Detectionmediumtest

Potential Base64 Encoded User-Agent

Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems), Brian IngramCreated Fri Jul 08Updated Thu May 04894a8613-cf12-48b3-8e57-9085f54aa0c3web

Log Source

Proxy Log

CategoryProxy Log← raw: proxy

Detection Logic

detection:
    selection:
        c-useragent|endswith: '='
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

Sub-techniques

Related Rules

Suspicious Base64 Encoded User-Agent

Detects suspicious encoded User-Agent strings, as seen used by some malware.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata

Rule ID

894a8613-cf12-48b3-8e57-9085f54aa0c3

Status

test

Level

medium

Type

Detection

Created

Fri Jul 08

Modified

Thu May 04

Author

Path

rules/web/proxy_generic/proxy_ua_susp_base64.yml

Raw Tags

attack.command-and-controlattack.t1071.001