NetScaler post-compromise: shells/downloaders spawned by nsppe or nobody, rc.net
Detects suspicious process execution where a shell or scripting tool is spawned by the nsppe process or running under the nobody account, followed closely by file creation or modification activity in persistence locations or NetScaler GUI web directories.
Microsoft Sentinel (KQL)
