Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.
Detects suspicious encoded User-Agent strings, as seen used by some malware.
Detects Baby Shark C2 Framework default communication patterns
Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).
Detects user agent and URI paths used by empire agents
Detects a potentially suspicious empty user agent strings in proxy log.
Could potentially indicate an uncommon request method.
Detect the update check performed by Advanced IP/Port Scanner utilities.
Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form
Detects Windows PowerShell Web Access
Detects WebDav DownloadCradle
Detects suspicious user agent strings used in APT malware in proxy logs
Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.
Detects Bitsadmin connections to IP addresses instead of FQDN names
Detects executable downloads from suspicious remote systems
Detects suspicious user agent strings used by malware in proxy logs
Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP
Detects suspicious malformed user agent strings in proxy logs
Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
Detects URL pattern used by search(-ms)/WebDAV initial access campaigns.
Detects download of certain file types from hosts with dynamic DNS names (selected list)
Detects download of certain file types from hosts in suspicious TLDs
Detects suspicious requests to Telegram API without the usual Telegram User-Agent
Detects Bitsadmin connections to domains with uncommon TLDs
Detects suspicious user agent strings used by crypto miners in proxy logs
Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs
Detects a flashplayer update from an unofficial location
Detects suspicious user agent strings user by hack tools in proxy logs
Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity