Query: alert when Detects suspicious user agent strings used in APT malware in proxy logs
Matching passage: Sigma rule: Detects suspicious user agent strings used in APT malware in proxy logs. Logsource: proxy. Rule: title: APT User Agent id: 6ec820f2-e963-4801-9127-d8b2dce4d31b status: test description: Detects suspicious user agent strings used in APT malware in proxy logs references: - Internal Research author: Florian Roth (Nextron Systems), Markus Neis date: 2019-11-12 modified: 2024-02-15 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: - SJZJ (compatible; MSIE 6.0; Win32) - Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0 - 'User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC' - Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit) - webclient - Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200 - Mozilla/4.0 (compatible; MSI 6.0; - Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 - Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/ - Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2 - Mozilla/4.0 - Netscape - Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7 - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Firefox/3.6.13 GTB7.1 - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1) - Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1) - Mozilla/4.0 (compatible; MSIE 8.0; Win32) - Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 - Mozilla/6.1 (compatible; MSIE 9.0; Windows NT 5.3; Trident/5.0) - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1) - Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko - Mozilla v5.1 * - MSIE 8.0 - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) - Mozilla/4.0 (compatible; RMS) - Mozilla/4.0 (compatible; MSIE 6.0; DynGate) - O/9.27 (W; U; Z) - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; Trident/5.0* - Mozilla/5.0 (Windows NT 9; * - hots scot - Mozilla/5.0 (compatible; MSIE 10.0; Windows NT) - Mozilla/5.0 (Windows NT 6.1; WOW64) Chrome/28.0.1500.95 Safari/537.36 - Mozilla/5.0 (Windows NT 6.2; Win32; rv:47.0) - Mozilla/4.0 (compatibl
Near-miss passage: Sigma rule: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc. Logsource: windows / process_creation. Rule: title: System Network Connections Discovery Via Net.EXE id: 1c67a717-32ba-409b-a45d-0fb704a73a81 status: test description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery author: frack113 date: 2021-12-10 modified: 2023-02-21 tags: - attack.discovery - attack.t1049 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: - CommandLine|endswith: - ' use' - ' sessions' - CommandLine|contains: - ' use ' - ' sessions ' condition: all of selection_* falsepositives: - Unknown level: low