Inferlume

title: Citrix NetScaler Webshell via CSS Extension Hijack
id: cti-2026-09-30-001-netscaler-webshell
status: experimental
description: Detects HTTP requests to CSS files that trigger PHP execution on NetScaler, indicating webshell activity per CVE-2026-88771/88772 exploitation.
author: CTI Research
date: 2026/09/30
references:
  - hxxps://support[.]citrix[.]com/external/article/CTX697096
  - hxxps://www[.]bleepingcomputer[.]com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/
logsource:
  category: webserver
  service: netscaler
detection:
  selection:
    c-uri|contains:
      - '/LogonPoint/custom/.ctxs.receiver'
      - 'receiver.min.css'
    c-status: 200
    sc-bytes|gt: 1000
  condition: selection
falsepositives:
  - Legitimate custom CSS files (verify file size and content type)
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
---
title: Citrix NetScaler DTLS Exploit Correlation
status: experimental
logsource:
    product: citrix_netscaler
    service: syslog
detection:
    selection_dtls_failure:
        Field: message
        Contains: 'SSL_HANDSHAKE_FAILURE'
    selection_dtls_version:
        Field: message
        Contains: 'ClientVersion DTLSv1.0'
    selection_internal_error:
        Field: message
        Contains: 'Handshake failure-Internal Error'
    selection_nsppe_crash:
        Field: message
        Contains: 'pitboss'
        Contains: 'NOT restarting NSPPE'
    timeframe: 5m
condition: (selection_dtls_failure and selection_dtls_version and selection_internal_error) | near(selection_nsppe_crash, timeframe)
---
title: NetScaler httpd.conf Tampering PHP Handler Registration
status: experimental
logsource:
    product: linux
    service: file_integrity
detection:
    selection_addhandler:
        Field: file_path
        Value: '/etc/httpd.conf'
        Condition: modified
    selection_php_handler:
        Field: file_content_delta
        Contains: 'AddHandler application/x-httpd-php'
    selection_alias:
        Field: file_content_delta
        Contains: 'AliasMatch'
    selection_php_flag:
        Field: file_content_delta
        Contains: 'php_flag engine on'
condition: selection_addhandler and (selection_php_handler or selection_alias or selection_php_flag)
---
title: SUID Set on /bin/sh on NetScaler
status: experimental
logsource:
    product: linux
    service: audit
detection:
    selection_chmod_suid:
        Field: command_line
        Contains: 'chmod u+s /bin/sh'
    selection_path:
        Field: file_path
        Value: '/bin/sh'
    selection_mode_change:
        Field: file_mode_after
        Contains: 'rws'
condition: selection_chmod_suid or (selection_path and selection_mode_change)
---
title: Apple CoreGraphics Out-of-Bounds Write Exploitation Attempt
id: cti-2026-09-30-002-coregraphics-oob
status: experimental
description: Detects potential exploitation of CVE-2026-86950 via anomalous CoreGraphics behavior and file processing patterns.
author: CTI Research
date: 2026/09/30
references:
  - hxxps://support[.]apple[.]com/en-us/121678
  - hxxps://www[.]bleepingcomputer[.]com/news/security/apple-patches-coregraphics-zero-day-flaw-exploited-in-attacks/
logsource:
  category: endpoint
  product: ios
  service: coregraphics
detection:
  selection:
    ImageName|contains: 'MobileSafari'
    EventID: 'CoreGraphics_Crash'
    ExceptionCode: 'EXC_BAD_ACCESS'
  filter_main_crash:
    ImageName|contains:
      - 'Photos'
      - 'Mail'
      - 'Messages'
  condition: selection and filter_main_crash
falsepositives:
  - Legitimate malformed image files causing crashes
  - App bugs unrelated to exploitation
level: high
tags:
  - attack.initial_access
  - attack.t1203
  - attack.client_exploitation
---
title: WSO2 API Manager Path Traversal Exploitation Attempt
id: cti-2026-09-30-003-wso2-path-traversal
status: experimental
description: Detects HTTP requests with path traversal patterns targeting WSO2 API Manager upload endpoints (CVE-2026-5430).
author: CTI Research
date: 2026/09/30
references:
  - hxxps://security[.]docs[.]wso2[.]com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/
  - hxxps://thehackernews[.]com/2026/09/wso2-and-adobe-commerce-flaws-exploited.html
logsource:
  category: webserver
  service: wso2
detection:
  selection:
    c-uri|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e/'
    c-method: 'POST'
    c-uri|contains|all:
      - 'upload'
      - 'api'
  condition: selection
falsepositives:
  - Legitimate file uploads with encoded paths (verify content type and file extension)
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
---
title: Cisco ISE Authentication Bypass Exploitation Attempt
id: cti-2026-09-30-004-ise-auth-bypass
status: experimental
description: Detects unauthenticated API requests to Cisco ISE management endpoints (CVE-2026-76460).
author: CTI Research
date: 2026/09/30
references:
  - hxxps://support[.]cisco[.]com/ise
  - hxxps://www[.]sentinelone[.]com/vulnerability-database/cve-2026-76460/
logsource:
  category: webserver
  service: cisco_ise
detection:
  selection:
    c-uri|contains:
      - '/admin/'
      - '/api/'
      - '/ise/'
    c-method: 
      - 'POST'
      - 'GET'
  filter_authenticated:
    authenticated_user: '-'
    src_ip|not startswith: 
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection and filter_authenticated
falsepositives:
  - Legitimate API calls from approved admin jump hosts (whitelist IPs)
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.persistence
  - attack.t1078
---
title: Suspicious JSP Web Shell Activity On Zimbra Server
status: experimental
logsource:
  category: webserver
  product: zimbra
detection:
  selection_uri:
    url|contains:
      - ".jsp"
  selection_method:
    http_method:
      - POST
      - PUT
  selection_process:
    process_command_line|contains:
      - "cmd="
      - "exec"
      - "Runtime.getRuntime"
      - "ProcessBuilder"
  condition: selection_uri and (selection_method or selection_process)
fields:
  - src_ip
  - http_method
  - url
  - user_agent
  - response_status
  - process_command_line
  - file_path
level: high
---
title: Unusual Cisco SD-WAN Manager Administrative API Activity
status: experimental
logsource:
  category: application
  product: cisco_sdwan_manager
detection:
  selection_api:
    url|contains:
      - "/dataservice/"
      - "/j_security_check"
      - "/login"
  selection_admin:
    user|endswith:
      - "admin"
    role|contains:
      - "netadmin"
  selection_anomaly:
    src_ip_not_in:
      - approved_management_ranges
  condition: selection_api and selection_admin and selection_anomaly
fields:
  - timestamp
  - src_ip
  - user
  - role
  - http_method
  - url
  - response_status
  - request_id
level: high

rule G_APT_Backdoor_webshell_WHIPSHOT_1 {
    meta:
        description = "Detects WHIPSHOT PHP webshell on Citrix NetScaler"
        author = "GTIG"
        family = "WHIPSHOT"
    strings:
        $sh1 = "HTTP_X_UX" ascii
        $sh2 = "HTTP_X_UX_" ascii
        $si1 = "/.uxdport" ascii
        $si2 = "/.uxdlock" ascii
        $sf1 = "fsockopen" ascii
        $sf2 = "127.0.0.1" ascii
    condition:
        filesize < 50KB and (($sh1 or $sh2) and ($si1 or $si2) and ($sf1 or $sf2))
}

rule G_APT_Tunneler_SLAPSHOT_1 {
    meta:
        description = "Detects SLAPSHOT Python proxy daemon"
        author = "GTIG"
        family = "SLAPSHOT"
    strings:
        $ss1 = "/tmp/.uxdport" ascii fullword
        $ss2 = "/tmp/.uxdlock" ascii fullword
        $ss3 = "UXD_IDLE_EXIT" ascii fullword
        $sc1 = "\"open\"" ascii fullword
        $sc2 = "\"push\"" ascii fullword
        $sc3 = "\"pull\"" ascii fullword
        $sc4 = "\"exch\"" ascii fullword
        $sc5 = "\"close\"" ascii fullword
        $sc6 = "\"ping\"" ascii fullword
    condition:
        filesize < 30KB and (($ss1 and $ss2 and $ss3) or ($ss1 and 3 of ($sc*)))
}

rule Netscaler_Webshell_CtxsReceiver {
  meta:
    description = "Detects PHP webshell deployed at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver"
    author = "CTI Research"
    date = "2026-09-30"
    reference = "hxxps://www[.]bleepingcomputer[.]com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/"
  strings:
    $php_shell = "<?php" ascii
    $netscaler_path = "/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver" ascii
    $httpd_conf = "/etc/httpd.conf" ascii
    $css_extension = ".css" ascii
  condition:
    $php_shell and ($netscaler_path or $httpd_conf or $css_extension)
}

rule CoreGraphics_Exploit_FilePattern {
  meta:
    description = "Detects file structures associated with CVE-2026-86950 exploitation (out-of-bounds write in CoreGraphics)"
    author = "CTI Research"
    date = "2026-09-30"
    reference = "hxxps://www[.]bleepingcomputer[.]com/news/security/apple-patches-coregraphics-zero-day-flaw-exploited-in-attacks/"
  strings:
    $png_header = "89 50 4E 47 0D 0A 1A 0A"
    $ihdr_chunk = "IHDR" ascii
    $large_width = { 00 00 [2-4] (??){2} }
    $trns_chunk = "tRNS" ascii
  condition:
    $png_header and $ihdr_chunk and $large_width and $trns_chunk
}

rule WSO2_Webshell_Upload {
  meta:
    description = "Detects webshell patterns uploaded to WSO2 API Manager directories"
    author = "CTI Research"
    date = "2026-09-30"
    reference = "hxxps://security[.]docs[.]wso2[.]com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/"
  strings:
    $php_shell = "<?php" ascii
    $wso2_path = "/repository/deployment/server/" ascii
    $jsp_shell = "<%@ page" ascii
    $exec_func = "Runtime.getRuntime().exec" ascii
  condition:
    ($php_shell or $jsp_shell) and ($wso2_path or $exec_func)
}

rule Generic_JSP_Command_Webshell_Hunt
{
    meta:
        description = "Hunt for JSP command execution web shells"
        confidence = "heuristic"

    strings:
        $jsp1 = "<%@ page"
        $cmd1 = "request.getParameter"
        $cmd2 = "Runtime.getRuntime"
        $cmd3 = "ProcessBuilder"
        $cmd4 = "getInputStream"
        $cmd5 = "java.lang.Process"

    condition:
        filesize < 2MB and
        $jsp1 and 2 of ($cmd*)
}

# 1. Splunk SIEM Query: Citrix NetScaler Webshell via CSS Hijack
index=netscaler_access 
(uri_path="*/LogonPoint/custom/.ctxs.receiver" OR uri_path="*receiver.min.css") 
status=200 
| stats count by src_ip, uri_path, useragent
| where count > 5
| eval alert="Potential NetScaler webshell activity - investigate src_ip"

# 2. SIEM Field Logic: NetScaler Webshell, Process, and Egress Tunneling Hunt
device.vendor = "Citrix"
AND device.product IN ("NetScaler ADC", "NetScaler Gateway")
AND (
    process.name IN ("sh", "bash", "busybox", "nc", "socat")
    OR file.name MATCHES /\.(jsp|jspx|php|pl)$/
    OR network.direction = "outbound"
       AND destination.port NOT IN (80, 443, 53, 123)
    OR user.name IN ("root", "nsroot")
       AND authentication.result = "success"
       AND source.ip NOT IN approved_admin_ranges
)

# 3. SIEM Correlation Rules: NetScaler DTLS Crash, httpd.conf FIM, SUID /bin/sh, and UDP/443 Baseline
ssl_handshake_failure AND dtls_version="DTLSv1.0" AND reason="Handshake failure-Internal Error" within 5m of (process_termination LIKE "%NSPPE%" AND pitboss_message LIKE "%NOT restarting NSPPE%") -> severity=critical
file_path="/etc/httpd.conf" AND (content_delta CONTAINS "AddHandler application/x-httpd-php" OR content_delta CONTAINS "AliasMatch") -> severity=high
file_path="/bin/sh" AND mode_after CONTAINS "rws" -> severity=critical
dst_port=443 AND proto=UDP to NetScaler Gateway from non-baseline source IPs when DTLS is disabled -> severity=medium

# 4. On-Appliance NetScaler CLI Hunt Commands
grep -En -i "application/x-httpd-php|php_flag|AliasMatch" /etc/httpd.conf
file /var/netscaler/gui/vpn/scripts/linux/* | grep -E "ASCII text|PHP script"
ls -la /tmp/.uxdport /tmp/.uxdlock /bin/sh

# 5. Splunk SIEM Query: Apple MDM Targeted Spyware Compliance and Profile Anomaly
index=apple_mdm 
(event_type="device_compliance" AND compliance_status="non_compliant") 
OR (event_type="profile_install" AND profile_type="unknown") 
| stats count by device_id, user_name, event_type 
| where count > 3 
| eval alert="Potential targeted spyware activity - investigate device"

# 6. Splunk SIEM Query: WSO2 API Manager Path Traversal Upload Hunt
index=wso2_access 
(c-uri="*../*" OR c-uri="*%2e%2e%2f*") 
c-method=POST 
| stats count by src_ip, c-uri, useragent 
| where count > 5 
| eval alert="Potential WSO2 path traversal exploitation - investigate src_ip"

# 7. Splunk SIEM Query: Cisco ISE Unauthenticated Admin Action Hunt
index=cisco_ise_audit 
(action="admin_login" OR action="policy_change" OR action="account_create") 
NOT authenticated_user=* 
| stats count by src_ip, action, user 
| where count > 3 
| eval alert="Potential ISE authentication bypass - investigate src_ip"