Query: Sigma YAML for proxy
Matching passage: Sigma rule: Detects suspicious user agent strings user by hack tools in proxy logs. Logsource: proxy. Rule: title: Hack Tool User Agent id: c42a3073-30fb-48ae-8c99-c23ada84b103 status: test description: Detects suspicious user agent strings user by hack tools in proxy logs references: - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2022-07-07 tags: - attack.initial-access - attack.t1190 - attack.credential-access - attack.t1110 logsource: category: proxy detection: selection: c-useragent|contains: - (hydra) - ' arachni/' - ' BFAC ' - ' brutus ' - ' cgichk ' - core-project/1.0 - ' crimscanner/' - datacha0s - dirbuster - domino hunter - dotdotpwn - FHScan Core - floodgate - get-minimal - gootkit auto-rooter scanner - grendel-scan - ' inspath ' - internet ninja - jaascois - ' zmeu ' - masscan - ' metis ' - morfeus fucking scanner - n-stealth - nsauditor - pmafind - security scan - springenwerk - teh forest lobster - toata dragostea - ' vega/' - voideye - webshag - webvulnscan - ' whcc/' - ' Havij' - absinthe - bsqlbf - mysqloit - pangolin - sql power injector - sqlmap - sqlninja - uil2pn - ruler - Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer C. Logsource: windows / process_creation. Rule: title: Obfuscated PowerShell MSI Install via WindowsInstaller COM id: 7b6a7418-3afc-11f0-aff4-000d3abf478c status: experimental description: 'Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., ''indowsInstaller.Installer''.Insert(0,''W'')) and correcting malformed URLs (e.g., converting ''htps://'' to ''https://'') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction. ' references: - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/ - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/ - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457 author: Meroujan Antonyan (vx3r) date: 2025-05-27 tags: - attack.stealth - attack.t1027.010 - attack.t1218.007 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - -ComObject - InstallProduct( - .Insert( - UILevel condition: all of selection_* falsepositives: - Unknown level: high