Exploit Framework User Agent Detection
Detects suspicious user agent strings commonly used by exploit and penetration testing frameworks such as Metasploit, Cobalt Strike, Empire, and Havoc. These user agents often mimic legitimate browsers or applications but contain specific patterns that indicate their use by these tools. The rule is designed to identify command and control (C2) communication or initial access attempts originating from these frameworks by analyzing proxy logs.
Sigma
