Proxy Log User-Agent Ending with '=' Suggesting Base64 Encoding

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule flags proxy requests where the User-Agent field ends with an equals sign, a common base64 padding character. Attackers may use base64-encoded identifiers or payload markers within User-Agent to obfuscate command-and-control related data. It relies on proxy telemetry capturing the full User-Agent string and evaluates only the trailing character pattern.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Malicious Renamed Python Interpreter Executing nvidia.py RAT

Malicious Self-Signed TLS Certificate With Exploit Subject via Zeek X509

Suspicious Network Connection From wabmig.exe (Turian Injection)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Proxy Log User-Agent Ending with '=' Suggesting Base64 Encoding

Pivot detection · T1071.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

proxy-user-agent-ending-with-indicating-potential-base64-encoding-894a8613

title: Proxy Log User-Agent Ending with '=' Suggesting Base64 Encoding
id: e5be63ab-c47b-4ace-a83e-8c113e6b90a1
related:
  - id: d443095b-a221-4957-a2c4-cd1756c9b747
    type: derived
  - id: 894a8613-cf12-48b3-8e57-9085f54aa0c3
    type: derived
status: test
description: This rule flags proxy requests where the User-Agent field ends with an equals sign, a common base64 padding character. Attackers may use base64-encoded identifiers or payload markers within User-Agent to obfuscate command-and-control related data. It relies on proxy telemetry capturing the full User-Agent string and evaluates only the trailing character pattern.
references:
  - https://blogs.jpcert.or.jp/en/2022/07/yamabot.html
  - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_susp_base64.yml
author: Florian Roth (Nextron Systems), Brian Ingram (update), Huntrule Team
date: 2022-07-08
modified: 2023-05-04
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
    c-useragent|endswith: =
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL