{"id":"7195a772-4b3f-43a4-a210-6a003d65caa1","title":"Suspicious User Agent","description":"Detects suspicious malformed user agent strings in proxy logs","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-07-08","modified":"2022-10-31","tags":["attack.command-and-control","attack.t1071.001"],"technique_ids":["T1071.001"],"logsource":{"category":"proxy"},"falsepositives":["Unknown"],"references":["https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb"],"source_path":"rules/web/proxy_generic/proxy_ua_susp.yml","source_sha256":"ff7d97cf5748182cb3583efe63c717643584c240d5f38b6262316377d7f8ab11","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_ua_susp.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious User Agent\nid: 7195a772-4b3f-43a4-a210-6a003d65caa1\nstatus: test\ndescription: Detects suspicious malformed user agent strings in proxy logs\nreferences:\n    - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-07-08\nmodified: 2022-10-31\ntags:\n    - attack.command-and-control\n    - attack.t1071.001\nlogsource:\n    category: proxy\ndetection:\n    selection1:\n        c-useragent|startswith:\n            - 'user-agent'  # User-Agent: User-Agent:\n            - 'Mozilla/3.0 '\n            - 'Mozilla/2.0 '\n            - 'Mozilla/1.0 '\n            - 'Mozilla '  # missing slash\n            - ' Mozilla/'  # leading space\n            - 'Mozila/'  # single 'l'\n            - 'Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol'  # https://twitter.com/NtSetDefault/status/1303643299509567488\n    selection2:\n        c-useragent|contains:\n            - ' (compatible;MSIE '  # typical typo - missing space\n            - '.0;Windows NT '  # typical typo - missing space\n            - 'loader'  # https://twitter.com/securityonion/status/1522614635152744453?s=20&t=gHyPTSq5A27EqKwrCd9ohg\n    selection3:\n        c-useragent:\n            - '_'\n            - 'CertUtil URL Agent'  # https://twitter.com/stvemillertime/status/985150675527974912\n            - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0)'  # CobaltStrike Beacon https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/\n            - 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0'  # used by APT28 malware https://threatvector.cylance.com/en_us/home/inside-the-apt28-dll-backdoor-blitz.html\n            - 'HTTPS'  # https://twitter.com/stvemillertime/status/1204437531632250880\n            - 'Erbium-UA-4ce7c27cb4be9d32e333bf032c88235a'  # https://www.cyfirma.com/outofband/erbium-stealer-malware-report\n            - 'x'  # Use by Racoon Stealer but could be something else\n            - 'xxx'  # Use by Racoon Stealer but could be something else\n    falsepositives:\n        - c-useragent: 'Mozilla/3.0 * Acrobat *'  # Acrobat with linked content\n        - cs-host|endswith: # Adobe product traffic, example: Mozilla/3.0 (compatible; Adobe Synchronizer 10.12.20000)\n              - '.acrobat.com'\n              - '.adobe.com'\n              - '.adobe.io'\n    condition: 1 of selection* and not falsepositives\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1071.001","id":"T1071.001","name":"Web Protocols","page":"techniques/enterprise/T1071.001/"}],"data_path":"data/detection-rules/7195a772-4b3f-43a4-a210-6a003d65caa1.json","kind":"sigma"}