CVE-2026-88775

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName contains "nsd" or FileName contains "httpd"
| where ProcessCommandLine contains "gateway" or ProcessCommandLine contains "aaa"
| where ProcessIntegrityLevel == "System" or ProcessIntegrityLevel == "High"
| summarize Count=count() by DeviceName, FileName, ProcessCommandLine
| where Count > 5 // Adjust threshold based on baseline
| project DeviceName, FileName, ProcessCommandLine, Count
// Further investigation for crashes or unexpected restarts of NetScaler services
| union DeviceProcessEvents
| where FileName contains "nsd" or FileName contains "httpd"
| where ActionType == "ProcessTerminated"
| where InitiatingProcessFileName !contains "update" and InitiatingProcessFileName !contains "patch"
| summarize Count=count() by DeviceName, FileName, InitiatingProcessFileName
| where Count > 1 // Look for multiple unexpected terminations
| project DeviceName, FileName, InitiatingProcessFileName, Count

Splunk SPL

(sourcetype=citrix:netscaler (process=nsd OR process=httpd) (commandline=*gateway* OR commandline=*aaa*)) OR (sourcetype=citrix:netscaler (process=nsd OR process=httpd) (status=terminated OR status=crashed) NOT (commandline=*update* OR commandline=*patch*))
| stats count by host, process, commandline
| where count > 5
| rename count as "Abnormal Process Count"
| table host, process, commandline, "Abnormal Process Count"

Sigma

title: Citrix NetScaler Memory Overflow DoS
id: 00000000-0000-0000-0000-0000000088775
status: experimental
description: Detects potential memory overflow leading to unpredictable behavior or DoS in Citrix NetScaler ADC/Gateway, specifically when gateway or AAA vServer is configured.
author: SecBoard
date: 2026/09/27
references:
  - https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway
logsource:
  product: citrix
  service: netscaler
detection:
  selection_process_behavior:
    EventID: 1 # Placeholder for process creation/termination events, adjust based on actual logs
    Image|endswith:
      - '\nsd.exe'
      - '\httpd.exe'
    CommandLine|contains:
      - 'gateway'
      - 'aaa'
  selection_crash_behavior:
    EventID: 2 # Placeholder for crash/termination events, adjust based on actual logs
    Image|endswith:
      - '\nsd.exe'
      - '\httpd.exe'
    Status|contains:
      - 'terminated'
      - 'crashed'
    ParentImage|contains:
      - 'update' # Exclude planned updates
      - 'patch'
    ParentImage|contains:
      - 'upgrade'
  condition: 1 of selection_*
level: high

Elastic ES|QL

from logs-citrix.netscaler.*
| where process.name : ("nsd", "httpd")
| where process.args : ("*gateway*", "*aaa*")
| stats count() by host.name, process.name, process.args
| where count() > 5
| union
from logs-citrix.netscaler.*
| where process.name : ("nsd", "httpd")
| where event.action : ("process_terminated", "process_crashed")
| where not process.parent.name : ("update", "patch", "upgrade")
| stats count() by host.name, process.name, process.parent.name
| where count() > 1