• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Malformed user agent

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•8•1•122

    'Malware authors will sometimes hardcode user agent string values when writing the network communication component of their malware. Malformed user agents can be an indication of such malware.'

    Microsoft Sentinel (KQL)

    Tags

    TA0005 - Defense EvasionT1027 - Obfuscated Files or InformationTA0001 - Initial AccessT1078 - Valid AccountsTA0006 - Credential AccessT1189 - Drive-by CompromiseT1071 - Application Layer ProtocolT1203 - Exploitation for Client ExecutionTA0011 - Command and ControlTA0002 - ExecutionTA0003 - PersistenceTA0004 - Privilege EscalationT1071.001 - Web ProtocolsNetwork ConnectionHTTP RequestMalware DetectedWindowsLinuxAWSAzureOffice 365M365 Unified Audit LogAzure Activity LogsAzure Signin LogsMicrosoft IisAWS CloudtrailAzure Ad Risk Detectionkqltactic:InitialAccesstactic:CommandAndControltactic:Executiontechnique:T1189technique:T1071technique:T1203

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?