Proxy Logs: Suspicious Hack Tool User-Agent Strings

title: "Proxy Logs: Suspicious Hack Tool User-Agent Strings"
id: f6a8dceb-0873-4345-8099-2b0d04740a89
status: test
description: This rule flags proxy requests whose User-Agent contains strings associated with vulnerability scanners, brute-force tools, SQL injection utilities, and other hack tools. Attackers often use these automated tools to probe for weaknesses or extract data, and the User-Agent can provide a direct indicator of that activity. It relies on proxy log telemetry capturing the HTTP User-Agent field and matches for the specific substrings listed in the rule.
references:
  - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb
  - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_hacktool.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-07-08
modified: 2022-07-07
tags:
  - attack.initial-access
  - attack.t1190
  - attack.credential-access
  - attack.t1110
logsource:
  category: proxy
detection:
  selection:
    c-useragent|contains:
      - (hydra)
      - " arachni/"
      - " BFAC "
      - " brutus "
      - " cgichk "
      - core-project/1.0
      - " crimscanner/"
      - datacha0s
      - dirbuster
      - domino hunter
      - dotdotpwn
      - FHScan Core
      - floodgate
      - get-minimal
      - gootkit auto-rooter scanner
      - grendel-scan
      - " inspath "
      - internet ninja
      - jaascois
      - " zmeu "
      - masscan
      - " metis "
      - morfeus fucking scanner
      - n-stealth
      - nsauditor
      - pmafind
      - security scan
      - springenwerk
      - teh forest lobster
      - toata dragostea
      - " vega/"
      - voideye
      - webshag
      - webvulnscan
      - " whcc/"
      - " Havij"
      - absinthe
      - bsqlbf
      - mysqloit
      - pangolin
      - sql power injector
      - sqlmap
      - sqlninja
      - uil2pn
      - ruler
      - Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c42a3073-30fb-48ae-8c99-c23ada84b103
    type: derived