Proxy Detects Empire-Style User-Agent with POST to Common PHP Admin/Auth Paths

Flags proxy HTTP POSTs using an Empire-like user agent to specific admin/login PHP endpoints.

FreeUnreviewedSigmahighv1

proxy-detects-empire-style-user-agent-with-post-to-common-php-admin-auth-paths-b923f7d6

title: Proxy Detects Empire-Style User-Agent with POST to Common PHP Admin/Auth Paths
id: 695886c9-281d-41b0-a8c7-7afbf25747b1
status: test
description: This rule matches proxy traffic where a specific Windows Internet Explorer user agent string is paired with HTTP POST requests to a set of PHP URI paths commonly used for admin/login-related endpoints. Attackers can use custom or tool-specific client identifiers along with targeted endpoint paths to blend into web traffic while executing command-and-control. It relies on proxy telemetry that includes the client user agent, request method, and full URI path to the server-side scripts.
references:
  - https://github.com/BC-SECURITY/Empire
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_hktl_empire_ua_uri_patterns.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-13
modified: 2024-02-26
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
    c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    cs-uri:
      - /admin/get.php
      - /news.php
      - /login/process.php
    cs-method: POST
  condition: selection
falsepositives:
  - Valid requests with this exact user agent to server scripts of the defined names
level: high
license: DRL-1.1
related:
  - id: b923f7d6-ac89-4a50-a71a-89fb846b4aa8
    type: derived

What it detects

This rule matches proxy traffic where a specific Windows Internet Explorer user agent string is paired with HTTP POST requests to a set of PHP URI paths commonly used for admin/login-related endpoints. Attackers can use custom or tool-specific client identifiers along with targeted endpoint paths to blend into web traffic while executing command-and-control. It relies on proxy telemetry that includes the client user agent, request method, and full URI path to the server-side scripts.

Known false positives

Valid requests with this exact user agent to server scripts of the defined names

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.