NetScaler forged pitboss PPE login burst from many source IPs (kw2-freebsd downl

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•3

Detects multiple distinct source IPs sending forged 'pitboss PPE' authentication failure messages to NetScaler authentication endpoints within a short timeframe, associated with a fetch-based FreeBSD payload download (kw2-freebsd-x64-s11).