CVE-2026-88772

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName in~ ("nsd", "httpd", "sshd") // Common NetScaler processes
| where ProcessCommandLine contains "dtls" // If DTLS is a factor
| where InitiatingProcessFileName !in ("nsd", "httpd", "sshd") // Look for unusual parent processes
| where ProcessCommandLine has_any ("sh", "bash", "powershell", "cmd") // Shell execution indicators
| summarize count() by DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
| where count_ > 5 // Adjust threshold as needed for your environment
| project DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, count_

Splunk SPL

index=your_netscaler_logs (process="nsd" OR process="httpd" OR process="sshd") (commandline=*dtls* OR commandline=*sh* OR commandline=*bash* OR commandline=*powershell* OR commandline=*cmd*)
| stats count by host, process, commandline, parent_process
| where count > 5

Sigma

title: Citrix NetScaler RCE/DoS via Memory Overflow
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects potential remote code execution or denial of service attempts on Citrix NetScaler ADC/Gateway via memory overflow (CVE-2026-88772).
author: SecBoard
date: 2026/09/28
references:
  - https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway
logsource:
  category: process_creation
  product: linux
tags:
  - attack.execution
  - cve.2026.88772
  - cisa_kev
detection:
  selection:
    Image|endswith:
      - '/nsd'
      - '/httpd'
      - '/sshd'
    CommandLine|contains:
      - 'dtls'
      - 'sh'
      - 'bash'
      - 'powershell'
      - 'cmd'
  condition: selection
falsepositives:
  - Legitimate administrative activities (requires tuning)
level: high

Elastic ES|QL

from process where process.executable in ("/usr/sbin/nsd", "/usr/sbin/httpd", "/usr/sbin/sshd") and (process.args contains "dtls" or process.args contains "sh" or process.args contains "bash" or process.args contains "powershell" or process.args contains "cmd")
| stats count() by host.name, process.executable, process.command_line, process.parent.executable
| where count > 5