver'
      - 'set ns'
      - 'shell'
      - '/bin/sh'
      - 'wget'
      - 'curl'
      - 'nc -e'
  selection_risk:
    source_ip|not_in:
      - approved_admin_networks
      - approved_management_jump_hosts
  condition: selection_config and selection_risk
falsepositives:
  - Authorized emergency remediation from non-standard jump hosts
level: high

title: Oracle PeopleSoft PSEMHUB Web Shell and WAF Bypass Activity
id: cti-2026-09-28-peoplesoft-webshell
status: experimental
description: Detects UNC6240 (ShinyHunters) percent-encoded WAF bypass and web shell access in PeopleSoft WebLogic logs.
logsource:
  product: oracle_weblogic
  service: access
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/%50SEMHUB/'
      - '/PSEMHUB/x.jsp'
      - '/PSEMHUB/u.jsp'
      - '/PSEMHUB/tunnel.jsp'
      - '/PSEMHUB/tunnel.jspx'
  selection_method:
    cs-method: 'POST'
  selection_params:
    cs-uri-query|contains:
      - 'c='
      - 'a='
      - 'n='
      - 'x='
  condition: (selection_uri and selection_method) or (selection_uri and selection_params)
falsepositives:
  - Legitimate internal EMHub administration (should never originate from external IPs)
level: critical

title: Suspicious SharePoint XamlServices Deserialization via ToolPane
id: cti-2026-09-28-sharepoint-cve-2026-65660
status: experimental
logsource:
  category: webserver
  service: iis
detection:
  selection:
    cs-uri-stem|contains: '_layouts/15/toolpane.aspx'
    cs-uri-query|contains|all:
      - 'Register'
      - 'XamlServices'
  condition: selection
falsepositives:
  - Legitimate SharePoint administrative operations using custom web parts
level: high

title: Azure Service Principal Mass Storage Account Deletion Burst (Storm-3168)
id: cti-2026-09-28-azure-sp-mass-delete
status: experimental
description: >
  Detects a workload identity (service principal) attempting high-volume
  storage account deletions and ListKeys operations in a short window,
  consistent with Storm-3168 (JADEPUFFER) cloud destruction activity.
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    identity.type: 'ServicePrincipal'
    operationName.value:
      - 'Microsoft.Storage/storageAccounts/delete'
      - 'Microsoft.Storage/storageAccounts/listKeys/action'
      - 'Microsoft.KeyVault/vaults/delete'
      - 'Microsoft.Web/sites/delete'
  condition: selection | count() by identity.claims.appid > 20 within 10m
falsepositives:
  - Authorized Terraform or Bicep teardown pipelines in non-production subscriptions
level: critical

rule NETSCALER_WEBSHELL_PITBOSS_HEURISTIC
{
    meta:
        author = "Combined CTI Pipeline"
        ref = "CVE-2026-88771 / CVE-2026-88772 post-exploitation webshell hunt"
        note = "Webshells are reported unique per appliance; use for on-disk /netscaler/ and /flash/nsconfig/ sweeps alongside mtime > 2026-09-01."
    strings:
        $p = "pitboss" ascii
        $b = "b64decode" ascii
        $i = "IFS=" ascii
        $php_shell = "<?php system($_GET[" ascii
        $jsp_shell = "Runtime.getRuntime().exec" ascii
        $path1 = "/netscaler/" ascii
        $path2 = "/flash/nsconfig/" ascii
        $path3 = "/var/tmp/" ascii
    condition:
        filesize < 300KB and (2 of ($p, $b, $i) or (($php_shell or $jsp_shell) and 1 of ($path*)))
}

rule WSO2_Forged_Admin_JWT_CVE_2026_5430
{
    meta:
        description = "Detects forged JWT tokens with admin subject targeting WSO2 API Manager (CVE-2026-5430)"
        date = "2026-09-28"
    strings:
        $jwt_header = /eyJhbGciOiJ[A-Za-z0-9_-]+/
        $admin_claim = /"sub":"YWRtaW4"/
        $scope_claim = /"scope":".*api.*"/
    condition:
        $jwt_header and $admin_claim and $scope_claim
}

/* Splunk SPL: Citrix NetScaler HTTP Log Hunt for pitboss and User-Agent Base64 Anomalies */
index=netscaler (sourcetype="citrix:adc:http*" OR sourcetype="citrix:netscaler:access" OR sourcetype="citrix:netscaler:error")
| regex _raw="(?i)(pitboss.*(IFS|b64decode)|User-Agent[^\"]{0,40}[A-Za-z0-9+/]{60,}={0,2})"
| rex field=_raw "User-Agent[^\"]{0,40}(?P<b64_payload>[A-Za-z0-9+/]{60,}={0,2})"
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(uri) as uris values(b64_payload) as payloads by client_ip, host, user_agent

/* Splunk SPL: Roundcube CVE-2026-48842 virtuser_query SQL Injection Hunt */
index=webmail sourcetype=roundcube
| regex _raw="(?i)(union.{0,20}select|sleep\(|benchmark\()"
| regex _raw="virtuser|_query"
| stats count by src_ip, uri, status

// Azure Log Analytics KQL: Storm-3168 Destructive Operations and IOC Correlation
AzureActivity
| where TimeGenerated > ago(30d)
| where CallerIpAddress in ("45.131.66.106", "34.153.223.102", "64.20.53.230")
   or OperationNameValue in (
       "Microsoft.Storage/storageAccounts/delete",
       "Microsoft.Storage/storageAccounts/listKeys/action",
       "Microsoft.KeyVault/vaults/delete",
       "Microsoft.Web/sites/delete",
       "Microsoft.Sql/servers/databases/delete",
       "Microsoft.RecoveryServices/vaults/backupProtectionContainers/protectableItems/delete"
   )
| summarize
    ReadOps = countif(OperationNameValue has "read"),
    DeleteOps = countif(OperationNameValue has "delete"),
    KeyOps = countif(OperationNameValue has "listKeys"),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by Caller, CallerIpAddress, SubscriptionId
| where CallerIpAddress in ("45.131.66.106", "34.153.223.102", "64.20.53.230") or DeleteOps > 5 or KeyOps > 10

/* MikroTik RouterOS CVE-2026-67279 + CVE-2026-86060 ("MikroTrick") SIEM Field Logic */
event_source = "mikrotik_log"
AND event_type = "ssh"
AND auth_result = "success"
AND (username = "" OR username = "admin")
AND session_channel = "exec"
AND source_ip NOT IN (trusted_management_subnet)