@inversecos

I worked a case recently where unauthenticated threat actors were able to access and perform reconnaissance and session manipulation in Citrix via API requests. These threat actors proceeded to abuse single-sign-on (SSO) for access. As such, I wrote this blog post to highlight some of the things to be aware of when hunting through Citrix logs that can hopefully help some security analysts when they're performing their threat hunts / investigations. Please note, how and whether this works depends on your clients Citrix configuration and settings. The reason why this is interesting to someone in a blue team is because an unauthenticated attacker could potentially (depending on the Citrix configuration) do the following: Enumerate resources available to a user i.e. what hosts they have access to and what method Force sessions to last longer without signing the attacker out Detect what methods of authentication are utilised (5 documented) and if SSO is enabled Abuse SSO for access to r...