Citrix ADC/NetScaler Web Exploitation Indicators for CVE-2020-8193 and CVE-2020-8195

title: Citrix ADC/NetScaler Web Exploitation Indicators for CVE-2020-8193 and CVE-2020-8195
id: 745bba89-ee68-412b-aecd-b4844be80ef0
status: test
description: This rule identifies web requests targeting Citrix ADC/NetScaler endpoints that match URI query patterns associated with exploitation activity. Attackers may use these requests to access or retrieve sensitive server-side resources through vulnerable paths. The detection relies on HTTP webserver telemetry, specifically the request query string (cs-uri-query), to match both download and signature/report request patterns.
references:
  - https://support.citrix.com/article/CTX276688
  - https://research.nccgroup.com/2020/07/10/rift-citrix-adc-vulnerabilities-cve-2020-8193-cve-2020-8195-and-cve-2020-8196-intelligence/
  - https://dmaasland.github.io/posts/citrix.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-8193/web_cve_2020_8193_8195_citrix_exploit.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-10
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2020-8193
  - cve.2020-8195
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection1:
    cs-uri-query|contains: /rapi/filedownload?filter=path:%2F
  selection2:
    cs-uri-query|contains|all:
      - /pcidss/report
      - type=all_signatures
      - sig_name=_default_signature_
  condition: 1 of selection*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7
    type: derived