SessionGate NSIS User-Agent
This rule detects network connections where the User-Agent or RequestClientApplication header contains "NSIS_InetLoad". This string is often associated with Nullsoft Scriptable Install System (NSIS) installers, which can be used by legitimate software but also by malware to download additional components or communicate with command and control servers. The rule specifically looks for at least 3 such connections from the same source to the same destination within the aggregated timeframe, while excluding connections to Microsoft domains to reduce false positives.
Microsoft Sentinel (KQL)
