The campaign reportdropped this morning.Your detection can be live by lunch.

Mars turns threat intel into validated detection logic in your SIEM’s native query language. In minutes. You review it and ship it.

How it works

A real advisory, walked through the pipeline. From published intel to a validated detection in your SIEM.

Threat Intel·Oct 5, 2026

Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation

High-severity (CVSS 8.7) memory overflow in NetScaler ADC & Gateway SAML SP/IdP configs. Active exploitation confirmed; added to CISA KEV catalog.

Extract

TTPs pulled from threat intel as it’s published.

In this advisory

Memory overflow triggered via crafted SAML assertions targeting NetScaler ADC / Gateway SP & IdP endpoints. Indicator: anomalous crashes of the authentication daemon following oversized SAML requests.

Translate

Detection logic written in your SIEM’s native query language.

In this advisory

A query watches NetScaler auth-daemon crash events correlated with oversized SAML request payloads to the /saml/login endpoint, scoped to internet-facing VIPs.

index=netscaler
 source=*auth*
 (action crashed OR
  event_id=CRASH)
 (saml OR "/saml/login")
 dest_ip IN (internet_vips)
 | stats count by
   dest_ip, src_ip,
   saml_assertion_size

Validate

Tested before you see it, tuned after it ships.

In this advisory

Replay of the published PoC payload confirms the crash signature fires. Benign SAML traffic sampled to tune false positives. Shipped with MITRE ATT&CK mapping: T1499 (Endpoint DoS).

Intel published at 09:00. Detection live before lunch.

Hunts are built from real attacker campaigns, not alert patterns. Connects by API to the tools you already run. No data ingestion.

Proof

Minutes

from intel to deployed detection

campaigns mapped to your environment monthly

Up to 0x

MITRE ATT&CK coverage expansion