This message was deleted.

Only seen false positives with the Mandiant so far, if you use AppFw and have HTML pages to provide feedback, it will flag them

We ran it in our lab and it returned positive, just opened a case with Citrix to get the one they provide

Mandiant says to run the script as sudo. The NetScaler doesn’t know what sudo is. It knows what su is, but I must not know the password as it’s not the same as nsroot. Everyone else running it without sudo or su?

You are root when you go into shell.. just run it with bash ./script.sh But I’ve heard reports of crashes while running

@Matt Sliva do you have a download link for the Citrix script or do I need to raise a support case with them? Thank you

You must open a Citrix case. IMO, the Mandiant script is superior to the Citrix script.

I was getting strange results with the Mandiant one. The version.sh was missing, then I was getting IOCs related to the ADM connecting to the ADCs

version.sh is an error i've seen others getting. try running their 1.1 (you can find it under the releases)

I amended the version.sh in the initial setup as it just needed a file. I will have a look to version 1.1. Citrix nowadays recommended also the Mandiant one . Thank you @Mads Petersen

With the mandiant make sure to read the log, even if the output doesn't mention anything. Also running the newest is best of course, because we saw some regex errors in one of the earlier, where it trigged on nobody running /bin/ht (and not /bin/httpd as expected) but looking at the NS showed no process of /bin/ht

I was reading the logs and it was flagging connections from ADM

yeah, just be mindful of stuff that seems our of the ordinary

thanks again @Mads Petersen v1.2 works fine, still with some false positives but much better