↳ GitHub sourceAnalytics ruleMedium

Cisco Umbrella - Hack Tool User-Agent Detected

View on GitHub ↗Original file ↗

An inconsistency was detected in the sources: variants or an invalid file. Check the files and commit shown below.

Description

'Detects suspicious user agent strings used by known hack tools'

Rule type: Scheduled
Version: 1.1.2
Query frequency: 15m
Query period: 15m
Trigger: gt 0

Declared MITRE coverage

CommandAndControl

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CiscoUmbrellaDataConnector

Data types

Cisco_Umbrella_proxy_CL

KQL query

Original query, unchanged.

let timeframe = 15m;
let user_agents=dynamic([
                          '(hydra)',
                          ' arachni/',
                          ' BFAC ',
                          ' brutus ',
                          ' cgichk ',
                          'core-project/1.0',
                          ' crimscanner/',
                          'datacha0s',
                          'dirbuster',
                          'domino hunter',
                          'dotdotpwn',
                          'FHScan Core',
                          'floodgate',
                          'get-minimal',
                          'gootkit auto-rooter scanner',
                          'grendel-scan',
                          ' inspath ',
                          'internet ninja',
                          'jaascois',
                          ' zmeu ',
                          'masscan',
                          ' metis ',
                          'morfeus fucking scanner',
                          'n-stealth',
                          'nsauditor',
                          'pmafind',
                          'security scan',
                          'springenwerk',
                          'teh forest lobster',
                          'toata dragostea',
                          ' vega/',
                          'voideye',
                          'webshag',
                          'webvulnscan',
                          ' whcc/',
                          ' Havij',
                          'absinthe',
                          'bsqlbf',
                          'mysqloit',
                          'pangolin',
                          'sql power injector',
                          'sqlmap',
                          'sqlninja',
                          'uil2pn',
                          'ruler',
                          'Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)'
                          ]);
Cisco_Umbrella
| where EventType == "proxylogs"
| where TimeGenerated > ago(timeframe)
| where HttpUserAgentOriginal has_any (user_agents)
| extend Message = "Hack Tool User Agent"
| project Message, SrcIpAddr, DstIpAddr, UrlOriginal, TimeGenerated, HttpUserAgentOriginal

Declared entities

URLIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Detections/CiscoUmbrella/CiscoUmbrellaHackToolUserAgentDetected.yaml ↗
Commit: 9800e51 ↗
Source identifier: 8d537f3c-094f-430c-a588-8a87da36ee3a

Additional source files 1

Detections/CiscoUmbrella/CiscoUmbrellaHackToolUserAgentDetected.yamlsource ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.