Suspicious Base64 Encoded User-Agent

Title: Suspicious Base64 Encoded User-Agent
Status: test
Description:Detects suspicious encoded User-Agent strings, as seen used by some malware.
References:
  -https://deviceatlas.com/blog/list-of-user-agent-strings#desktop
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-04
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1071.001'

Logsource:

• category: proxy

Detection:
  selection:
    c-useragent|startswith:
      -'Q2hyb21l'
      -'QXBwbGVXZWJLaX'
      -'RGFsdmlr'
      -'TW96aWxsY'

  condition:selection
Falsepositives:
  -Unknown
Level: medium