title: Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195
description: Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195
id: 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7
author: Florian Roth
status: experimental
date: 2020/07/10
references:
    - https://support.citrix.com/article/CTX276688
    - https://research.nccgroup.com/2020/07/10/rift-citrix-adc-vulnerabilities-cve-2020-8193-cve-2020-8195-and-cve-2020-8196-intelligence/
    - https://dmaasland.github.io/posts/citrix.html
logsource:
    category: webserver
detection:
    selection1:
        c-uri|contains: 
            - '/rapi/filedownload?filter=path:%2F'
    selection2:
        c-uri|contains|all:
            - '/pcidss/report'
            - 'type=all_signatures'
            - 'sig_name=_default_signature_'
    condition: 1 of them
fields:
    - client_ip
    - vhost
    - url
    - response
falsepositives:
    - Unknown
level: critical
tags:
    - attack.initial_access
    - attack.t1190