Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
3
3
Platforms
39,945
6,997
6,464
3,924
3,590
Products / Services
3
MITRE Techniques
3
3
3
3
CVEs
3
Hunts for NetScaler Pitboss packet engine messages where the text after NSPPE carries shell syntax such as separators, command substitution or ${IFS}. Security vendors observed this pattern during exploitation of the NetScaler pre authentication command injection flaw patched in September 2026.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
Hunts for NetScaler Pitboss packet engine messages where the text after NSPPE carries shell syntax such as separators, command substitution or ${IFS}. Security vendors observed this pattern during exploitation of the NetScaler pre authentication command injection flaw patched in September 2026.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
Hunts for NetScaler Pitboss packet engine messages where the text after NSPPE carries shell syntax such as separators, command substitution or ${IFS}. Security vendors observed this pattern during exploitation of the NetScaler pre authentication command injection flaw patched in September 2026.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
The query reads Syslog and CommonSecurityLog and decodes URL encoding. It checks only the text after NSPPE, so plain heartbeat lines without shell syntax do not match. The matching logic was checked on sample strings only, not on real appliance logs.
Triage: Check the source, the appliance version and whether it was patched at that time. A match on an unpatched appliance points to an exploitation attempt, not proof of success. Preserve logs and a snapshot before upgrading. Hunting query, not an alert.
Limitations: Needs NetScaler syslog forwarded to Sentinel. Empty results do not prove an appliance is clean. Attackers can remove traces and other techniques are not covered. Field names depend on the syslog format and connector. Bare separators and short words can match legitimate messages, so tune the regex after reviewing real results.
