Portal/UI checks (tiny backdoors, exfil patterns) and live-host triage

[lbuiter]

Hoi @NCSC-NL-Sebastiaan @ncsc-nl-ralph @ncsc-nl-pepijn ,

I’ve published a triage extension for citrix-2025 focused on:

• Portal persistence (themes, plugins, UI-layer injections)
• JS-based exfil indicators (sendBeacon, fetch, etc.)
• Tiny stealth webshells and timestamp anomalies

It’s structured to align with your existing YAML/Python architecture and is purely additive.

While I haven’t been able to run full tests on a live NetScaler instance, the logic follows the same patterns as your existing modules and aims to improve post-exploit detection in the portal surface.

• Fork/branch for review: https://github.com/lbuiter/citrix-2025/tree/feature/portal-ui-triage

Happy to adapt or collaborate further if useful.

Kind regards,

[ncsc-nl-pepijn]

Hi @lbuiter, thanks for the additions! Could you open two separate PRs with these changes? One for the disk-image-checks and one for the live-host-bash-check? This will allow us to review more easily.

[lbuiter]

Thanks, I’ve split the changes into two separate PRs (#14 and #15) as suggested. Happy to adapt further if needed.