Shout out to @_splitline_ and @cfreal_ for their prior work that enabled this research.

Indicators of Compromise: 🔹 Depending on logging configurations, log entries in ns.log with non-printable characters are a pretty good indicator that something is amiss. 🔹 The Citrix advisory recommends terminating existing ICA and PCoIP sessions, which leads us to believe that endpoints related to those features are being targeted. Entries for those logs may similarly contain contents of leaked memory, which may or may not include session tokens. 🔹 Auditing active sessions is also recommended. As an example, a single session being used from multiple client IP addresses could be an indicator that the session may have been compromised. Active sessions for NetScaler Gateway can be found in the WebUI via “NetScaler Gateway -> Active User Sessions -> Select applicable context -> Continue” Session information can also be viewed on the command line by running commands such as “show sessions” or “show <service> session”