SigmaHQ/rules/proxy/proxy_empty_ua.yml

title: Empty User Agent
status: experimental
description: Detects suspicious empty user agent strings in proxy logs
reference:
    - https://twitter.com/Carlos_Perez/status/883455096645931008
author: Florian Roth
logsource:
    category: proxy
detection:
    selection:
      UserAgent:
        # Empty string - as used by Powershell's (New-Object Net.WebClient).DownloadString 
        - ''
    condition: selection
falsepositives:
    - Unknown
level: medium