proxy_generic | Detection.FYI

F5 BIG-IP iControl Rest API Command Execution - Proxy

Oct 1, 2024 · attack.initial-access attack.t1190 ·
Share on:

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

Read More
APT User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used in APT malware in proxy logs

Read More
Bitsadmin to Uncommon IP Server Address

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·
Share on:

Detects Bitsadmin connections to IP addresses instead of FQDN names

Read More
Bitsadmin to Uncommon TLD

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.defense-evasion attack.persistence attack.t1197 attack.s0190 ·
Share on:

Detects Bitsadmin connections to domains with uncommon TLDs

Read More
Crypto Miner User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used by crypto miners in proxy logs

Read More
Download from Suspicious Dyndns Hosts

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1105 attack.t1568 ·
Share on:

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Read More
Download From Suspicious TLD - Blacklist

Aug 12, 2024 · attack.initial-access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·
Share on:

Detects download of certain file types from hosts in suspicious TLDs

Read More
Download From Suspicious TLD - Whitelist

Aug 12, 2024 · attack.initial-access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·
Share on:

Detects executable downloads from suspicious remote systems

Read More
Exploit Framework User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

Read More
Flash Player Update from Suspicious Location

Aug 12, 2024 · attack.initial-access attack.t1189 attack.execution attack.t1204.002 attack.defense-evasion attack.t1036.005 ·
Share on:

Detects a flashplayer update from an unofficial location

Read More
Hack Tool User Agent

Aug 12, 2024 · attack.initial-access attack.t1190 attack.credential-access attack.t1110 ·
Share on:

Detects suspicious user agent strings user by hack tools in proxy logs

Read More
HackTool - BabyShark Agent Default URL Pattern

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects Baby Shark C2 Framework default communication patterns

Read More
HackTool - CobaltStrike Malleable Profile Patterns - Proxy

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·
Share on:

Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

Read More
HackTool - Empire UserAgent URI Combo

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·
Share on:

Detects user agent and URI paths used by empire agents

Read More
HTTP Request With Empty User Agent

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·
Share on:

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

Read More
Malware User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious user agent strings used by malware in proxy logs

Read More
Potential Base64 Encoded User-Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.

Read More
PUA - Advanced IP/Port Scanner Update Check

Aug 12, 2024 · attack.discovery attack.t1590 ·
Share on:

Detect the update check performed by Advanced IP/Port Scanner utilities.

Read More
PwnDrp Access

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.t1102.001 attack.t1102.003 ·
Share on:

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Read More
Raw Paste Service Access

Aug 12, 2024 · attack.command-and-control attack.t1071.001 attack.t1102.001 attack.t1102.003 attack.defense-evasion ·
Share on:

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

Read More
Rclone Activity via Proxy

Aug 12, 2024 · attack.exfiltration attack.t1567.002 ·
Share on:

Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string

Read More
Suspicious Base64 Encoded User-Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious encoded User-Agent strings, as seen used by some malware.

Read More
Suspicious External WebDAV Execution

Aug 12, 2024 · attack.initial-access attack.t1584 attack.t1566 ·
Share on:

Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.

Read More
Suspicious Network Communication With IPFS

Aug 12, 2024 · attack.credential-access attack.t1056 ·
Share on:

Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.

Read More
Suspicious User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects suspicious malformed user agent strings in proxy logs

Read More
Telegram API Access

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 attack.t1102.002 ·
Share on:

Detects suspicious requests to Telegram API without the usual Telegram User-Agent

Read More
Windows PowerShell User Agent

Aug 12, 2024 · attack.defense-evasion attack.command-and-control attack.t1071.001 ·
Share on:

Detects Windows PowerShell Web Access

Read More
Windows WebDAV User Agent

Aug 12, 2024 · attack.command-and-control attack.t1071.001 ·
Share on:

Detects WebDav DownloadCradle

Read More