Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195

Description

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Query · sigma

selection1:
  cs-uri-query|contains: /rapi/filedownload?filter=path:%2F
selection2:
  cs-uri-query|contains|all:
  - /pcidss/report
  - type=all_signatures
  - sig_name=_default_signature_
condition: 1 of selection*

Known false positives

  • Unknown
Raw source Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195
id: 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7
status: test
description: Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195
references:
    - https://support.citrix.com/article/CTX276688
    - https://research.nccgroup.com/2020/07/10/rift-citrix-adc-vulnerabilities-cve-2020-8193-cve-2020-8195-and-cve-2020-8196-intelligence/
    - https://dmaasland.github.io/posts/citrix.html
author: Florian Roth (Nextron Systems)
date: 2020-07-10
modified: 2023-01-02
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2020-8193
    - cve.2020-8195
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection1:
        cs-uri-query|contains: '/rapi/filedownload?filter=path:%2F'
    selection2:
        cs-uri-query|contains|all:
            - '/pcidss/report'
            - 'type=all_signatures'
            - 'sig_name=_default_signature_'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: critical

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.