From 6fc782958a74019c7e3c4ba87f5d694b33322de3 Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Fri, 8 Jul 2022 10:40:35 +0200
Subject: [PATCH 1/2] rule: Proxy UA Base64 value

---
 rules/proxy/proxy_ua_susp_base64.yml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 rules/proxy/proxy_ua_susp_base64.yml

diff --git a/rules/proxy/proxy_ua_susp_base64.yml b/rules/proxy/proxy_ua_susp_base64.yml
new file mode 100644
index 000000000..3af1eb8fe
--- /dev/null
+++ b/rules/proxy/proxy_ua_susp_base64.yml
@@ -0,0 +1,25 @@
+title: Suspicious User Agent
+id: 894a8613-cf12-48b3-8e57-9085f54aa0c3
+status: experimental
+description: Detects suspicious User Agent strings that end with an equal sign, which can be a sign of base64 encoded values used as User Agent string
+author: Florian Roth
+date: 2022/07/08
+references:
+    - https://blogs.jpcert.or.jp/en/2022/07/yamabot.html
+logsource:
+    category: proxy
+detection:
+    selection:
+        c-useragent|endswith:
+            - '='
+    condition: selection
+fields:
+    - ClientIP
+    - c-uri
+    - c-useragent
+falsepositives:
+    - Unknown
+level: high
+tags:
+    - attack.command_and_control
+    - attack.t1071.001

From 9b47c868bcdd42dca8a3935ca9517d3fa3ece90f Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Fri, 8 Jul 2022 10:50:52 +0200
Subject: [PATCH 2/2] fix: list and add base64 encoded Mozilla keyword

---
 rules/proxy/proxy_ua_susp_base64.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rules/proxy/proxy_ua_susp_base64.yml b/rules/proxy/proxy_ua_susp_base64.yml
index 3af1eb8fe..2ea52fe86 100644
--- a/rules/proxy/proxy_ua_susp_base64.yml
+++ b/rules/proxy/proxy_ua_susp_base64.yml
@@ -10,8 +10,9 @@ logsource:
     category: proxy
 detection:
     selection:
-        c-useragent|endswith:
+        c-useragent|endswith: 
             - '='
+            - 'TW96aWxsY'  # base64 encoded Mozilla/ as used by YamaBot
     condition: selection
 fields:
     - ClientIP