Potential NetScaler Log Poisoning Command Injection Attempt

Last updated 11 days ago on 2026-10-23

Created a month ago on 2026-09-28

About

Detects shell syntax in NetScaler Pitboss records or in Citrix records that combine Pitboss, packet-engine, or core terminology with shell syntax. This may indicate that attacker-controlled data poisoned an appliance log consumed by a privileged script. The behavior includes CVE-2026-88771, but the detection is intended to identify similar NetScaler log-poisoning command-injection attempts without requiring a specific vulnerability, failure phrase, or command.

Tags

Domain: NetworkPlatform: CitrixUse Case: Network Security MonitoringUse Case: Threat DetectionUse Case: VulnerabilityTactic: Initial AccessTactic: ExecutionData Source: Citrix ADCThreat: Vulnerability ExploitRule Type: Event Correlation (EQL)Vuln: CVE-2026-88771Language: eql

Severity

high

Risk Score

MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Exploit Public-Facing Application (T1190)(external, opens in a new tab or window)

Execution (TA0002)(external, opens in a new tab or window)

↳ Command and Scripting Interpreter (T1059)(external, opens in a new tab or window)

False Positive Examples

Authorized security testing may deliberately write a harmless forged Pitboss or PPE record to validate exposure or detection. Confirm the source and testing window. Normal Pitboss and packet-engine records should not contain shell separators, command substitution, pipes, or redirection.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Event Correlation Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-citrix_adc.log-*
Related Integrations: citrix_adc(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗any where
  data_stream.dataset == "citrix_adc.log" and
  (
    (
      citrix.detail regex~ """.*pitboss.*(nsppe|ppe|packet.*engine|core).*""" and
      citrix.detail like~ (
        "*;*", "*`*", "*$(*", "*&&*", "*||*",
        "*%3b*", "*%60*", "*%7c*", "*%24%28*", "*%26%26*", "*%3e*", "*%3c*"
      )
    ) or
    (
      citrix.device_event_class_id == "PITBOSS" and
      citrix_adc.log.message like~ (
        "*;*", "*`*", "*$(*", "*|*", "*>*", "*<*", "*&&*", "*||*",
        "*%3b*", "*%60*", "*%7c*", "*%24%28*", "*%26%26*", "*%3e*", "*%3c*"
      )
    )
  )

Install detection rules in Elastic Security

Detect Potential NetScaler Log Poisoning Command Injection Attempt in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).