CVE-2019-19781

Sentinel/Defender KQL

let CitrixADCGatewayIPs = dynamic(['<IP_OF_CITRIX_ADC_GATEWAY_1>', '<IP_OF_CITRIX_ADC_GATEWAY_2>']);
SecurityEvent
| where EventID == 4624 // Beispiel für erfolgreiche Anmeldungen, anpassen für Webserver-Logs
| where IpAddress in (CitrixADCGatewayIPs)
| join kind=inner (
    CommonSecurityLog
    | where DeviceVendor == "Citrix" and DeviceProduct == "NetScaler"
    | where RequestURL contains "/vpns/" and RequestURL contains "/../"
    | project TimeGenerated, SourceIP, RequestURL, DeviceAction
) on $left.IpAddress == $right.SourceIP
| project TimeGenerated, IpAddress, RequestURL, DeviceAction, Account, Activity

Splunk SPL

sourcetype=citrix:netscaler (uri_path="*/vpns/*" AND uri_path="*/../*") OR (http_user_agent="*curl*" AND uri_path="*/vpn/../vpns/cfg/smb.conf*") | table _time, src_ip, uri_path, http_method, http_status

Sigma

title: Citrix ADC/Gateway Directory Traversal Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects attempts to exploit CVE-2019-19781 (Citrix ADC/Gateway Directory Traversal).
references:
  - https://www.kb.cert.org/vuls/id/619785
logsource:
  category: webserver
  product: citrix_netscaler
detection:
  selection:
    url|contains_all:
      - '/vpns/'
      - '/../'
  condition: selection
fields:
  - client_ip
  - url
  - user_agent
tags:
  - attack.initial_access
  - attack.t1190 # Exploit Public-Facing Application
  - cve.2019.19781
level: high

Elastic ES|QL

from logs-webserver-citrix.netscaler*
| where url.path : "*/vpns/*" and url.path : "*/../*"
| project @timestamp, client.ip, url.original, user_agent.original