NetScaler Repeated Restarts/HA Failovers Indicating CVE-2026-88772 DoS
Detects high-frequency restarts, HA failovers, or process crashes (e.g., nsppe, nsaaad) on Citrix NetScaler appliances. This behavior is indicative of potential denial-of-service exploitation, such as the CVE-2026-88772 DTLS memory-overflow vulnerability.
Microsoft Sentinel (KQL)

