Sigma rule: Citrix Netscaler Attack CVE-2019-19781

Rule

Title

Citrix Netscaler Attack CVE-2019-19781

Status

test

Level

critical

Author

Arnim Rupp, Florian Roth

Date

2020-01-02

Modified

2023-01-02

File

rules-emerging-threats/2019/Exploits/CVE-2019-19781/web_cve_2019_19781_citrix_exploit.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects CVE-2019-19781 exploitation attempt against Citrix Netscaler, Application Delivery Controller and Citrix Gateway Attack

Log source

category

webserver

definition

Make sure that your Netscaler appliance logs all kinds of attacks (test with http://your-citrix-gw.net/robots.txt). The directory traversal with ../ might not be needed on certain cloud instances or for authenticated users, so we also check for direct paths. All scripts in portal/scripts are exploitable except logout.pl.

Detection

selection_cs:
    - cs-uri-query|contains: '/../vpns/'
    - cs-uri-query|endswith: '/vpns/cfg/smb.conf'
selection_csall:
    cs-uri-query|contains|all:
        - '/vpns/portal/scripts/'
        - '.pl'
condition: 1 of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.t1190
• cve.2019-19781
• detection.emerging-threats

CVEs this rule names

• CVE-2019-19781

MITRE ATT&CK ids this rule names

• T1190

References

• https://support.citrix.com/article/CTX267679
• https://support.citrix.com/article/CTX267027
• https://isc.sans.edu/diary/25686
• https://twitter.com/mpgn_x64/status/1216787131210829826
• https://github.com/x1sec/CVE-2019-19781/blob/25f7ab97275b2d41800bb3414dac8ca3a78af7e5/CVE-2019-19781-DFIR.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2019/Exploits/CVE-2019-19781/web_cve_2019_19781_citrix_exploit.yml