How do you detect Citrix NetScaler exploitation?

Detect NetScaler exploitation on two tracks. For remote code execution such as CVE-2023-3519, look for nsppe crashes and core files, new script files in web-served directories, and unexpected shell activity on the appliance. For session theft such as CVE-2023-4966 (Citrix Bleed), hunt for oversized-Host-header requests to the OpenID discovery path and for one session identifier used from several addresses. After patching, terminate all sessions, run the vendor’s scanner, review web directories and accounts, and rotate credentials stored on the device.

Detecting Citrix NetScaler and ADC Exploitation

Two NetScaler vulnerabilities define the hunting playbook. CVE-2023-3519 was an unauthenticated remote code execution flaw in ADC and Gateway, exploited to drop web shells. CVE-2023-4966, known as Citrix Bleed, leaked memory that included session tokens, letting attackers hijack authenticated sessions and bypass multifactor controls (T1550.004). The first leaves files; the second leaves sessions.

Signals at a Glance

Signal	Where	ATT&CK
nsppe process crash or core file around the time of exploitation attempts	Appliance logs, /var/core, /var/crash	T1190
New script files in web-served directories under /netscaler or /var/netscaler/logon	File listing, vendor scanner	T1505.003
Requests with an oversized Host header to the OpenID discovery path	Access and WAF logs	T1190
One session identifier used from multiple client addresses	Gateway session logs	T1550.004
Shell commands run on the appliance by unexpected accounts or at unusual times	Appliance shell and audit logs	T1059.004
Appliance originating LDAP, SMB or RDP to internal servers	Firewall, flow, Zeek	T1021

Exploitation Traces

For Citrix Bleed, public analyses describe requests to /oauth/idp/.well-known/openid-configuration carrying a very long Host header and returning an oversized response. If you retain access or WAF logs for the appliance, hunt for that shape. Also check for requests to Gateway paths from addresses that never log in successfully:

title: NetScaler Oversized Host Header to OpenID Discovery Endpoint
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|endswith: '/oauth/idp/.well-known/openid-configuration'
    cs-method: 'GET'
  large_response:
    sc-bytes|gte: 20000
  condition: selection and large_response
level: high
# Tune/validate: the request-header length is not in every log format;
# if your WAF records Host length, alert on Host values above ~1000 characters.

Because stolen tokens give a valid session, the evidence is in the session pattern, not the exploit request. Look for the same identifier or user session appearing from more than one client address, or from a hosting provider range:

index=network sourcetype="citrix:netscaler:syslog" ("SSLVPN" OR "AAA" OR "ICAUSERNAME")
| stats dc(src_ip) as src_count values(src_ip) as srcs min(_time) as first max(_time) as last
        by user, session_id
| where src_count > 1
| eval first=strftime(first,"%F %T"), last=strftime(last,"%F %T")
# Tune/validate: roaming users on mobile networks can change IP; require a short window,
# a different ASN or geography, and an IP not previously seen for that user.

After Patching: Hunt and Reset

Terminate all active sessions after patching. Citrix guidance for session-token theft has stressed that sessions created before the fix remain valid until they are killed.
Run the vendor’s published indicator-of-compromise scanner and review web-served directories for new scripts. Compare file lists to a clean image of the same firmware build.
Review appliance shell history, cron entries and recently created accounts, and rotate credentials and certificates stored on the device, including LDAP bind accounts.
Review domain controller logs for authentication from the appliance’s service accounts, and for new logons by users whose sessions appeared from unfamiliar addresses.
Keep core files for forensics. An nsppe crash is a high-value artifact when you are working out when exploitation began.

Vetted sources

Use Citrix security bulletins and their published IOC-scanning guidance, CISA advisories on NetScaler exploitation, and SigmaHQ and Elastic rules for web server and edge device anomalies. Baseline your own environment: legitimate roaming users change source addresses, and restarts happen for non-malicious reasons.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Exploitation Traces

After Patching: Hunt and Reset

Build Detections That Fire

Edge Device & Web Shell Detection

Detection Hub

VPN Appliance Exploitation Detection

Ivanti Exploitation Detection