Detectionhightest

HackTool - Empire UserAgent URI Combo

Detects user agent and URI paths used by empire agents

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems)Created Mon Jul 13Updated Mon Feb 26b923f7d6-ac89-4a50-a71a-89fb846b4aa8web
Log Source
Proxy Log
CategoryProxy Log← raw: proxy
Detection Logic
Detection Logic1 selector
detection:
    selection:
        c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'
        cs-uri:
            - '/admin/get.php'
            - '/news.php'
            - '/login/process.php'
        cs-method: 'POST'
    condition: selection
False Positives

Valid requests with this exact user agent to server scripts of the defined names

Rule Metadata
Rule ID
b923f7d6-ac89-4a50-a71a-89fb846b4aa8
Status
test
Level
high
Type
Detection
Created
Mon Jul 13
Modified
Mon Feb 26
Path
rules/web/proxy_generic/proxy_hktl_empire_ua_uri_patterns.yml
Raw Tags
attack.defense-evasionattack.command-and-controlattack.t1071.001
View on GitHub