MediumMicrosoft Sentinel analytics Microsoft Security Research

Malformed user agent

Malware authors will sometimes hardcode user agent string values when writing the network communication component of their malware. Malformed user agents can be an indication of such malware.

Detection logic

Detection requirements

Platform: ESXi Identity Provider Linux macOS Network Devices Windows
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.
Log source product: aws azureactivedirectory azuremonitor_iis office365 waf
Log source service: aadnoninteractiveusersigninlogs awscloudtrail azurediagnostics officeactivity signinlogs w3ciislog

Detection rules

Malformed user agent

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules