Mandiant-Observed In-the-Wild NetScaler CVE-2026-88772 Exploitation — C2 Traffic, SMTP Egress & Internal Fan-Out
This rule monitors network traffic from CommonSecurityLog data to detect bidirectional communication between NetScaler appliances and known malicious infrastructure associated with the CVE-2026-88772 campaign, which is indicative of command-and-control activity.
Microsoft Sentinel (KQL)
