Proxy User-Agent ending with '=' indicating potential Base64 encoding

Alerts on proxy requests with User-Agent values ending in '=' that may indicate Base64-encoded content.

FreeUnreviewedSigmamediumv1

proxy-user-agent-ending-with-indicating-potential-base64-encoding-894a8613

title: Proxy User-Agent ending with '=' indicating potential Base64 encoding
id: e5be63ab-c47b-4ace-a83e-8c113e6b90a1
related:
  - id: d443095b-a221-4957-a2c4-cd1756c9b747
    type: derived
  - id: 894a8613-cf12-48b3-8e57-9085f54aa0c3
    type: derived
status: test
description: This rule flags proxy requests where the User-Agent string ends with an equal sign, a pattern consistent with base64-encoded data. Attackers may embed encoded or obfuscated identifiers in HTTP headers to support command-and-control or tracking while reducing straightforward signature matching. Detection relies on proxy telemetry capturing the User-Agent field and evaluating whether it ends with '='.
references:
  - https://blogs.jpcert.or.jp/en/2022/07/yamabot.html
  - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_susp_base64.yml
author: Florian Roth (Nextron Systems), Brian Ingram (update), Huntrule Team
date: 2022-07-08
modified: 2023-05-04
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
    c-useragent|endswith: =
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags proxy requests where the User-Agent string ends with an equal sign, a pattern consistent with base64-encoded data. Attackers may embed encoded or obfuscated identifiers in HTTP headers to support command-and-control or tracking while reducing straightforward signature matching. Detection relies on proxy telemetry capturing the User-Agent field and evaluating whether it ends with '='.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.