Detect Exploitation Attempts on Citrix, Fortinet, Ivanti

This guide helps security analysts and IT administrators spot signs of exploitation attempts against Citrix, Fortinet, and Ivanti devices by examining logs. You’ll learn which log sources to check, what patterns to look for, and how to confirm suspicious activity. Before you begin, ensure you have access to your device logs and a basic understanding of log analysis.

What You’ll Need

• Access to device logs (via console, SSH, or a SIEM platform).
• A way to search and filter logs (grep, Splunk, ELK, or similar).
• Knowledge of your device’s normal traffic baseline.
• Current threat intelligence or CVE details for Citrix, Fortinet, and Ivanti products.

Step-by-Step

1. Identify your log sources. For Citrix ADC/NetScaler, logs are in /var/log/ns.log and /var/log/nsvpn.log. For Fortinet FortiGate, check eventlog and attacklog via CLI or FortiAnalyzer. For Ivanti (Pulse Secure, Connect Secure), logs are in /var/log/dsaccess.log and /var/log/access.log. Make sure logging is enabled and time-synced (NTP).
2. Look for known CVE indicators. Search for specific exploit patterns. For Citrix CVE-2023-4966 (Citrix Bleed), look for unusual memory access or repeated POST requests to /vpn/../vpns/ with long strings. For Fortinet CVE-2024-21762 (SSL VPN), look for malformed HTTP headers or requests to /remote/login with unusual content. For Ivanti CVE-2024-21887, look for command injection attempts in the web interface, such as | or ; in parameters.
3. Monitor authentication logs. Exploitation often precedes or follows credential abuse. In Citrix logs, look for repeated failed logins followed by success from the same IP. In Fortinet, check for auth_fail and auth_success events. In Ivanti, look for login failed then login succeeded patterns. Pay special attention to accounts with admin privileges.
4. Check for unusual HTTP requests. Use grep to find requests with suspicious payloads. For Citrix, search for POST /vpn/ with URL-encoded characters. For Fortinet, look for GET /remote/ with long query strings. For Ivanti, search for GET /dana-na/ with ../ or command separators. Log entries may show 4xx or 5xx status codes, but successful exploits return 200.
5. Examine system log entries for anomalies. Look for unexpected process starts, file writes, or configuration changes. In Citrix, check ns.log for nsconfig changes. In Fortinet, look for config change events. In Ivanti, check dsaccess.log for admin login from unusual IPs or at odd hours.
6. Correlate with outbound connections. After exploitation, attackers often make outbound connections. Check firewall logs for connections from the device to external IPs on non-standard ports (e.g., 4444, 8080, 8443). For Citrix, look for TCP connections initiated by the device. For Fortinet, use get log traffic to see outbound sessions. For Ivanti, check access.log for connect entries to unusual destinations.
7. Use threat intelligence feeds. Compare suspicious IPs and hashes with known IOC lists. Many vendors provide free feeds. If an IP matches a known malicious source, it’s a strong indicator. Also, check if the exploit attempts match recent CVE details from NVD or vendor advisories.
8. Set up alerts for these patterns. The goal is to detect in real time. Create SIEM alerts for the specific log signatures you’ve identified. For example, alert on Citrix ns.log entries containing HTTP/1.1" 200 with a body length over 1000 bytes to /vpn/. For Fortinet, alert on attacklog entries with severity high. For Ivanti, alert on dsaccess.log entries with cmd in the URL.

Common Mistakes

• Ignoring false positives. Not every odd log entry is an exploit. Legitimate admin activity can trigger patterns. Always verify with context.
• Only looking at one log type. Exploitation often spans multiple logs. Check both access logs and system logs.
• Forgetting time zones. Logs from different devices may be in different time zones. Normalize to UTC for correlation.
• Overlooking encrypted traffic. Many exploits use HTTPS. You may need to enable SSL inspection on FortiGate or use Citrix’s native logging to see decrypted content.
• Not updating signatures. If you use IDS/IPS, ensure signatures are current. Old signatures miss new CVEs.

Tips

• Use grep with extended regex. For example: grep -E "(POST|GET).*(\\.\\./|;|\|)" /var/log/ns.log to find path traversal or command injection.
• Create baselines. Understand what normal traffic looks like. Use tools like netflow or SIEM to profile typical requests.
• Enable verbose logging. On Citrix, set ns.log to debug level temporarily. On Fortinet, use diagnose debug application. On Ivanti, enable debug in dsaccess.conf.
• Check for webshells. After exploitation, attackers may upload files. Look for unexpected files in web directories like /var/tmp or /tmp on the device.
• Use vendor-specific tools. Citrix has nsconmsg for log analysis. Fortinet has fortiview. Ivanti has dslog.

Troubleshooting

If you’re not finding anything but suspect an exploit, try these steps:

• Check if logging is actually working. Generate a test event (like a failed login) and see if it appears in the log. If not, logging may be disabled or misconfigured.
• Increase log verbosity. As mentioned, enable debug logging temporarily. This can reveal hidden attempts.
• Look at network captures. Use tcpdump or Wireshark on the device’s network interface. Filter for traffic to/from the device on ports 443, 8443, etc. You may see exploit payloads that logs don’t capture.
• Check for log tampering. Attackers may delete or alter logs. Check file integrity (e.g., ls -la on log directories) and look for gaps in timestamps.
• Consult vendor advisories and community forums. Sometimes the exploit pattern is not well-known. Search for the specific CVE and your device model to find known indicators.

Frequently Asked Questions

What are the most common CVEs for these devices?

Recent ones include Citrix Bleed (CVE-2023-4966), Fortinet SSL VPN (CVE-2024-21762), and Ivanti Connect Secure (CVE-2024-21887). Always check the latest vendor advisories.

Can I detect exploitation without a SIEM?

Yes, you can use command-line tools like grep and awk on the device or a central log server. However, a SIEM makes correlation and alerting easier.

What should I do if I find an exploitation attempt?

Immediately isolate the device from the network, preserve logs, and follow your incident response plan. Notify your security team and consider contacting your vendor for support.

How often should I review these logs?

Ideally, set up real-time alerts. If that’s not possible, review logs daily, especially after new CVEs are announced.

Are there any automated tools to help?

Yes, many SIEMs have built-in correlation rules for these devices. Also, some open-source tools like Sigma rules can be used. But manual verification is still essential.

What if the logs are encrypted or compressed?

Use the device’s native log export tools or decrypt them if you have the keys. For Fortinet, you can use execute log display to view logs in plain text.

Related

• AWS S3 Commands: The Complete CLI Guide
• Office Tab Feature Demo: What It Does
• How to Merge Two iTunes Libraries