Aniket Trimbake

@aniket93

2 followers12 downloads10 copies7 likes344 views

2 detections

Filters

Last updated

All Time

Detection languages

Microsoft Sentinel (KQL)2

Platforms

Network (Generic)1

Products / Services

Linux Syslog1

MITRE Techniques

T1005 - Data from Local System1

T1083 - File and Directory Discovery1

T1203 - Exploitation for Client Execution1

NetScaler CitrixBleed 2 Exploitation Detection

KQL

This detection identifies potential exploitation attempts against Citrix NetScaler appliances vulnerable to CVE-2025-5777 (CitrixBleed 2), focusing on suspicious POST requests and memory spillage in logoff entries.

Aniket Trimbake@aniket93

Detections.ai Community

1 year ago

62244

Detection of Inactive Log Sources in the Last Hour

KQL

The rule identifies log sources that have stopped sending data in the last hour despite being active in the past 24 hours, suggesting possible misconfigurations or disruptions. The rule is valid.