false positives may be present based on organization use of saml utilities. filter, or restrict the analytic to citrix devices only.

Techniques

T1190

Sample rules

Citrix ADC Exploitation CVE-2023-3519

source: splunk
technicques:
- T1190

Description

The following analytic identifies potential exploitation attempts against Citrix ADC related to CVE-2023-3519. It detects POST requests to specific web endpoints associated with this vulnerability by leveraging the Web datamodel. This activity is significant as CVE-2023-3519 involves a SAML processing overflow issue that can lead to memory corruption, posing a high risk. If confirmed malicious, attackers could exploit this to execute arbitrary code, escalate privileges, or disrupt services, making it crucial for SOC analysts to monitor and investigate these alerts promptly.

Detection logic


| tstats `security_content_summariesonly`
         count min(_time) as firstTime
               max(_time) as lastTime
FROM datamodel=Web WHERE

Web.http_method=POST
Web.url IN (
    "*/cgi/logout",
    "*/saml/activelogin",
    "*/saml/login",
    "/cgi/samlart?samlart=*",
    "/cgi/samlauth",
    "/gwtest/formssso?event=start&target=*",
    "/netscaler/ns_gui/vpn/*"
)
BY Web.http_user_agent, Web.status
   Web.http_method Web.url Web.url_length
   Web.src Web.dest

| `drop_dm_object_name("Web")`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `citrix_adc_exploitation_cve_2023_3519_filter`