Detectionhightest
HackTool - Empire UserAgent URI Combo
Detects user agent and URI paths used by empire agents
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Florian Roth (Nextron Systems)Created Mon Jul 13Updated Mon Feb 26b923f7d6-ac89-4a50-a71a-89fb846b4aa8web
Log Source
Proxy Log
CategoryProxy Log← raw: proxy
Detection Logic
Detection Logic1 selector
detection:
selection:
c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'
cs-uri:
- '/admin/get.php'
- '/news.php'
- '/login/process.php'
cs-method: 'POST'
condition: selectionFalse Positives
Valid requests with this exact user agent to server scripts of the defined names
References
MITRE ATT&CK
Sub-techniques
Rule Metadata
Rule ID
b923f7d6-ac89-4a50-a71a-89fb846b4aa8
Status
test
Level
high
Type
Detection
Created
Mon Jul 13
Modified
Mon Feb 26
Path
rules/web/proxy_generic/proxy_hktl_empire_ua_uri_patterns.yml
Raw Tags
attack.defense-evasionattack.command-and-controlattack.t1071.001