Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
Platforms
1
Products / Services
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
This rule detects suspicious user agent strings commonly associated with various Advanced Persistent Threat (APT) groups and malware families. It specifically targets patterns found in proxy logs, indicating potential command and control (C2) communications or other malicious web activity. The rule includes a broad list of user agent strings linked to specific APTs like Backspace, GrizzlySteppe, Comment Crew, Naikon, Sofacy (Xtunnel, Zebrocy), Derusbi, Winnti, APT17, Bronze Butler (Daserf), TSCookie, Delphi downloader, VPNFilter, FELIXROOT, RMS, Cmstar, KerrDown, APT33 (PowerTon), Hidden Cobra, Strong Pity, Mustang Panda, BackdoorDiplomacy, SideWalk, LitePower (WRITE), ZINC, PlugX, and RedCurl.
