This message was deleted.
# citrix-netscalers
Slackbot
11/02/2023, 9:31 AMThis message was deleted.
c
c4rm0
11/02/2023, 9:45 AMI would personally wait for a IOC tool from Citrix if they will release one
m
Michiel Roos
11/02/2023, 9:59 AMAccording to the description an attack takes over an existing session but does not modify anything on the Netscaler itself, so I would think an IOC tool from Citrix would almost have to work the same way as this script?
m
Mads Petersen
11/02/2023, 12:03 PMHow would they be able to release an IoC script, there wont be logged anything that is flagged, you have to manually compare the logins with the source IP, hopefully you have another logging tool than the ns.log file, that can help you find superman symptoms in logins.
c
CTXMike
11/02/2023, 2:58 PMRespectfully, y'all could just look at the script and see what it's looking for instead of guessing. IOCs aren't just "files with bad signatures" - it's checking the logs and looking for things that shouldn't happen which are, by definition, potential IOCs.
CTXMike
11/02/2023, 3:00 PMConnection stat messages without corresponding login entries, reconnects from different ASNs, clients with excessive logins, reconnects to logged-out sessions, from a quick glance.
2 Views