1200KM / sigma-rule
Potential Base64 Encoded User-Agent — Sigma Rule
Sigma rule 894a8613-cf12-48b3-8e57-9085f54aa0c3. Potential Base64 Encoded User-Agent — Sigma Rule. Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.
Rule metadata and linked tags
Author: Florian Roth (Nextron Systems), Brian Ingram (update). Source status: test; severity: medium. Source dates: 2022-07-08 / 2023-05-04.
{
"category": "proxy"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: d909bdab6ebfb94ffc6159964798917aded622c0761539ddc9a328d3bfabf8a3
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Potential Base64 Encoded User-Agent
id: 894a8613-cf12-48b3-8e57-9085f54aa0c3
related:
- id: d443095b-a221-4957-a2c4-cd1756c9b747
type: derived
status: test
description: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.
references:
- https://blogs.jpcert.or.jp/en/2022/07/yamabot.html
- https://deviceatlas.com/blog/list-of-user-agent-strings#desktop
author: Florian Roth (Nextron Systems), Brian Ingram (update)
date: 2022-07-08
modified: 2023-05-04
tags:
- attack.command-and-control
- attack.t1071.001
logsource:
category: proxy
detection:
selection:
c-useragent|endswith: '='
condition: selection
falsepositives:
- Unknown
level: medium
False positives
- Unknown
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.