From 9b47c868bcdd42dca8a3935ca9517d3fa3ece90f Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Fri, 8 Jul 2022 10:50:52 +0200
Subject: [PATCH] fix: list and add base64 encoded Mozilla keyword

---
 rules/proxy/proxy_ua_susp_base64.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rules/proxy/proxy_ua_susp_base64.yml b/rules/proxy/proxy_ua_susp_base64.yml
index 3af1eb8fe..2ea52fe86 100644
--- a/rules/proxy/proxy_ua_susp_base64.yml
+++ b/rules/proxy/proxy_ua_susp_base64.yml
@@ -10,8 +10,9 @@ logsource:
     category: proxy
 detection:
     selection:
-        c-useragent|endswith:
+        c-useragent|endswith: 
             - '='
+            - 'TW96aWxsY'  # base64 encoded Mozilla/ as used by YamaBot
     condition: selection
 fields:
     - ClientIP