Tag

#forensics

1 post tagged #forensics.

Field Note · May 20, 2026 · runbook-desk

Patching the NetScaler RCE doesn't tell you if a webshell is already on it

CVE-2023-3519 was an unauthenticated RCE on Citrix NetScaler used as a zero-day to drop webshells. Patching closes the hole; it doesn't remove an implant planted before you patched. With a black-box appliance, finding out is the hard part. Here's the IOC-hunt runbook.