To investigate possible NetScaler exploitation, preserve appliance and remote logs first, then correlate any suspicious entries with filesystem changes, network and authentication activity, and the appliance’s configuration and software build. Treat an indicator of compromise as a lead—not proof on its own. CISA’s example indicators apply to its CVE-2023-3519 webshell investigation; they are not universal signatures for every NetScaler vulnerability.
Start by establishing what appliance and time period you are investigating
Before interpreting a log entry—or deciding that no relevant entry means the appliance is clean—record the system and the incident scope. This gives investigators the context needed to compare appliance records with network, identity, and endpoint telemetry.
As an Amazon Associate I earn from qualifying purchases.
- Record the appliance model and deployment type, including whether it is VPX, MPX, or SDX, and its exact software build.
- Document relevant Gateway, AAA, VPN, and other exposed configurations; management reachability; and any HA or cluster relationships.
- Identify the suspected vulnerability or event that triggered the investigation. Record the suspected exploitation window and preserve a wider surrounding period where available.
- Record the appliance’s system time, timezone, and NTP configuration before isolation. Use this information to align timestamps with external logs.
Citrix’s guidance for a suspected-compromise investigation calls for preserving appliance logs as well as remote syslog and NetScaler Console records. Remote copies matter because local evidence may be incomplete or unavailable.
Preserve evidence before changing the appliance
Containment and recovery can alter system state or remove evidence. Coordinate evidence collection with the incident-response team and any legal-preservation requirements before making changes that could affect the investigation.
#1 Best Overall
Collect logs and a support bundle
Preserve available local NetScaler logs, remote syslog records, and NetScaler Console records. Citrix recommends collecting a technical support bundle, which can retain configuration, running-process information, and related data useful to an investigation.
Choose preservation actions with operational effects in mind
- VPX: Citrix recommends taking a snapshot for forensic analysis.
- Packet Engine core file: Citrix describes this as an option, but creating one causes a warm restart and disconnects SSH. Coordinate the action with incident responders and the operational plan before proceeding.
- MPX or SDX: Citrix points to hardware incident-response processes that may include preserving memory, powering down, and making a bit-for-bit disk image with a write blocker. Its guidance also describes retaining two copies and documenting chain of custody.
These actions are not interchangeable, and not every collection method is appropriate for every incident. Follow the organization’s forensic process and account for service impact before selecting a method.
Inspect NetScaler logs and filesystem evidence
For its July 2023 AA23-201A advisory on CVE-2023-3519, CISA recommends reviewing NetScaler internal shell logs, including sh.log* and bash.log*, for suspicious activity. The advisory gives the following example search strings:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →database.phpns_gui/vpn/flash/nsconfig/keys/updatedLDAPTLS_REQCERTldapsearchopenssl + salt
These are investigation leads from a specific webshell case, not a complete signature set. A match needs context: establish when and where it appeared, what process or request was associated with it, and whether the activity fits the appliance’s normal operation.
Review web access and error records
- In
httpaccess-vpn.log*, investigate successful HTTP 200 responses for unknown or unexpected web resources. - Review HTTP error logs for unusual requests involving
.shor.phpresources.
Preserve relevant log entries and associated files with their metadata for forensic review. A successful response or suspicious request is not, by itself, proof that code was implanted or executed.
Check for filesystem changes
Look for unexpected filesystem changes, recently created files, and root-owned setuid binaries that are not part of the expected appliance state. Retain potentially relevant files and metadata rather than deleting or modifying them during initial triage.
Rank #3
Correlate appliance findings with other telemetry
A finding becomes more useful when it can be aligned with events elsewhere in the environment. Build a timeline using timestamps, source and destination addresses, identities, and observed baseline behavior.
Recommended Free Tools
| Evidence source | What to examine | How to interpret it |
|---|---|---|
| Network and firewall | Scanning over HTTP, HTTPS, or SMB originating from the ADC; repeated connections to a suspected webshell; and unusually large outbound transfers over short periods. | Check whether the traffic is expected for this appliance and whether it aligns with suspicious appliance activity. |
| DNS | Unexpected lookups for internal computer names. | Compare names, timing, and query patterns with normal appliance behavior. |
| Directory and authentication | Spikes in AD, LDAP, or LDAPS traffic; AD logons from the ADC address using its configured directory account; and, where applicable, Windows event 4625 with failure reason “User not allowed to logon at this computer.” | Check the identity, source, time, and expected use of the configured account. CISA specifically calls out the cited 4625 failure reason in its CVE-2023-3519 advisory. |
| Sessions and connected systems | Per-source connection or session counts, activity involving suspected webshell resources, and events on systems the ADC contacted. | Compare with normal usage and investigate related events on authentication servers, sensitive systems, web tiers, and management jump hosts. |
Unexpected activity in one source is a clue to investigate, not an independent verdict. Correlation can strengthen or weaken a compromise hypothesis; it should not be replaced by a single matching string, event, or traffic spike.
Decide when to contain and expand the investigation
If the available evidence makes compromise credible, Citrix advises removing the suspected appliance from the network to prevent further unauthorized access. Plan the isolation with responders so it does not inadvertently destroy evidence or create avoidable operational risk.
Rank #4
Investigate systems the ADC connected to, especially authentication servers, sensitive systems, web tiers, and management jump hosts. Review whether accounts or secrets available to the appliance may have been exposed.
- Change service-account passwords and secrets stored on the appliance on their respective systems. Examples include relevant LDAP credentials, RADIUS shared secrets, OAuth tokens, API keys, and SNMP community names.
- Change accounts that may have authenticated through the suspected Gateway or AAA virtual server.
- Revoke certificates and private keys stored on the device, and plan for replacement during recovery.
Recover from a suspected compromise using a clean basis
Citrix’s response guidance recommends rebuilding or replacing the appliance, upgrading to the latest available firmware before restoring configuration, and restoring only a known-good backup that predates the compromise. A backup’s existence does not establish that it is safe to restore; verify its date and provenance against the suspected incident window.
After restoration, change local appliance passwords, rotate key-encryption keys, and replace revoked certificates. Harden the rebuilt appliance and monitor it closely for at least 90 days, as Citrix recommends. Its guidance also says management services should never be exposed to the public internet. If law-enforcement involvement is anticipated or required, coordinate evidence and legal-preservation needs before rebuilding.
Best Value
- Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment, 2nd Edition
- ABIS BOOK
- Packt Publishing
Keep conclusions specific to the CVE and build
Do not combine one vulnerability’s indicators, prerequisites, or fixed versions with another’s. CISA’s AA23-201A procedures concern CVE-2023-3519 and webshell implantation. The Citrix bulletin for CVE-2023-4966 describes sensitive information disclosure in Gateway or AAA configurations and reports exploitation on unmitigated appliances. The CVE-2025-5777 bulletin describes an input-validation issue leading to memory overread and states a Gateway or AAA configuration precondition.
Citrix’s CVE-2025-5777 guidance lists release floors for that bulletin and recommends terminating active ICA and PCoIP sessions after upgrading all appliances in the HA pair or cluster to fixed builds. Those version and response details apply to that advisory, not to every incident. Confirm the current bulletin, exact appliance build, configuration, and any related advisories before drawing a version-specific conclusion or planning remediation. The relevant Citrix bulletin’s changelog includes entries through July 2026.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
