Query: Sigma rule for Detects suspicious user agent strings used by malware in proxy logs
Matching passage: Sigma rule: Detects suspicious user agent strings used by malware in proxy logs. Logsource: proxy. Rule: title: Malware User Agent id: 5c84856b-55a5-45f1-826f-13f37250cf4e status: test description: Detects suspicious user agent strings used by malware in proxy logs references: - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules - http://www.botopedia.org/search?searchword=scan&searchphrase=all - https://networkraptor.blogspot.com/2015/01/user-agent-strings.html - https://perishablepress.com/blacklist/ua-2013.txt - https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents - https://twitter.com/kladblokje_88/status/1614673320124743681?s=12&t=joEpeVa5d58aHYNGA_To7Q - https://pbs.twimg.com/media/FtYbfsDXoAQ1Y8M?format=jpg&name=large - https://twitter.com/crep1x/status/1635034100213112833 author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2017-07-08 modified: 2024-04-14 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Chrome /53.0 - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1) - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0) - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) - HttpBrowser/1.0 - '*<|>*' - nsis_inetc (mozilla) - Wget/1.9+cvs-stable (Red Hat modified) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322) - '*zeroup*' - Mozilla/5.0 (Windows NT 5.1 ; v.* - '* adlib/*' - '* tiny' - '* BGroom *' - '* changhuatong' - '* CholTBAgent' - Mozilla/5.0 WinInet - RookIE/1.0 - M - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0) - Mozilla/4.0 (compatible;MSIE 7.0;Windows NT 6.0) - backdoorbot - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) - Opera/8.81 (Windows NT 6.0; U; en) - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30729) - Opera - Mozilla/4.0 (compatible; MSIE 5.0; Windows 98) - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) - MSIE - '*(Charon; Inferno)' - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0) - Mozilla/4.0 (compatible; MSIE 6.1; Windows NT) - Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1) - Mozilla/5.0 (Windows NT 10.0; Win64; x64) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64) - Mozilla/4.0
Near-miss passage: Sigma rule: Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access. Logsource: aws / cloudtrail. Rule: title: AWS Key Pair Import Activity id: 92f84194-8d9a-4ee0-8699-c30bfac59780 status: experimental description: 'Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations. ' references: - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html author: Ivan Saakov date: 2024-12-19 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: ImportKeyPair condition: selection falsepositives: - Legitimate administrative actions by authorized users importing keys for valid purposes. - Automated processes for infrastructure setup may trigger this alert. - Verify the user identity, user agent, and source IP address to ensure they are expected. level: medium