SessionGate NSIS User-Agent Detection

Ethan Andrews@eandrews

•updated Jun 3, 2026•2•0•7

This rule detects network connections originating from clients using a specific User-Agent string associated with the SessionGate malware. The User-Agent string 'NSIS_InetLoad' combined with 'Mozilla' is indicative of SessionGate C2 check-ins, leveraging the NSIS (Nullsoft Scriptable Install System) InetLoad plugin. The rule searches across common proxy and web logs for this pattern.