Suspicious Base64 Encoded User-Agent (via proxy)

title: Suspicious Base64 Encoded User-Agent (via proxy)
id: 618b489d-06d6-5434-9134-a6c357f96126
status: stable
description: This rule detects anomalous encoded User-Agent strings, as seen used by some malware.
references:
    - https://attack.mitre.org/techniques/T1071/001/
    - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop
author: Huntrule Team
date: 2026-01-24
tags:
    - attack.command-and-control
    - attack.t1071.001
logsource:
    category: proxy
detection:
    selection:
        c-useragent|startswith:
            - 'Q2hyb21l'
            - 'QXBwbGVXZWJLaX'
            - 'RGFsdmlr'
            - 'TW96aWxsY'
    condition: selection
falsepositives:
    - Unknown
level: medium