Query: Sigma rule for Detects suspicious user agent strings used in APT malware in proxy logs
Matching passage: Sigma rule: Detects suspicious user agent strings used in APT malware in proxy logs. Logsource: proxy. Rule: title: APT User Agent id: 6ec820f2-e963-4801-9127-d8b2dce4d31b status: test description: Detects suspicious user agent strings used in APT malware in proxy logs references: - Internal Research author: Florian Roth (Nextron Systems), Markus Neis date: 2019-11-12 modified: 2024-02-15 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: - SJZJ (compatible; MSIE 6.0; Win32) - Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0 - 'User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC' - Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit) - webclient - Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200 - Mozilla/4.0 (compatible; MSI 6.0; - Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 - Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/ - Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2 - Mozilla/4.0 - Netscape - Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7 - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Firefox/3.6.13 GTB7.1 - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1) - Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1) - Mozilla/4.0 (compatible; MSIE 8.0; Win32) - Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 - Mozilla/6.1 (compatible; MSIE 9.0; Windows NT 5.3; Trident/5.0) - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1) - Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko - Mozilla v5.1 * - MSIE 8.0 - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) - Mozilla/4.0 (compatible; RMS) - Mozilla/4.0 (compatible; MSIE 6.0; DynGate) - O/9.27 (W; U; Z) - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; Trident/5.0* - Mozilla/5.0 (Windows NT 9; * - hots scot - Mozilla/5.0 (compatible; MSIE 10.0; Windows NT) - Mozilla/5.0 (Windows NT 6.1; WOW64) Chrome/28.0.1500.95 Safari/537.36 - Mozilla/5.0 (Windows NT 6.2; Win32; rv:47.0) - Mozilla/4.0 (compatibl
Near-miss passage: Sigma rule: Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detecti. Logsource: linux / auditd. Rule: title: Steganography Extract Files with Steghide id: a5a827d9-1bbe-4952-9293-c59d897eb41b status: test description: Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information. references: - https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/ author: Pawel Mazur date: 2021-09-11 modified: 2022-10-09 tags: - attack.stealth - attack.t1027.003 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: steghide a1: extract a2: -sf a3|endswith: - .jpg - .png condition: selection falsepositives: - Unknown level: low