Suspicious Base64 Encoded User-Agent in Proxy Logs

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•33

Detects suspicious User-Agent strings that appear to be Base64 encoded. This pattern has been observed in some malware, such as YamaBot, to obfuscate the true User-Agent. The rule specifically looks for Base64 encoded prefixes of common browser User-Agents like 'Chrome', 'AppleWebKit', 'Dalvik', and 'Mozilla', with an offset to account for potential padding variations.