{"id":"fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f","title":"Exploit Framework User Agent","description":"Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-07-08","modified":"2025-01-18","tags":["attack.command-and-control","attack.t1071.001"],"technique_ids":["T1071.001"],"logsource":{"category":"proxy"},"falsepositives":["Unknown"],"references":["https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/"],"source_path":"rules/web/proxy_generic/proxy_ua_frameworks.yml","source_sha256":"892606b24e2416461b25f1fa6feac1613f53ef57c98215f604ba02e3d4db4e16","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_ua_frameworks.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Exploit Framework User Agent\nid: fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f\nstatus: test\ndescription: Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs\nreferences:\n    - https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-07-08\nmodified: 2025-01-18\ntags:\n    - attack.command-and-control\n    - attack.t1071.001\nlogsource:\n    category: proxy\ndetection:\n    selection:\n        c-useragent:\n        # Cobalt Strike https://www.cobaltstrike.com/help-malleable-c2\n            - 'Internet Explorer *'\n            - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2)' # https://bluescreenofjeff.com/2016-06-28-cobalt-strike-http-c2-redirectors-with-apache-mod_rewrite/\n\n        # Metasploit Framework - Analysis by Didier Stevens https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/\n            - 'Mozilla/4.0 (compatible; Metasploit RSPEC)'\n            - 'Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)'\n            - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)' # old browser, rare, base-lining needed\n            - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)' # old browser, rare, base-lining needed\n            - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)' # old browser, rare, base-lining needed\n            - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SIMBAR={7DB0F6DE-8DE7-4841-9084-28FA914B0F2E}; SLCC1; .N'\n            - 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)' # only use in proxy logs - not for detection in web server logs\n            - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/525.13'\n            - 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MAAU)' # Payloads\n\n        # Metasploit Update by Florian Roth 08.07.2017\n            - 'Mozilla/5.0'\n            - 'Mozilla/4.0 (compatible; SPIPE/1.0'\n        # - 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)'  # too many false positives expected\n        # - 'Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko'  # too many false positives expected\n            - 'Mozilla/5.0 (Windows NT 6.3; rv:39.0) Gecko/20100101 Firefox/35.0'\n            - 'Sametime Community Agent' # Unknown if prone to false positives - https://github.com/rapid7/metasploit-framework/blob/97095ab3113de2f046e64a64c461a1f888554401/modules/exploits/windows/http/steamcast_useragent.rb\n            - 'X-FORWARDED-FOR'\n            - 'DotDotPwn v2.1'\n            - 'SIPDROID'\n            - 'Mozilla/5.0 (Windows NT 10.0; Win32; x32; rv:60.0)' # CobaltStrike https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/\n\n        # Empire\n            - 'Mozilla/6.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205     Firefox/27.0 Iceweasel/25.3.0'\n\n        # Exploits\n            - '*wordpress hash grabber*'\n            - '*exploit*'\n\n        # Havoc\n            - 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36'  # https://github.com/HavocFramework/Havoc/issues/519\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1071.001","id":"T1071.001","name":"Web Protocols","page":"techniques/enterprise/T1071.001/"}],"data_path":"data/detection-rules/fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f.json","kind":"sigma"}