CVE-2026-8452

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName contains "nsd" or FileName contains "httpd" // Common NetScaler processes
| where ProcessCommandLine contains "-DoS" or ProcessCommandLine contains "-crash" // Look for crash/DoS related arguments if available in logs
| where InitiatingProcessFileName contains "nsd" or InitiatingProcessFileName contains "httpd" // Look for processes initiating unusual activity
| summarize count() by DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
| where count_ > 5 // Adjust threshold based on baseline

Splunk SPL

index=your_netscaler_logs (source="/var/log/ns.log" OR source="/var/log/httpaccess.log") (("memory overflow" OR "denial of service" OR "crash" OR "restarting") AND ("NetScaler ADC" OR "NetScaler Gateway" OR "SSL VPN" OR "ICA Proxy" OR "CVPN" OR "RDP Proxy" OR "AAA virtual server"))
| stats count by host, source, _time
| where count > 5

Sigma

title: NetScaler DoS Vulnerability
logsource:
  product: netscaler
  service: system
detection:
  selection:
    EventID: # Placeholder for specific NetScaler event IDs related to crashes/DoS
    Message|contains:
      - 'memory overflow'
      - 'denial of service'
      - 'crash'
      - 'restarting'
      - 'NetScaler ADC'
      - 'NetScaler Gateway'
      - 'SSL VPN'
      - 'ICA Proxy'
      - 'CVPN'
      - 'RDP Proxy'
      - 'AAA virtual server'
  condition: selection
level: critical

Elastic ES|QL

from netscaler_logs
| where message : ("memory overflow" or "denial of service" or "crash" or "restarting") and ("NetScaler ADC" or "NetScaler Gateway" or "SSL VPN" or "ICA Proxy" or "CVPN" or "RDP Proxy" or "AAA virtual server")
| stats count() by host, message
| where count > 5