Saltar al contenido
yararules.org
Menú

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_LOG_EXPL_Citrix_Netscaler_ADC_Exploitation_Attempt_CVE_2023_3519_Jul23_1

This YARA rule detects forensic artifacts that appear following an attempted exploitation of Citrix NetScaler ADC CVE-2023-3519. The rule identifies an attempt to access the vulnerable function using an overly long URL, a potential sign of attempted exploitation. However, it does not confirm whether such an attempt was successful.

ExploitSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compila con YARA-X
Autor
Florian Roth
Fecha
2023-07-27
Modificada
2023-12-05
Puntuación / Calidad
65 / 85

Qué detecta esta regla

This YARA rule detects forensic artifacts that appear following an attempted exploitation of Citrix NetScaler ADC CVE-2023-3519. The rule identifies an attempt to access the vulnerable function using an overly long URL, a potential sign of attempted exploitation. However, it does not confirm whether such an attempt was successful.

Define 2 patrones (1 de texto, 0 hex, 1 regex).

Resumen generado a partir de los metadatos y la condición de la regla.

Código de la regla

Descargar .yar
log-expl-citrix-netscaler-adc-exploitation-attempt-cve-2023-3519-jul23-1.yarDetection Rule License 1.1
rule SIGNATURE_BASE_LOG_EXPL_Citrix_Netscaler_ADC_Exploitation_Attempt_CVE_2023_3519_Jul23_1 : CVE_2023_3519
{
	meta:
		description = "This YARA rule detects forensic artifacts that appear following an attempted exploitation of Citrix NetScaler ADC CVE-2023-3519. The rule identifies an attempt to access the vulnerable function using an overly long URL, a potential sign of attempted exploitation. However, it does not confirm whether such an attempt was successful."
		author = "Florian Roth"
		id = "7dfe4130-d976-5d6d-a05d-ccadefe45406"
		date = "2023-07-27"
		modified = "2023-12-05"
		reference = "https://blog.assetnote.io/2023/07/24/citrix-rce-part-2-cve-2023-3519/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L63-L77"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "7ad3164c5b2616b12a513a2bb3736d530769e75fca03346a72351a27b8343b2a"
		score = 65
		quality = 85
		tags = "CVE-2023-3519"

	strings:
		$sr1 = /GWTEST FORMS SSO: Parse=0; URLLEN=([2-9][0-9]{2}|[0-9]{4,20}); Event: start=0x/
		$s1 = ", type=1; Target: start=0x"

	condition:
		all of them
}

Cadenas (2 patrones)

IdentificadorTipoValorModificadores
$sr1regex/GWTEST FORMS SSO: Parse=0; URLLEN=([2-9][0-9]{2}|[0-9]{4,20}); Event: start=0x/
$s1texto", type=1; Target: start=0x"

Condición

all of them

En palabras sencillas (Heurística)

  • Deben coincidir todos los patrones de la regla.

Prueba esta regla en tu navegador

Arrastra un archivo para escanearlo con esta regla usando YARA-X compilado a WebAssembly. No se sube nada.

Arrastra un archivo aquí o haz clic para elegirSe escanea en local con YARA-X. Archivos de hasta 200 MB.

Abrir en el editor

Referencias

Licencia y atribución

Autor: Florian Roth

Repositorio de origen: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licencia: Detection Rule License 1.1 (licencia del repositorio)

Regla original

Obtenida a través de YARA Forge 20260927, que añade a los nombres el prefijo de la fuente y campos meta normalizados.

Id de la regla: 7dfe4130-d976-5d6d-a05d-ccadefe45406

Etiquetas:CVE_2023_3519

Reglas relacionadas