Citrix updates causing IDR events

InsightIDR
1

Everytime Citrix is installed or updated it is causing IDR alerts for Suspicious Process - TaskKill Multiple Times. These are false positive alerts.

"process": {
"start_time": "2026-09-18T15:36:44.952Z",
"name": "cmd.exe",
"pid": 1052,
"exe_path": "C:\Windows\SysWOW64\cmd.exe",
"working_dir": "C:\WINDOWS\SysWOW64\",
"cmd_line": ""C:\WINDOWS\SysWOW64\cmd.exe" /c "C:\WINDOWS\SysWOW64\taskkill.exe" /f /im nglauncher.exe 2>nul & "C:\WINDOWS\SysWOW64\taskkill.exe" /f /im nsepa.exe 2>nul & rd /s /q "C:\WINDOWS\system32\config\systemprofile\AppData\Local\Citrix\Secure Access Client" 2>nul & exit /b 0",
"username": "NT AUTHORITY\SYSTEM",
"session": 1,
"exe_file": {
"owner": "NT SERVICE\TrustedInstaller",
"orig_filename": "Cmd.Exe",
"description": "Windows Command Processor",
"product_name": "Microsoft® Windows® Operating System",
"version": "10.0.26100.9278 (WinBuild.160101.0800)",
"created": "2026-09-08T23:32:39.246Z",
"last_modified": "2026-09-08T23:32:39.253Z",
"size": 262144,
"internal_name": "cmd",
"hashes": {
"md5": "f2a8884471c2579515594f02829e3a3f",
"sha256": "a5923f7667d1d0e7d8b10f9e53fb22e04aa424b87a18805ec8f08f2be5092205",
"sha1": "6122e29a833a1f95e725df47487b8edb9eaf1baa",
"imphash": "58af81efb41b1e0e3595b9d25c292c7d"

"parent_process": {
	"start_time": "2026-09-18T15:36:44.890Z",
	"name": "msiexec.exe",
	"pid": 20036,
	"ppid": 11576,
	"exe_path": "C:\\Windows\\SysWOW64\\msiexec.exe",
	"working_dir": "C:\\WINDOWS\\SysWOW64\\",
	"cmd_line": "C:\\Windows\\syswow64\\MsiExec.exe -Embedding AC2225D33C045DB87D1F7927CE075678 E Global\\MSI0000",
	"username": "NT AUTHORITY\\SYSTEM",
1 Like
2

Same here . Related to the auto update of the software , nothing harmful but indeed some noise.

1 Like
3

Yep, same here. Technically not a false-positive as the command is trying to taskkill multiple times - I guess either Citrix have changed the update method or something has changed in the IDR detection. We’ve just added an exception that checks for multiple elements within the cmd_line and device names (as we only have a few systems using it, so that method isn’t a problem for us)