HTTP Request With Empty User Agent

Title: HTTP Request With Empty User Agent
Status: test
Description:Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.
References:
  -https://twitter.com/Carlos_Perez/status/883455096645931008
Author: Florian Roth (Nextron Systems)
Date: 2017-07-08
modified:2021-11-27
Tags:

• -'attack.command-and-control'
• -'attack.t1071.001'

Logsource:

• category: proxy

Detection:
  selection:
    c-useragent: ''
  condition:selection
Falsepositives:
  -Unknown
Level: medium