Inferlume

title: Citrix NetScaler CVE-2026-88771 Command Injection Attempt
id: 7c2e9a1b_4f60_4c1e_9d11_netscaler_login_meta
status: experimental
description: Detects exploitation attempts for CVE-2026-88771 via shell metacharacters and crash strings in login parameters targeting doAuthentication.do
logsource:
  product: citrix_netscaler
  category: webserver
detection:
  selection_endpoint:
    url.path|endswith: '/nf/auth/doAuthentication.do'
    http.request.method: 'POST'
  selection_payload:
    url.query|contains:
      - 'pitboss PPE unexpectedly died'
      - 'NSPPE;'
      - '`id>'
      - '%3B'
      - '%60'
      - '%7C'
      - '%24%28'
      - '/var/tmp/'
      - 'watchTowr'
      - 'ns_monuploadd'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Authorized vulnerability scanning in lab environments
level: critical
---
title: Citrix NetScaler Webshell Access and Apache AliasMatch Evasion
id: 91aa0c44_2b17_4e88_a0de_netscaler_webshell_seed
status: experimental
description: Detects filesystem, process, or web access matching the .ctxs.receiver PHP webshell and receiver.min.css AliasMatch persistence chain
logsource:
  product: linux
  service: auditd
detection:
  selection_process:
    process.name:
      - 'chmod'
      - 'httpd'
      - 'apachectl'
      - 'pkill'
    process.command_line|contains:
      - '/bin/sh'
      - '.ctxs.receiver'
      - 'receiver.min'
      - 'AliasMatch'
      - 'SetHandler'
  condition: selection_process
falsepositives:
  - Legitimate appliance firmware upgrades
level: critical
---
title: Suspicious NetScaler Administrative Activity During Active Exploitation
id: 88b12c33_5d11_4a99_b123_netscaler_admin_anomaly
status: experimental
description: Detects anomalous administrative logins, shell execution, policy modifications, or logging gaps on Citrix NetScaler appliances
logsource:
  product: citrix_netscaler
  service: audit
detection:
  selection_event:
    event.action:
      - 'admin_login'
      - 'configuration_change'
      - 'shell_command'
      - 'policy_change'
      - 'create_user'
      - 'export_configuration'
      - 'log_service_stop'
  suspicious_source:
    source.ip|not_in: 'approved_admin_ranges'
  condition: selection_event and suspicious_source
level: high
---
title: CLOSEDQUORUM Suspicious LLM API Calls from Unknown Windows Binary
id: 44c91e22_8a10_4f33_9c01_closedquorum_llm_c2
status: experimental
description: Detects unsigned or unknown Go binaries making outbound HTTPS connections to commercial LLM APIs for autonomous C2 voting
logsource:
  product: windows
  category: network_connection
detection:
  selection_process:
    Image|endswith: '.exe'
    Company: 'Unknown'
  selection_domains:
    DestinationHostname|contains:
      - 'generativelanguage[.]googleapis[.]com'
      - 'api[.]deepseek[.]com'
      - 'api[.]qwen[.]ai'
      - 'api[.]mistral[.]ai'
  condition: selection_process and selection_domains
level: high
---
title: JADEPUFFER Azure Bulk Resource Deletion and Storage Key Enumeration
id: 55d82f11_9b20_4e44_8d02_azure_jadepuffer_destruction
status: experimental
description: Detects rapid bulk deletion of Azure resources or excessive ListKeys calls by a Service Principal matching Storm 3168 tradecraft
logsource:
  product: azure
  service: azureactivity
detection:
  selection_Caller:
    CallerType: 'ServicePrincipal'
  selection_ops:
    OperationNameValue|contains:
      - 'delete'
      - 'listKeys'
  condition: selection_Caller and selection_ops
level: critical
---
title: Cluster Wide Secret Enumeration by Kubernetes Operator
id: 66e73a00_1c30_4d55_7e03_k8s_operator_secrets
status: experimental
description: Detects Kubernetes operator service accounts listing or watching secrets across cluster scope outside authorized namespaces
logsource:
  product: kubernetes
  service: audit
detection:
  operator_identity:
    user.username|startswith: 'system:serviceaccount:'
  secret_read:
    objectRef.resource: 'secrets'
    verb:
      - 'get'
      - 'list'
      - 'watch'
  cluster_scope:
    objectRef.namespace: null
  condition: operator_identity and secret_read and cluster_scope
level: high

rule CVE_2026_88771_Exploit_And_Ctxs_Receiver_Webshell
{
    meta:
        description = "Detects Citrix NetScaler CVE-2026-88771 exploit strings and .ctxs.receiver PHP webshell artifacts"
        date = "2026_09_29"
        cve = "CVE-2026-88771"
    strings:
        $payload1 = "pitboss PPE unexpectedly died NSPPE" ascii wide nocase
        $payload2 = "/var/tmp/watchTowr" ascii
        $payload3 = "ns_monuploadd_err.pl" ascii wide nocase
        $endpoint = "/nf/auth/doAuthentication.do" ascii wide nocase
        $dotfile = ".ctxs.receiver" ascii wide nocase
        $alias = "receiver.min.css" ascii wide nocase
        $aliasmatch = "AliasMatch" ascii wide nocase
        $handler = "SetHandler application/x-httpd-php" ascii
    condition:
        ($endpoint and any of ($payload*)) or (2 of ($dotfile, $alias, $aliasmatch, $handler))
}

rule ClosedQuorum_Multi_LLM_Go_Binary
{
    meta:
        description = "Detects CLOSEDQUORUM Go implant embedding multiple commercial LLM API endpoints and voting logic"
        date = "2026_09_29"
    strings:
        $go_runtime = "go runtime version" ascii
        $llm_gemini = "generativelanguage[.]googleapis[.]com" ascii
        $llm_deepseek = "api[.]deepseek[.]com" ascii
        $llm_qwen = "api[.]qwen[.]ai" ascii
        $llm_mistral = "api[.]mistral[.]ai" ascii
        $vote_tiebreak = "DeepSeek" ascii
    condition:
        $go_runtime and $vote_tiebreak and (2 of ($llm_*))
}

rule Azure_ServicePrincipal_Credential_Exposure
{
    meta:
        description = "Detects exposed Azure service principal client secrets or certificate data in code repositories"
        date = "2026_09_29"
    strings:
        $sp_secret = "client_secret" ascii
        $sp_cert = "client_certificate_data" ascii
    condition:
        $sp_secret or $sp_cert
}

# 1. Citrix NetScaler Exploit, Webshell, and Admin Anomaly Hunt (Splunk / ECS)
index=netlogs sourcetype=citrix:netscaler:access (cs_uri_stem="/nf/auth/doAuthentication.do" cs_method=POST) OR cs_uri_stem="*/.ctxs.receiver" OR cs_uri_stem="*/receiver.min*.css"
| regex cs_uri_query="(pitboss PPE unexpectedly died|NSPPE;|`id>|/var/tmp/|watchTowr|%3B|%60)"
| table _time c_ip cs_uri_stem cs_uri_query cs_method cookie cs_user_agent

# 2. Citrix NetScaler Post Exploitation Process and Version Gate Logic
device.vendor = "Citrix" AND device.product IN ("NetScaler ADC", "NetScaler Gateway") AND (device.version < "14.1.73.37" OR device.version < "13.1.64.23" OR event.action IN ("shell_command", "admin_login", "configuration_change", "user_created", "policy_modified", "certificate_changed", "log_service_stop") OR process.command_line CONTAINS "chmod u+s /bin/sh") AND source.ip NOT IN approved_admin_cidrs

# 3. CLOSEDQUORUM Behavioral LLM C2 and Credential Harvest Logic
(process.name ENDSWITH ".exe" AND process.vendor = "Unknown" AND network.destination.domain IN ("generativelanguage[.]googleapis[.]com", "api[.]deepseek[.]com", "api[.]qwen[.]ai", "api[.]mistral[.]ai")) OR (file.path CONTAINS ("Login Data", "logins.json", "keystore") AND process.vendor = "Unknown")

# 4. JADEPUFFER (Storm 3168) Azure Reconnaissance, Bulk Deletion, and ListKeys Hunt (KQL)
AzureActivity
| where CallerType == "ServicePrincipal"
| summarize ReadOps = countif(OperationNameValue contains "read"), DeleteOps = countif(OperationNameValue contains "delete"), ListKeyOps = countif(OperationNameValue contains "listKeys") by Caller, bin(TimeGenerated, 30m)
| where ReadOps > 50 or DeleteOps > 10 or ListKeyOps > 20

# 5. Apple CoreGraphics Zero Click Crash and Exploit Protection Hunt
index=endpoint sourcetype=crash_report process_name IN ("CoreGraphics", "PDFKit", "ImageIO", "Preview", "Mail", "Messages")
| where signature LIKE "%out of bounds%" OR signature LIKE "%EXC_BAD_ACCESS%"
| table _time host process_name signature crashed_thread

# 6. Lazarus Group Bitget Attacker Wallet Cluster Alert
index=blockchain sourcetype=crypto_tx (from_address IN ("0x7A5...", "TRX...", "ZEC...") OR to_address IN ("0x7A5...", "TRX...", "ZEC..."))
| table _time from_address to_address value token_symbol