Title:HackTool - Empire UserAgent URI Combo Status:test Description:Detects user agent and URI paths used by empire agents References: -https://github.com/BC-SECURITY/Empire Author: Florian Roth (Nextron Systems) Date: 2020-07-13 modified:2024-02-26 Tags:
-'attack.command-and-control'
-'attack.t1071.001'
Logsource:
category: proxy
Detection: selection: c-useragent:
'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko' cs-uri: -'/admin/get.php' -'/news.php' -'/login/process.php'
cs-method:
'POST' condition:selection Falsepositives:
-Valid requests with this exact user agent to server scripts of the defined names Level:high
