github-actions[bot]
26 lines
743 B
YAML
26 lines
743 B
YAML
title: Potential Base64 Encoded User-Agent
|
|
id: 894a8613-cf12-48b3-8e57-9085f54aa0c3
|
|
related:
|
|
- id: d443095b-a221-4957-a2c4-cd1756c9b747
|
|
type: derived
|
|
status: test
|
|
description: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.
|
|
references:
|
|
- https://blogs.jpcert.or.jp/en/2022/07/yamabot.html
|
|
- https://deviceatlas.com/blog/list-of-user-agent-strings#desktop
|
|
author: Florian Roth (Nextron Systems), Brian Ingram (update)
|
|
date: 2022/07/08
|
|
modified: 2023/05/04
|
|
tags:
|
|
- attack.command_and_control
|
|
- attack.t1071.001
|
|
logsource:
|
|
category: proxy
|
|
detection:
|
|
selection:
|
|
c-useragent|endswith: '='
|
|
condition: selection
|
|
falsepositives:
|
|
- Unknown
|
|
level: medium
|