Anyone re-ran IOC scans? I am seeing potentially compromised messaged even though we updated when the firmware came out and IOC was clear as of Sunday

I am seeing messages in the log file archives that are false tagging as compromise.

oh yea?

Seeing Light Node Limited VPS trying to login to the netscalers as pitboss. That is what is being logged.

also seeing messages regarding pitboss

Yup. that is part of the attack. If you are patched this won't work. But it is a good way to find IP addresses to block outright.

is this what you are seeing?

Yup. So without the patch, having that in the log could cause code execution. After the patch, it just is in the logs.

ok I wonder why Citrix shows this in IOC....

nslookup attempts?

Yeah, if you look at the pitboss user you will see the command they are looking to execute. Some security vendors are scanning for unpatched gear by sending an nslookup in the payload to a custom url, and then when that custom url is checked they know exactly who are not patched yet.

will that trigger IOC?

Yup

the attempt I mean

So do we know if those show up in the logs AFTER the patch, we are ok, but if it was before the patch, no bueno?

Yup.

lovely, seeing tons of chatter about this because now the IOC is coming back with compromise few days later

This has been protecting my lab pretty well, no compromises yet. github.com/jeffriechers/Random-Powershell-Scripts/…/NetScalerVPNandVPSblocking

Hey also seeing Pitboss on IOC on previously clear Netscalers - did the IOC script change or did they make it through anyway?

If you are patched you are fine. These are just bots and testers probing available NetScalers for vulnerabilities. Use these items to block the IP from accessing anything in your organization.

Thanks Jeff, going to get the client going on a case with Citrix just in case

Sounds like there is a new IOC scanner available that is getting rid of some false positives

Anyone know how to get the newer script? it shows "available" in the IOC tab, but can't seem to GET IT.

I just ran another scan and it updated automatically.