EXPL_Citrix_Netscaler_ADC_ForensicArtifacts_CVE_2023_3519_Jul23

rule EXPL_Citrix_Netscaler_ADC_ForensicArtifacts_CVE_2023_3519_Jul23 {
   meta:
      description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
      author = "Florian Roth"
      reference = "https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf"
      date = "2023-07-18"
      modified = "2023-07-21"
      score = 70
      id = "07d725cc-2cf2-55e5-8609-486500547f13"
   strings:
      $sa1 = "216.41.162.172" ascii fullword

      $sb1 = "/flash/nsconfig/keys" ascii
      $sb2 = "ldapsearch" ascii fullword
      $sb3 = "ns_gui/vpn" ascii
      $sb4 = "LDAPTLS_REQCERT" ascii fullword
   condition:
      filesize < 10MB and $sa1
      or (
         filepath == "/var/log"
         and filename matches /^(bash|sh)\.log/
         and 1 of ($sb*)
      )
}