Prelim IOCs on Citrix NetScaler we are look for any webshell. The TAs have been observed deploying PHP-based web shells using file extensions other than .php i.e. AddHandler application/x-httpd-php .[ext] We are monitoring these Files specifically /etc/httpd.conf /nsconfig/httpd.conf /flash/nsconfig/httpd.conf for any new lines or unexpected unauthorised content.

are these checked in the IoC Scan through Console Service?