MAR-10478915-1.v1 Citrix Bleed

  

<

table class=”tablesaw tablesaw-stack” id=”cma-table”>

Notification

This report is provided “as is” for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:CLEAR–Recipients may share this information without restriction. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp.

Summary

Description

Responding to the recently disclosed CVE-2023-4966, affecting Citrix NetScaler ADC and NetScaler Gateway appliances, CISA received four files for analysis that show files being used to save registry hives, dump the Local Security Authority Subsystem Service (LSASS) process memory to disk, and attempts to establish sessions via Windows Remote Management (WinRM). The files include:

• Windows Batch file (.bat)
• Windows Executable (.exe)
• Windows Dynamic Link Library (.dll)
• Python Script (.py)

Download the PDF version of this report:

For a downloadable copy of IOCs associated with this MAR in JSON format, see:

Submitted Files (4)

17a27b1759f10d1f6f1f51a11c0efea550e2075c2c394259af4d3f855bbcc994 (a.dll)

906602ea3c887af67bcb4531bbbb459d7c24a2efcb866bcb1e3b028a51f12ae6 (a.py)

98e79f95cf8de8ace88bf223421db5dce303b112152d66ffdf27ebdfcdf967e9 (a.bat)

e557e1440e394537cca71ed3d61372106c3c70eb6ef9

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.