Detect presence of uncommon user agents in web requests (ASIM Web Session)
This rule assists in detecting rare user agents, which may indicate web browsing activity by an unconventional process different from the usual ones. The rule specifically searches for UserAgent strings that have not…
Description
This rule assists in detecting rare user agents, which may indicate web browsing activity by an unconventional process different from the usual ones. The rule specifically searches for UserAgent strings that have not been seen in the past 14 days. This query will perform better when run over summarized data
Detection logic
Detection requirements
- Platform
- ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 2d50d937-d7f2-4c05-b151-9af7f9ec747e
- Tagged by the source as
- InitialAccess
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 15, 2026
- Version
- 2