Règles YARA avec le tag CVE_2023_3519

Detects SECRETSAUCE PHP webshells (found after an exploitation of Citrix NetScaler ADC CVE-2023-3519)

Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519

Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519

This YARA rule detects forensic artifacts that appear following an attempted exploitation of Citrix NetScaler ADC CVE-2023-3519. The rule identifies an attempt to access the vulnerable function using an overly long URL, a potential sign of attempted exploitation. However, it does not confirm whether such an attempt was successful.