Sigma rule: Exploit Framework User Agent

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-fa16af9728c3, updated 2025-01-18T00:00:00.000Z.

Rule

Title
Exploit Framework User Agent
Status
test
Level
high
Author
Florian Roth (Nextron Systems)
Date
2017-07-08
Modified
2025-01-18
File
rules/web/proxy_generic/proxy_ua_frameworks.yml
Commit
ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

Log source

category
proxy

Detection

selection:
    c-useragent:
    # Cobalt Strike https://www.cobaltstrike.com/help-malleable-c2
        - 'Internet Explorer *'
        - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2)' # https://bluescreenofjeff.com/2016-06-28-cobalt-strike-http-c2-redirectors-with-apache-mod_rewrite/

    # Metasploit Framework - Analysis by Didier Stevens https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/
        - 'Mozilla/4.0 (compatible; Metasploit RSPEC)'
        - 'Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)'
        - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)' # old browser, rare, base-lining needed
        - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)' # old browser, rare, base-lining needed
        - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)' # old browser, rare, base-lining needed
        - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SIMBAR={7DB0F6DE-8DE7-4841-9084-28FA914B0F2E}; SLCC1; .N'
        - 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)' # only use in proxy logs - not for detection in web server logs
        - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/525.13'
        - 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MAAU)' # Payloads

    # Metasploit Update by Florian Roth 08.07.2017
        - 'Mozilla/5.0'
        - 'Mozilla/4.0 (compatible; SPIPE/1.0'
    # - 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)'  # too many false positives expected
    # - 'Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko'  # too many false positives expected
        - 'Mozilla/5.0 (Windows NT 6.3; rv:39.0) Gecko/20100101 Firefox/35.0'
        - 'Sametime Community Agent' # Unknown if prone to false positives - https://github.com/rapid7/metasploit-framework/blob/97095ab3113de2f046e64a64c461a1f888554401/modules/exploits/windows/http/steamcast_useragent.rb
        - 'X-FORWARDED-FOR'
        - 'DotDotPwn v2.1'
        - 'SIPDROID'
        - 'Mozilla/5.0 (Windows NT 10.0; Win32; x32; rv:60.0)' # CobaltStrike https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/

    # Empire
        - 'Mozilla/6.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205     Firefox/27.0 Iceweasel/25.3.0'

    # Exploits
        - '*wordpress hash grabber*'
        - '*exploit*'

    # Havoc
        - 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36'  # https://github.com/HavocFramework/Havoc/issues/519
condition: selection

False positives (as the rule lists them)

  • Unknown

Tags

  • attack.command-and-control
  • attack.t1071.001

MITRE ATT&CK ids this rule names

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/proxy_generic/proxy_ua_frameworks.yml

Sources and licences

  • SigmaHQ

    "Exploit Framework User Agent" by Florian Roth (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/proxy_generic/proxy_ua_frameworks.yml.
    Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License

    Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Exploit Framework User Agent",
entity page, dataset version ref-fa16af9728c3, updated 2025-01-18T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f (accessed 2026-11-03).
Underlying source: SigmaHQ rule fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.