Query: Sigma rule for Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs
Matching passage: Sigma rule: Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs. Logsource: proxy. Rule: title: Exploit Framework User Agent id: fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f status: test description: Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs references: - https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/ author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2025-01-18 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: - Internet Explorer * - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2) - Mozilla/4.0 (compatible; Metasploit RSPEC) - Mozilla/4.0 (compatible; MSIE 6.1; Windows NT) - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0) - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SIMBAR={7DB0F6DE-8DE7-4841-9084-28FA914B0F2E}; SLCC1; .N - Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/525.13 - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MAAU) - Mozilla/5.0 - Mozilla/4.0 (compatible; SPIPE/1.0 - Mozilla/5.0 (Windows NT 6.3; rv:39.0) Gecko/20100101 Firefox/35.0 - Sametime Community Agent - X-FORWARDED-FOR - DotDotPwn v2.1 - SIPDROID - Mozilla/5.0 (Windows NT 10.0; Win32; x32; rv:60.0) - Mozilla/6.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205 Firefox/27.0 Iceweasel/25.3.0 - '*wordpress hash grabber*' - '*exploit*' - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than t. Logsource: windows / process_creation. Rule: title: Ie4uinit Lolbin Use From Invalid Path id: d3bf399f-b0cf-4250-8bb4-dfc192ab81dc status: test description: Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories references: - https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/ - https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/ author: frack113 date: 2022-05-07 modified: 2022-05-16 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: lolbin: - Image|endswith: \ie4uinit.exe - OriginalFileName: IE4UINIT.EXE filter_correct: CurrentDirectory: - c:\windows\system32\ - c:\windows\sysWOW64\ filter_missing: CurrentDirectory: null condition: lolbin and not 1 of filter_* falsepositives: - ViberPC updater calls this binary with the following commandline "ie4uinit.exe -ClearIconCache" level: medium