EXPLORE
Sign In
← Back to Explore
sigmahighHunting

Suspicious User Agent

Detects suspicious malformed user agent strings in proxy logs

MITRE ATT&CK

T1071.001
command-and-control

Detection Query

selection1:
  c-useragent|startswith:
    - user-agent
    - "Mozilla/3.0 "
    - "Mozilla/2.0 "
    - "Mozilla/1.0 "
    - "Mozilla "
    - " Mozilla/"
    - Mozila/
    - Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol
selection2:
  c-useragent|contains:
    - " (compatible;MSIE "
    - ".0;Windows NT "
    - loader
selection3:
  c-useragent:
    - _
    - CertUtil URL Agent
    - Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0)
    - Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0
    - HTTPS
    - Erbium-UA-4ce7c27cb4be9d32e333bf032c88235a
    - x
    - xxx
falsepositives:
  - c-useragent: Mozilla/3.0 * Acrobat *
  - cs-host|endswith:
      - .acrobat.com
      - .adobe.com
      - .adobe.io
condition: 1 of selection* and not falsepositives

Author

Florian Roth (Nextron Systems)

Created

2017-07-08

Data Sources

proxy

References

Tags

attack.command-and-controlattack.t1071.001
Raw Content
title: Suspicious User Agent
id: 7195a772-4b3f-43a4-a210-6a003d65caa1
status: test
description: Detects suspicious malformed user agent strings in proxy logs
references:
    - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb
author: Florian Roth (Nextron Systems)
date: 2017-07-08
modified: 2022-10-31
tags:
    - attack.command-and-control
    - attack.t1071.001
logsource:
    category: proxy
detection:
    selection1:
        c-useragent|startswith:
            - 'user-agent'  # User-Agent: User-Agent:
            - 'Mozilla/3.0 '
            - 'Mozilla/2.0 '
            - 'Mozilla/1.0 '
            - 'Mozilla '  # missing slash
            - ' Mozilla/'  # leading space
            - 'Mozila/'  # single 'l'
            - 'Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol'  # https://twitter.com/NtSetDefault/status/1303643299509567488
    selection2:
        c-useragent|contains:
            - ' (compatible;MSIE '  # typical typo - missing space
            - '.0;Windows NT '  # typical typo - missing space
            - 'loader'  # https://twitter.com/securityonion/status/1522614635152744453?s=20&t=gHyPTSq5A27EqKwrCd9ohg
    selection3:
        c-useragent:
            - '_'
            - 'CertUtil URL Agent'  # https://twitter.com/stvemillertime/status/985150675527974912
            - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0)'  # CobaltStrike Beacon https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/
            - 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0'  # used by APT28 malware https://threatvector.cylance.com/en_us/home/inside-the-apt28-dll-backdoor-blitz.html
            - 'HTTPS'  # https://twitter.com/stvemillertime/status/1204437531632250880
            - 'Erbium-UA-4ce7c27cb4be9d32e333bf032c88235a'  # https://www.cyfirma.com/outofband/erbium-stealer-malware-report
            - 'x'  # Use by Racoon Stealer but could be something else
            - 'xxx'  # Use by Racoon Stealer but could be something else
    falsepositives:
        - c-useragent: 'Mozilla/3.0 * Acrobat *'  # Acrobat with linked content
        - cs-host|endswith: # Adobe product traffic, example: Mozilla/3.0 (compatible; Adobe Synchronizer 10.12.20000)
              - '.acrobat.com'
              - '.adobe.com'
              - '.adobe.io'
    condition: 1 of selection* and not falsepositives
falsepositives:
    - Unknown
level: high