Proxy User-Agent starts with Base64-like prefixes associated with encoded client strings

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule flags HTTP proxy logs where the User-Agent header starts with specific Base64-like prefixes that indicate an encoded client identity. Attackers and malware may use encoded User-Agent values to evade simple filtering, blend into traffic patterns, or obscure their tooling. Detection relies on proxy telemetry capturing the User-Agent field and matching the specified starting substrings.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Malicious Renamed Python Interpreter Executing nvidia.py RAT

Malicious Self-Signed TLS Certificate With Exploit Subject via Zeek X509

Suspicious Network Connection From wabmig.exe (Turian Injection)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Proxy User-Agent starts with Base64-like prefixes associated with encoded client strings

Pivot detection · T1071.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

proxy-traffic-with-suspicious-base64-encoded-user-agent-prefixes-d443095b

title: Proxy User-Agent starts with Base64-like prefixes associated with encoded client strings
id: cd917286-80cd-4ceb-a761-9d02d8d65b8e
related:
  - id: 894a8613-cf12-48b3-8e57-9085f54aa0c3
    type: derived
  - id: d443095b-a221-4957-a2c4-cd1756c9b747
    type: derived
status: test
description: This rule flags HTTP proxy logs where the User-Agent header starts with specific Base64-like prefixes that indicate an encoded client identity. Attackers and malware may use encoded User-Agent values to evade simple filtering, blend into traffic patterns, or obscure their tooling. Detection relies on proxy telemetry capturing the User-Agent field and matching the specified starting substrings.
references:
  - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_base64_encoded.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
    c-useragent|startswith:
      - Q2hyb21l
      - QXBwbGVXZWJLaX
      - RGFsdmlr
      - TW96aWxsY
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL