huntrule

Suspicious Access to Citrix Session Evidence Registry Keys

PremiumReviewedSigma · Medium · v1
Product
windows
Category
registry_set
Author
HuntRule
Published
2026-09-14
Updated
2026-09-14
AnalysisDetection

ATT&CK techniques

Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects modification of Citrix session Evidence registry keys that record ClientName and ClientIP, which attackers exploiting CitrixBleed (CVE-2023-4966) leverage to hijack authenticated sessions. Manipulating these keys helps the attacker impersonate legitimate remote sessions after stealing session tokens. Monitoring these keys surfaces session-hijack activity tied to the vulnerability.

Reporting behind it

Related detections9 linkedT1021.002 — drag to rearrange
Suspicious PsExec Service Launching Encoded PowerShell Payload
Suspicious Impacket Style Command Execution with ADMIN Share Output Redirect
Suspicious Active Directory Reconnaissance via In-Memory Offensive PowerShell (via ps_script)
Suspicious NetExec Post-Exploitation Tool Execution via nxc (via process_creation)
Suspicious SMB Admin Share Mapping for Lateral Tool Transfer (via process_creation)
Suspicious Impacket Remote Execution Tool Usage via process_creation
Suspicious Remote Service Execution via PsExec (via process_creation)
Suspicious RemCom Service Named Pipe for Lateral Movement (via pipe_created)
Suspicious WMIC Remote Process Creation for Lateral Movement
Suspicious Access to Citrix Session Evidence Registry Keys
Pivot detection · T1021.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.