Exploit Framework User Agent

Title: Exploit Framework User Agent
Status: test
Description:Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs
References:
  -https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/
Author: Florian Roth (Nextron Systems)
Date: 2017-07-08
modified:2025-01-18
Tags:

• -'attack.command-and-control'
• -'attack.t1071.001'

Logsource:

• category: proxy

Detection:
  selection:
    c-useragent:
      -'Internet Explorer *'
      -'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2)'
      -'Mozilla/4.0 (compatible; Metasploit RSPEC)'
      -'Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)'
      -'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)'
      -'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)'
      -'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)'
      -'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SIMBAR={7DB0F6DE-8DE7-4841-9084-28FA914B0F2E}; SLCC1; .N'
      -'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)'
      -'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/525.13'
      -'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MAAU)'
      -'Mozilla/5.0'
      -'Mozilla/4.0 (compatible; SPIPE/1.0'
      -'Mozilla/5.0 (Windows NT 6.3; rv:39.0) Gecko/20100101 Firefox/35.0'
      -'Sametime Community Agent'
      -'X-FORWARDED-FOR'
      -'DotDotPwn v2.1'
      -'SIPDROID'
      -'Mozilla/5.0 (Windows NT 10.0; Win32; x32; rv:60.0)'
      -'Mozilla/6.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205 Firefox/27.0 Iceweasel/25.3.0'
      -'*wordpress hash grabber*'
      -'*exploit*'
      -'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36'

  condition:selection
Falsepositives:
  -Unknown
Level: high