This detection identifies potential reconnaissance or evasion activities where adversaries manipulate User-Agent strings to bypass standard filtering mechanisms or mimic legitimate traffic patterns. Proactively hunting for these anomalies in Azure Sentinel is critical because even low-severity malformed agents can serve as early indicators of sophisticated threat actors attempting to obscure their identity before executing more impactful attacks.
rule volgmer
{
meta:
description = "Malformed User Agent"
ref = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
strings:
$s = "Mozillar/"
condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $s
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the Malformed User Agent detection rule in an enterprise environment, along with suggested filters or exclusions:
Legacy Internal Reporting Scripts
ReportGen_v2.exe) running on internal file servers to pull data from web dashboards often use hardcoded User-Agent strings that lack standard versioning syntax (e.g., missing the / separator between name and version) or contain non-ASCII characters specific to the legacy OS.Internal-Servers subnet where the User-Agent starts with known internal script prefixes like Python-urllib, PowerShell-Script, or CustomReportAgent.CI/CD Pipeline Artifact Downloads
CI-CD-Jumpbox IP range where the destination port is 80/443 and the User-Agent contains keywords like Jenkins, GitLab-CI, or AzurePipelines.Mobile Device Management (MDM) Compliance Checks