huntrule

Proxy Traffic with Suspicious Base64-Encoded User-Agent Prefixes

Identifies proxy requests with User-Agent values starting with known Base64-encoded prefixes.

FreeUnreviewedSigmamediumv1
title: Proxy Traffic with Suspicious Base64-Encoded User-Agent Prefixes
id: cd917286-80cd-4ceb-a761-9d02d8d65b8e
related:
  - id: 894a8613-cf12-48b3-8e57-9085f54aa0c3
    type: derived
  - id: d443095b-a221-4957-a2c4-cd1756c9b747
    type: derived
status: test
description: This rule flags proxy requests whose User-Agent begins with specific Base64-like prefixes associated with encoded strings. Attackers may encode the User-Agent to evade simple detection, blend in with normal traffic, or signal automated client behavior. The detection relies on proxy telemetry containing the request User-Agent field and matches only those defined prefix values.
references:
  - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_base64_encoded.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
    c-useragent|startswith:
      - Q2hyb21l
      - QXBwbGVXZWJLaX
      - RGFsdmlr
      - TW96aWxsY
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags proxy requests whose User-Agent begins with specific Base64-like prefixes associated with encoded strings. Attackers may encode the User-Agent to evade simple detection, blend in with normal traffic, or signal automated client behavior. The detection relies on proxy telemetry containing the request User-Agent field and matches only those defined prefix values.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.