Suspicious User Agent String in Proxy Logs

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•5•0•53

Detects suspicious and malformed user agent strings in proxy logs that may indicate malicious activity, including the use of specific malware or tools like Cobalt Strike, APT28 malware, Racoon Stealer, and Erbium stealer. The rule identifies various anomalies such as incorrect formatting, typos, and specific user agent strings known to be associated with adversary tools.