Emerging Threats
CVE2023

CVE-2023-4966

4Rules
5References
1Folders
2023-11-28Latest
Summary

CVE-2023-4966 is tracked here through 4 Sigma detections for exploitation attempts and related post-exploitation behavior observed in 2023. Coverage centers on proxy, webserver.

Related Detections
Search this threat
Emerging Threathightest

CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs by looking for a very long host header string.

Proxy Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2023-4966detection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Tue Nov 282023
Emerging Threathightest

CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs by looking for a very long host header string.

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2023-4966detection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Tue Nov 282023
Emerging Threatmediumtest

CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs.

Proxy Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2023-4966detection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)+1Tue Nov 282023
Emerging Threatmediumtest

CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs.

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2023-4966detection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)+1Tue Nov 282023
References