CVE-2026-88777

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName contains "netscaler" or FolderPath contains "netscaler"
| where ProcessCommandLine contains "non-HTTP L7 protocol" or InitiatingProcessCommandLine contains "non-HTTP L7 protocol" // Placeholder for specific process related to non-HTTP L7 protocol handling
| summarize count() by DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| extend Anomaly = "Potential memory overflow or DoS related to CVE-2026-88777"

Splunk SPL

index=your_netscaler_logs (sourcetype=netscaler_adc OR sourcetype=netscaler_gateway) (error OR warning OR "denial of service" OR "memory overflow" OR "unpredictable behavior")
| where _raw like "*non-HTTP L7 protocol*"
| stats count by host, _raw
| rename _raw as "Log Message"
| table host, "Log Message", count

Sigma

title: Citrix NetScaler CVE-2026-88777 DoS
author: SecBoard
date: 2026/09/28
logsource:
  product: netscaler
  service: adc_gateway
detection:
  selection:
    - message|contains: ['memory overflow', 'denial of service', 'unpredictable behavior']
    - message|contains: 'non-HTTP L7 protocol'
  condition: selection
  timeframe: 5m
level: high

Elastic ES|QL

from netscaler_logs
| where message : ("memory overflow" or "denial of service" or "unpredictable behavior") and message : "non-HTTP L7 protocol"
| stats count() by host, message
| sort by count desc