CVE-2019-19781
Live Response First Steps
=========================

Some tips on how to go about running a micro-compromise assessment on Netscaler boxes, this is what I've been using:

>>> Check the root user command history: history /1 >>> Check bash log files and sort by frequency, less frequent commands at the top: cat /var/log/bash.log | grep -Eio "shell_command=.*$" | sort | uniq -c | sort -n && zcat /var/log/bash*.gz | grep -Eio "shell_command=.*$" | sort | uniq -c | sort -n /2