CVE-2026-88778

Sentinel/Defender KQL

// This is a conceptual query as direct ISN prediction detection is complex and often requires deep packet inspection or specific NetScaler logs not detailed in the source.
// Look for unusual TCP session patterns, especially related to new connections or resets, that might indicate ISN prediction attempts.
// This query assumes logs from NetScaler or network devices are ingested and contain relevant TCP session information.
// Adjust 'YourNetScalerLogs' to your actual log table name.
YourNetScalerLogs
| where EventType == "TCP_SESSION_START" or EventType == "TCP_RESET"
| summarize SessionCount = count() by SourceIP, DestinationIP, DestinationPort, bin(TimeGenerated, 1m)
| where SessionCount > 5 // Example threshold for unusual activity, customize as needed
| project SourceIP, DestinationIP, DestinationPort, SessionCount, TimeGenerated
| order by TimeGenerated desc

Splunk SPL

# This is a conceptual query as direct ISN prediction detection is complex and often requires deep packet inspection or specific NetScaler logs not detailed in the source.
# Look for unusual TCP session patterns, especially related to new connections or resets, that might indicate ISN prediction attempts.
# This query assumes logs from NetScaler or network devices are ingested and contain relevant TCP session information.
# Adjust 'sourcetype=your_netscaler_logs' to your actual log sourcetype.
sourcetype=your_netscaler_logs (event_type="TCP_SESSION_START" OR event_type="TCP_RESET")
| stats count as SessionCount by src_ip, dest_ip, dest_port, _time span=1m
| where SessionCount > 5
| table _time, src_ip, dest_ip, dest_port, SessionCount
| sort -_time

Sigma

title: Citrix NetScaler TCP ISN Prediction Attempt
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx # Generate a unique GUID
status: experimental
description: Detects potential attempts to exploit CVE-2026-88778 by observing unusual TCP session patterns indicative of ISN prediction.
references:
  - https://www.cve.org/CVERecord?id=CVE-2026-88778
logsource:
  product: netscaler
  service: tcp_logs # Adjust service name based on actual log source
detection:
  selection:
    EventID: # Placeholder for relevant event ID if available
    EventType: "TCP_SESSION_START" OR "TCP_RESET"
  timeframe: 1m
  condition: selection | stats count() by SourceIP, DestinationIP, DestinationPort | where count() > 5 # Example threshold
falsepositives:
  - Legitimate network activity with high connection rates
level: medium

Elastic ES|QL

// This is a conceptual query as direct ISN prediction detection is complex and often requires deep packet inspection or specific NetScaler logs not detailed in the source.
// Look for unusual TCP session patterns, especially related to new connections or resets, that might indicate ISN prediction attempts.
// This query assumes logs from NetScaler or network devices are ingested and contain relevant TCP session information.
// Adjust 'your_netscaler_logs' to your actual log index pattern.
FROM your_netscaler_logs
| WHERE event.type == "TCP_SESSION_START" OR event.type == "TCP_RESET"
| SUM(k = 1) BY source.ip, destination.ip, destination.port, RUNDOWN(event.ingested, 1m)
| WHERE k > 5 // Example threshold for unusual activity, customize as needed
| SELECT source.ip, destination.ip, destination.port, k AS session_count, RUNDOWN(event.ingested, 1m) AS time_window
| ORDER BY time_window DESC