title: APT User Agent
id: 6ec820f2-e963-4801-9127-d8b2dce4d31b
status: test
description: Detects suspicious user agent strings used in APT malware in proxy logs
author: Florian Roth, Markus Neis
references:
  - Internal Research
date: 2019/11/12
modified: 2021/11/30
logsource:
  category: proxy
detection:
  selection:
    c-useragent:
         # APT Related
      - 'SJZJ (compatible; MSIE 6.0; Win32)'    # APT Backspace
      - 'Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0'    # APT GrizzlySteppe - ChopStick - US CERT https://goo.gl/1DTHwi
      - 'User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC'    # Comment Crew Miniasp
      - 'Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit)'    # Comment Crew Miniasp
      - 'webclient'    # Naikon APT
      - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200'    # Naikon APT
      - 'Mozilla/4.0 (compatible; MSI 6.0;'    # SnowGlobe Babar - yes, it is cut
      - 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0'    # Sofacy - Xtunnel
      - 'Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/'    # Sofacy - Xtunnel
      - 'Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2'    # Sofacy - Xtunnel
      - 'Mozilla/4.0'    # Derusbi backdoor ELF https://github.com/fideliscyber/indicators/tree/master/FTA-1021
      - 'Netscape'    # Unit78020 Malware
      - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7'    # Unit78020 Malware
      - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Firefox/3.6.13 GTB7.1'    # Winnti related
      - 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)'    # Winnti related
      - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)'    # APT17
      - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)'    # Bronze Butler - Daserf
      - 'Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)'    # Bronze Butler - Daserf
      - 'Mozilla/4.0 (compatible; MSIE 8.0; Win32)'    # TSCookie https://app.any.run/tasks/0996b314-5133-491b-8d23-d431ffdec597
      - 'Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1'    # Delphi downloader https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
      - 'Mozilla/6.1 (compatible; MSIE 9.0; Windows NT 5.3; Trident/5.0)'    # VPNFilter https://blog.talosintelligence.com/2018/05/VPNFilter.html
      - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1)'    # Sofacy User-Agent https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/
      - 'Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko'    # Sofacy User-Agent https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/
      - 'Mozilla v5.1 *'    # Sofacy Zebrocy samples
      - 'MSIE 8.0'    # Sofacy Azzy Backdoor  from https://www.hybrid-analysis.com/sample/a80e29c0757bee05338fd5c22a542d852ad86c477068e3eb4aacc1c3e59e2eef?environmentId=100
      - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)'    # https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html
      - 'Mozilla/4.0 (compatible; RMS)'    # Attacks on industrial enterprises using RMS and TeamViewer https://goo.gl/GthvTw
      - 'Mozilla/4.0 (compatible; MSIE 6.0; DynGate)'    # Attacks on industrial enterprises using RMS and TeamViewer https://goo.gl/GthvTw
      - 'O/9.27 (W; U; Z)'   # Cmstar https://www.virustotal.com/#/file/e4328011bb2b04abc856ccd04404c9f95d67167f6c291d343e8ffa8aa2aa2099/details
      - 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0;  Trident/5.0*'    # KerrDown UA https://goo.gl/s2WU6o
      - 'Mozilla/5.0 (Windows NT 9; *'    # Suspicious 'Windows NT 9' user agent - used by APT33 malware in 2018
      - 'hots scot'    # Unknown iOS zero-day implant https://twitter.com/craiu/status/1176437994288484352?s=20
      - 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT)'    # https://blog.telsy.com/meeting-powerband-the-apt33-net-powerton-variant/
      - 'Mozilla/5.0 (Windows NT 6.1; WOW64) Chrome/28.0.1500.95 Safari/537.36'    # Hidden Cobra malware
      - 'Mozilla/5.0 (Windows NT 6.2; Win32; rv:47.0)'    # Strong Pity loader https://twitter.com/VK_Intel/status/1264185981118406657
      - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;SV1;'    # Mustang Panda https://insights.oem.avira.com/new-wave-of-plugx-targets-hong-kong/
      - 'Mozilla/5.0 (X11; Linux i686; rv:22.0) Firefox/22.0'    # BackdoorDiplomacy https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/
      - 'Mozilla/5.0 Chrome/72.0.3626.109 Safari/537.36'    # SideWalk malware used by Sparkling Goblin
      - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:FTS_06) Gecko/22.36.35.06 Firefox/2.0'  # LitePower stager used by WRITE https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044/
  condition: selection
fields:
  - ClientIP
  - c-uri
  - c-useragent
falsepositives:
  - Old browsers
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
