{"id":"c42a3073-30fb-48ae-8c99-c23ada84b103","title":"Hack Tool User Agent","description":"Detects suspicious user agent strings user by hack tools in proxy logs","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-07-08","modified":"2022-07-07","tags":["attack.initial-access","attack.t1190","attack.credential-access","attack.t1110"],"technique_ids":["T1110","T1190"],"logsource":{"category":"proxy"},"falsepositives":["Unknown"],"references":["https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb","http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules"],"source_path":"rules/web/proxy_generic/proxy_ua_hacktool.yml","source_sha256":"a64265075225b934ee8442f46dab2bac5b84d03c8f27a2591bfebde03741823b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_ua_hacktool.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Hack Tool User Agent\nid: c42a3073-30fb-48ae-8c99-c23ada84b103\nstatus: test\ndescription: Detects suspicious user agent strings user by hack tools in proxy logs\nreferences:\n    - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb\n    - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-07-08\nmodified: 2022-07-07\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - attack.credential-access\n    - attack.t1110\nlogsource:\n    category: proxy\ndetection:\n    selection:\n        c-useragent|contains:\n            # Vulnerability scanner and brute force tools\n            - '(hydra)'\n            - ' arachni/'\n            - ' BFAC '\n            - ' brutus '\n            - ' cgichk '\n            - 'core-project/1.0'\n            - ' crimscanner/'\n            - 'datacha0s'\n            - 'dirbuster'\n            - 'domino hunter'\n            - 'dotdotpwn'\n            - 'FHScan Core'\n            - 'floodgate'\n            - 'get-minimal'\n            - 'gootkit auto-rooter scanner'\n            - 'grendel-scan'\n            - ' inspath '\n            - 'internet ninja'\n            - 'jaascois'\n            - ' zmeu '\n            - 'masscan'\n            - ' metis '\n            - 'morfeus fucking scanner'\n            - 'n-stealth'\n            - 'nsauditor'\n            - 'pmafind'\n            - 'security scan'\n            - 'springenwerk'\n            - 'teh forest lobster'\n            - 'toata dragostea'\n            - ' vega/'\n            - 'voideye'\n            - 'webshag'\n            - 'webvulnscan'\n            - ' whcc/'\n            # SQL Injection\n            - ' Havij'\n            - 'absinthe'\n            - 'bsqlbf'\n            - 'mysqloit'\n            - 'pangolin'\n            - 'sql power injector'\n            - 'sqlmap'\n            - 'sqlninja'\n            - 'uil2pn'\n            # Hack tool\n            - 'ruler'  # https://www.crowdstrike.com/blog/using-outlook-forms-lateral-movement-persistence/\n            - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)'  # SQLi Dumper\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1110","id":"T1110","name":"Brute Force","page":"techniques/enterprise/T1110/"},{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"}],"data_path":"data/detection-rules/c42a3073-30fb-48ae-8c99-c23ada84b103.json","kind":"sigma"}