huntrule

Proxy logs: Detect suspicious hack tool user agents from known scanning and SQLi tools

Alerts on proxy requests with User-Agent values commonly used by scanners and hack tools, indicating automated probing or exploitation attempts.

FreeReviewedSigma · High · v2
Category
proxy
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2017-07-08
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access → Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches proxy user-agent strings that contain or exactly equal values associated with vulnerability scanners, brute-force tools, and SQL injection tooling. Attackers often disguise automated probing by using characteristic user agents, so flagging these strings helps identify initial reconnaissance and credential-access activity. The detection relies on proxy log telemetry capturing the HTTP user-agent field.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Possible SonicWall Credential Testing via userLogin Endpoint
Malicious SharePoint ToolShell Exploitation via ToolPane Endpoint
Malicious Exchange Mailbox Export to ASPX via New-MailboxExportRequest
Suspicious Shell Spawned by ActiveMQ Java Process
Cleo Autorun Exploitation via Healthcheck File Drop
Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell
Malicious IIS Worker Process Spawning Command Shell Reconnaissance
Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)
Cisco IOS XE Configuration Change by Web UI WSMA User
Proxy logs: Detect suspicious hack tool user agents from known scanning and SQLi tools
Pivot detection · T1190 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.