CVE-2026-88772 - Citrix NetScaler Persistence Indicators: VPN Directory Modification, SUID Backdoor Creation, and Apache Restart
This detection identifies potential Citrix NetScaler persistence and anti-forensic activity associated with CVE-2026-88772. It monitors for suspicious modifications within VPN-related directories and execution of commands indicative of SUID root backdoor creation or Apache web server restart activity, which may indicate efforts to establish persistence, conceal attacker activity, or activate malicious web content.
Microsoft Sentinel (KQL)
