Sigma rule: Hack Tool User Agent

Rule

Title

Hack Tool User Agent

Status

test

Level

high

Author

Florian Roth (Nextron Systems)

Date

2017-07-08

Modified

2022-07-07

File

rules/web/proxy_generic/proxy_ua_hacktool.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious user agent strings user by hack tools in proxy logs

Log source

category

proxy

Detection

selection:
    c-useragent|contains:
        # Vulnerability scanner and brute force tools
        - '(hydra)'
        - ' arachni/'
        - ' BFAC '
        - ' brutus '
        - ' cgichk '
        - 'core-project/1.0'
        - ' crimscanner/'
        - 'datacha0s'
        - 'dirbuster'
        - 'domino hunter'
        - 'dotdotpwn'
        - 'FHScan Core'
        - 'floodgate'
        - 'get-minimal'
        - 'gootkit auto-rooter scanner'
        - 'grendel-scan'
        - ' inspath '
        - 'internet ninja'
        - 'jaascois'
        - ' zmeu '
        - 'masscan'
        - ' metis '
        - 'morfeus fucking scanner'
        - 'n-stealth'
        - 'nsauditor'
        - 'pmafind'
        - 'security scan'
        - 'springenwerk'
        - 'teh forest lobster'
        - 'toata dragostea'
        - ' vega/'
        - 'voideye'
        - 'webshag'
        - 'webvulnscan'
        - ' whcc/'
        # SQL Injection
        - ' Havij'
        - 'absinthe'
        - 'bsqlbf'
        - 'mysqloit'
        - 'pangolin'
        - 'sql power injector'
        - 'sqlmap'
        - 'sqlninja'
        - 'uil2pn'
        # Hack tool
        - 'ruler'  # https://www.crowdstrike.com/blog/using-outlook-forms-lateral-movement-persistence/
        - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)'  # SQLi Dumper
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.t1190
• attack.credential-access
• attack.t1110

MITRE ATT&CK ids this rule names

• T1110
• T1190

References

• https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb
• http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/proxy_generic/proxy_ua_hacktool.yml