SigmaHQ/rules/web/web_citrix_cve_2020_8193_8195_exploit.yml

title: Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195
description: Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195
id: 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7
author: Florian Roth
status: experimental
date: 2020/07/10
modified: 2021/08/09
references:
    - https://support.citrix.com/article/CTX276688
    - https://research.nccgroup.com/2020/07/10/rift-citrix-adc-vulnerabilities-cve-2020-8193-cve-2020-8195-and-cve-2020-8196-intelligence/
    - https://dmaasland.github.io/posts/citrix.html
logsource:
    category: webserver
detection:
    selection1:
        c-uri|contains: '/rapi/filedownload?filter=path:%2F'
    selection2:
        c-uri|contains|all:
            - '/pcidss/report'
            - 'type=all_signatures'
            - 'sig_name=_default_signature_'
    condition: 1 of them
fields:
    - client_ip
    - vhost
    - url
    - response
falsepositives:
    - Unknown
level: critical
tags:
    - attack.initial_access
    - attack.t1190
rule: better rule name and descriptions, plus MITRE ATT&CK tags 2020-07-10 15:55:13 +00:00			`title: Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195`
			`description: Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195`
rule: Citrix Netscaler Attack CVE-2020-8193 CVE-2020-8195 2020-07-10 15:45:11 +00:00			`id: 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7`
Second round 2020-09-15 13:02:30 +00:00			`author: Florian Roth`
			`status: experimental`
			`date: 2020/07/10`
$frack113$ Split PR 1802 fix net rules 2021-08-09 15:23:15 +00:00			`modified: 2021/08/09`
rule: Citrix Netscaler Attack CVE-2020-8193 CVE-2020-8195 2020-07-10 15:45:11 +00:00			`references:`
			`- https://support.citrix.com/article/CTX276688`
			`- https://research.nccgroup.com/2020/07/10/rift-citrix-adc-vulnerabilities-cve-2020-8193-cve-2020-8195-and-cve-2020-8196-intelligence/`
rule: updated Citrix rule 2020-07-10 15:49:07 +00:00			`- https://dmaasland.github.io/posts/citrix.html`
rule: Citrix Netscaler Attack CVE-2020-8193 CVE-2020-8195 2020-07-10 15:45:11 +00:00			`logsource:`
			`category: webserver`
			`detection:`
rule: improved Citrix rule 2020-07-10 16:15:35 +00:00			`selection1:`
$frack113$ Split PR 1802 fix net rules 2021-08-09 15:23:15 +00:00			`c-uri\|contains: '/rapi/filedownload?filter=path:%2F'`
rule: improved Citrix rule 2020-07-10 16:15:35 +00:00			`selection2:`
			`c-uri\|contains\|all:`
			`- '/pcidss/report'`
			`- 'type=all_signatures'`
			`- 'sig_name=_default_signature_'`
			`condition: 1 of them`
rule: Citrix Netscaler Attack CVE-2020-8193 CVE-2020-8195 2020-07-10 15:45:11 +00:00			`fields:`
			`- client_ip`
			`- vhost`
			`- url`
			`- response`
			`falsepositives:`
			`- Unknown`
			`level: critical`
Second round 2020-09-15 13:02:30 +00:00			`tags:`
			`- attack.initial_access`
			`- attack.t1190`