This query detects suspicious user agent strings used by exploit and pen test frameworks.There are several exploit and pen test frameworks that are being used by pen testers as well as attackers to compromise an environment and achieve their objective. The query tries to detect suspicious user agent strings used by these frameworks in some of the data sources that contain UserAgent field. This is based out of sigma rules described in references. References: https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_frameworks.yml

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.