SLAPSHOT IPC file creation and Python launcher on NetScaler

Georgios Maragos@Gmarak

•updated 22 days ago•3•0•7

Detects evidence of the SLAPSHOT backdoor on Citrix NetScaler appliances by identifying specific ephemeral IPC files (/tmp/.uxdport and /tmp/.uxdlock) or the associated python-based launcher process that uses base64-encoded arguments to initialize the proxy daemon.