SSH Key/Credential Persistence on Hosts Reached via Anomalous NetScaler VPN Sess

Ibrahim Saud@tektrix

•updated Sep 28, 2026•0•0•6

This rule identifies suspicious post-exploitation activity where an anomalous or unauthenticated NetScaler VPN session (potentially exploiting CVE-2026-88771 or CVE-2026-88772) is followed by the creation or modification of SSH authorized_keys files or related credential manipulation commands on internal hosts, suggesting an attacker establishing persistence.