Suspicious exploit-framework User-Agent strings in proxy logs

title: Suspicious exploit-framework User-Agent strings in proxy logs
id: 6c608955-ae1f-407e-ac1d-aaab6a356f2b
status: test
description: This rule flags proxy requests whose User-Agent matches a set of known or common strings associated with exploit and pentest frameworks. Attackers can use these distinctive headers to blend in with automated tooling or to support C2 and exploit delivery workflows. The detection relies on proxy log telemetry that records the requested client User-Agent header.
references:
  - https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_frameworks.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-07-08
modified: 2025-01-18
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
    c-useragent:
      - Internet Explorer *
      - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2)
      - Mozilla/4.0 (compatible; Metasploit RSPEC)
      - Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)
      - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
      - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
      - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)
      - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SIMBAR={7DB0F6DE-8DE7-4841-9084-28FA914B0F2E}; SLCC1; .N
      - Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
      - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/525.13
      - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MAAU)
      - Mozilla/5.0
      - Mozilla/4.0 (compatible; SPIPE/1.0
      - Mozilla/5.0 (Windows NT 6.3; rv:39.0) Gecko/20100101 Firefox/35.0
      - Sametime Community Agent
      - X-FORWARDED-FOR
      - DotDotPwn v2.1
      - SIPDROID
      - Mozilla/5.0 (Windows NT 10.0; Win32; x32; rv:60.0)
      - Mozilla/6.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205     Firefox/27.0 Iceweasel/25.3.0
      - "*wordpress hash grabber*"
      - "*exploit*"
      - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f
    type: derived