Threat actors exploit Citrix CVE-2023-3519 for webshell implant
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Unauthenticated RCE in NetScaler ADC/Gateway enables webshell deployment and Active Directory harvesting; actively exploited.
CVE-2023-3519 is an unauthenticated remote code execution vulnerability in Citrix NetScaler ADC and NetScaler Gateway versions 13.1 (before 13.1-49.13), 13.0 (before 13.0-91.13), 12.1 (end-of-life), and FIPS variants. The vulnerability requires the appliance to be configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server for exploitation. Threat actors have exploited this as a zero-day and in active campaigns to upload webshells and establish persistent access.
Observed attacker behavior includes uploading TGZ files containing webshells (generic PHP shells, SECRETSAUCE, loading.php, defaults.php), discovery scripts, and setuid binaries. After gaining access, actors perform Active Directory enumeration via ldapsearch queries (users, computers, groups, trusts, subnets, organizational units), extract and exfiltrate AD data encrypted with openssl, and attempt lateral movement to domain controllers. A second victim saw actors deploy pykeygen and pip4 ELF binaries to gain root shell access. Additional observed tools include LIGOLO-NG and NPS tunnellers for C2 proxying, libnsd.so for SSH credential capture, and ADExplorer for AD manipulation. Actors modify rc.netscaler for persistence, delete logs and artifacts post-exploitation, and use compromised pfSense devices for multi-hop C2.
Network segmentation blocked lateral movement in observed cases, but credential harvesting and data exfiltration succeeded. Citrix released patches on July 18, 2023. CISA added the CVE to its Known Exploited Vulnerabilities Catalog on July 19, 2023.
Mentioned in this report
Detection guidance
LDAP Enumeration of AD Objects via ldapsearch on Linux/Appliance
ldapsearch run with queries for domain trusts, computers, subnets, OUs or groups, as seen in post-exploitation AD enumeration from a compromised Citrix NetScaler. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LDAP Enumeration of AD Objects via ldapsearch on Linux/Appliance
id: 13b2a53b-cf5b-5253-a7ea-3c9570152a7d
status: experimental
description: Detects ldapsearch executed with filters for trusts, computers, subnets,
organizational units or groups. This matches the AD enumeration (users, computers,
groups, trusts, subnets, OUs) performed from compromised NetScaler/Linux edge appliances
after CVE-2023-3519 exploitation. Generalises on the tool plus the query object
classes, not on specific hosts or DNs.
tags:
- attack.discovery
- attack.t1482
- attack.t1069.002
- attack.t1018
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /ldapsearch
selection_query:
CommandLine|contains:
- trustedDomain
- objectClass=computer
- objectCategory=computer
- objectClass=subnet
- objectCategory=subnet
- organizationalUnit
- objectClass=group
- objectCategory=group
condition: selection_img and selection_query
falsepositives:
- Linux administrators or inventory scripts querying AD from a management host
- Identity management sync tooling that uses ldapsearch
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a
Openssl Symmetric Encryption of Staged Data via Command Line
openssl enc invoked with a cipher/salt/pbkdf2 option to encrypt archived data prior to exfiltration, as seen with AD data encrypted on compromised NetScaler appliances. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Openssl Symmetric Encryption of Staged Data via Command Line
id: b6175028-730e-5e8c-8f5d-956a474bd234
status: experimental
description: Detects openssl enc used with a symmetric cipher, salt or pbkdf2 options
to encrypt files from the command line. Threat actors exploiting CVE-2023-3519 encrypted
extracted AD data with openssl before exfiltration. Most useful on edge appliances
and servers that do not normally run ad-hoc openssl encryption.
tags:
- attack.collection
- attack.t1560.001
- attack.t1074.001
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /openssl
selection_enc:
CommandLine|contains: ' enc '
selection_opts:
CommandLine|contains:
- ' -aes'
- ' -des'
- ' -salt'
- ' -pbkdf2'
- ' -camellia'
condition: selection_img and selection_enc and selection_opts
falsepositives:
- Backup or secrets-management scripts that encrypt files with openssl enc
- Administrators manually encrypting files for transfer
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a
Modification of rc.netscaler for Persistence
Shell commands that write to or edit rc.netscaler, the NetScaler boot script, to persist implants across reboots. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Modification of rc.netscaler for Persistence
id: 7f8b0aaa-e080-5e84-a78e-d14e5f774932
status: experimental
description: Detects shell commands that append to, overwrite or edit rc.netscaler,
which executes at NetScaler boot. Actors exploiting CVE-2023-3519 modified this
file for persistence. Generalises on the file being written by a command, not the
payload added.
tags:
- attack.persistence
- attack.t1547
logsource:
category: process_creation
product: linux
detection:
selection_file:
CommandLine|contains: rc.netscaler
selection_write:
CommandLine|contains:
- '>'
- sed -i
- 'tee '
- 'cp '
- 'mv '
- 'echo '
condition: selection_file and selection_write
falsepositives:
- Citrix administrators intentionally adding custom startup commands to rc.netscaler
- Appliance upgrade or configuration-management scripts that rewrite rc.netscaler
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs