CVE-2026-88771

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName in~ ("sh", "bash", "perl", "python", "php", "wget", "curl", "nc", "ncat", "powershell.exe", "cmd.exe")
| where InitiatingProcessFileName in~ ("httpd", "nginx", "java", "tomcat") or InitiatingProcessCommandLine contains "netscaler"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, RemoteIP, RemoteUrl
| summarize count() by DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| where count_ > 5 // Adjust threshold as needed to reduce false positives

Splunk SPL

(sourcetype=linux_audit OR sourcetype=syslog OR sourcetype=windows_security) (process="sh" OR process="bash" OR process="perl" OR process="python" OR process="php" OR process="wget" OR process="curl" OR process="nc" OR process="ncat" OR process="powershell.exe" OR process="cmd.exe") (parent_process="httpd" OR parent_process="nginx" OR parent_process="java" OR parent_process="tomcat" OR command_line=*netscaler*)
| stats count by host, parent_process, process, command_line
| where count > 5

Sigma

title: Citrix NetScaler RCE Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential arbitrary command execution on Citrix NetScaler ADC/Gateway via CVE-2026-88771.
author: SecBoard
date: 2026/09/28
logsource:
  category: process_creation
  product: linux
  service: auditd
detection:
  selection:
    ParentImage|endswith:
      - '\httpd'
      - '\nginx'
      - '\java'
      - '\tomcat'
    Image|endswith:
      - '\sh'
      - '\bash'
      - '\perl'
      - '\python'
      - '\php'
      - '\wget'
      - '\curl'
      - '\nc'
      - '\ncat'
      - '\powershell.exe'
      - '\cmd.exe'
  condition: selection
falsepositives:
  - Legitimate administrative scripts (requires tuning)
level: high

Elastic ES|QL

from process.start
| where process.parent.name in ("httpd", "nginx", "java", "tomcat") or process.parent.command_line : "*netscaler*"
| where process.name in ("sh", "bash", "perl", "python", "php", "wget", "curl", "nc", "ncat", "powershell.exe", "cmd.exe")
| summarize count() by host.name, process.parent.name, process.name, process.command_line
| where count > 5