Sigma rule: CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-640182ed5288, updated 2023-11-28T00:00:00.000Z.
Rule
- Title
- CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver
- Status
- test
- Level
- high
- Author
- Nasreddine Bencherchali (Nextron Systems)
- Date
- 2023-11-28
- File
- rules-emerging-threats/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs by looking for a very long host header string.
Log source
- category
- webserver
Detection
selection:
cs-method: 'GET'
cs-uri-stem|contains: '/oauth/idp/.well-known/openid-configuration'
cs-host|re: '.{150}'
condition: selectionFalse positives (as the rule lists them)
- Vulnerability scanners
Tags
- attack.initial-access
- attack.t1190
- cve.2023-4966
- detection.emerging-threats
CVEs this rule names
MITRE ATT&CK ids this rule names
Related rules
- 87c83d8e-5390-44ce-aa4a-d3b37e54d0a0 (similar)
- ff349b81-617f-4af4-924f-dbe8ea9bab41 (similar)
- aee7681f-b53d-4594-a9de-ac51e6ad3362 (similar)
References
- https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
- https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966
- https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
- https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
- https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml
Sources and licences
SigmaHQ
"CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver" by Nasreddine Bencherchali (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver",
entity page, dataset version ref-640182ed5288, updated 2023-11-28T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/a4e068b5-e27c-4f21-85b3-e69e5a4f7ce1 (accessed 2026-11-03).
Underlying source: SigmaHQ rule a4e068b5-e27c-4f21-85b3-e69e5a4f7ce1, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.