Citrix ADC CVE-2023-4966 Exploitation Attempt (Citrix Bleed)

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•1•0•27

Detects exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The detection logic specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' with an unusually long host header string (150 characters or more) in proxy logs. This pattern is indicative of the 'Citrix Bleed' exploit.