Potential Base64 Encoded User-Agent

Title: Potential Base64 Encoded User-Agent
Status: test
Description:Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.
References:
  -https://blogs.jpcert.or.jp/en/2022/07/yamabot.html
  -https://deviceatlas.com/blog/list-of-user-agent-strings#desktop
Author: Florian Roth (Nextron Systems), Brian Ingram (update)
Date: 2022-07-08
modified:2023-05-04
Tags:

• -'attack.command-and-control'
• -'attack.t1071.001'

Logsource:

• category: proxy

Detection:
  selection:
    c-useragent|endswith: '='
  condition:selection
Falsepositives:
  -Unknown
Level: medium