Malware User Agent

Original Source: [Sigma source]

Title: Malware User Agent
Status: test
Description:Detects suspicious user agent strings used by malware in proxy logs
References:
-http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules
-http://www.botopedia.org/search?searchword=scan&searchphrase=all
-https://networkraptor.blogspot.com/2015/01/user-agent-strings.html
-https://perishablepress.com/blacklist/ua-2013.txt
-https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents
-https://twitter.com/kladblokje_88/status/1614673320124743681?s=12&t=joEpeVa5d58aHYNGA_To7Q
-https://pbs.twimg.com/media/FtYbfsDXoAQ1Y8M?format=jpg&name=large
-https://twitter.com/crep1x/status/1635034100213112833
Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2017-07-08
modified:2024-04-14
Tags:

-'attack.command-and-control'
-'attack.t1071.001'

Logsource:

category: proxy

Detection:
selection:
c-useragent:
-'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Chrome /53.0'
-'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)'
-'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)'
-'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)'
-'HttpBrowser/1.0'
-'*<|>*'
-'nsis_inetc (mozilla)'
-'Wget/1.9+cvs-stable (Red Hat modified)'
-'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)'
-'*zeroup*'
-'Mozilla/5.0 (Windows NT 5.1 ; v.*'
-'* adlib/*'
-'* tiny'
-'* BGroom *'
-'* changhuatong'
-'* CholTBAgent'
-'Mozilla/5.0 WinInet'
-'RookIE/1.0'
-'M'
-'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)'
-'Mozilla/4.0 (compatible;MSIE 7.0;Windows NT 6.0)'
-'backdoorbot'
-'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731)'
-'Opera/8.81 (Windows NT 6.0; U; en)'
-'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30729)'
-'Opera'
-'Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)'
-'Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)'
-'MSIE'
-'*(Charon; Inferno)'
-'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)'
-'Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)'
-'Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1)'
-'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
-'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)'
-'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)'
-'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3)'
-'Mozilla/5.0 (Windows NT 6.1)'
-'AppleWebkit/587.38 (KHTML, like Gecko)'
-'Chrome/91.0.4472.77'
-'Safari/537.36'
-'Edge/91.0.864.37'
-'Firefox/89.0'
-'Gecko/20100101'
-'* pxyscand*'
-'* asd'
-'* mdms'
-'sample'
-'nocase'
-'Moxilla'
-'Win32 *'
-'*Microsoft Internet Explorer*'
-'agent *'
-'AutoIt'
-'IczelionDownLoad'
-'Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 10.0; .NET4.0C; .NET4.0E; Tablet PC 2.0)'
-'record'
-'mozzzzzzzzzzz'
-'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0'
-'Havana/0.1'
-'antSword/v2.1'
-'rqwrwqrqwrqw'
-'qwrqrwrqwrqwr'
-'rc2.0/client'
-'TakeMyPainBack'
-'xxx'
-'20112211'
-'23591'
-'901785252112'
-'1235125521512'
-'125122112551'
-'B1D3N_RIM_MY_ASS'
-'AYAYAYAY1337'
-'iMightJustPayMySelfForAFeature'
-'ForAFeature'
-'Ares_ldr_v_*'
-'Microsoft Internet Explorer'
-'CLCTR'
-'uploader'
-'agent'
-'License'
-'vb wininet'
-'Client'
-'Lilith-Bot/3.0'
-'svc/1.0'
-'WSHRAT'
-'ZeroStresser Botnet/1.5'
-'OK'
-'Project1sqlite'
-'Project1'
-'DuckTales'
-'Zadanie'
-'GunnaWunnaBlueTips'
-'Xlmst'
-'GeekingToTheMoon'
-'SunShineMoonLight'
-'BunnyRequester'
-'BunnyTasks'
-'BunnyStealer'
-'BunnyLoader_Dropper'
-'BunnyLoader'
-'BunnyShell'
-'SPARK-COMMIT'
-'4B4DB4B3'
-'SouthSide'
-'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)'

condition:selection
Falsepositives:
-Unknown
Level: high