Anomalous User Agent connection attempt

Hunt Hypothesis

Adversaries may use anomalous User Agent strings to mask their true identity or evade detection during initial access. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential stealthy reconnaissance or command and control activities.

KQL Query

let short_uaLength = 5;
let long_uaLength = 1000;
let c_threshold = 100;
W3CIISLog
// Exclude local IPs as these create noise
| where cIP !startswith "192.168." and cIP != "::1"
| where isnotempty(csUserAgent) and csUserAgent !in~ ("-", "MSRPC") and (string_size(csUserAgent) <= short_uaLength or string_size(csUserAgent) >= long_uaLength)
| extend csUserAgent_size = string_size(csUserAgent)
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ConnectionCount = count() by Computer, sSiteName, sPort, csUserAgent, csUserAgent_size, csUserName , csMethod, csUriStem, sIP, cIP, scStatus, scSubStatus, scWin32Status
| where ConnectionCount < c_threshold
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(csUserName, "@")[0]), AccountUPNSuffix = tostring(split(csUserName, "@")[1])

Analytic Rule Definition

id: f845881e-2500-44dc-8ed7-b372af3e1e25
name: Anomalous User Agent connection attempt
description: |
  'Identifies connection attempts (success or fail) from clients with very short or very long User Agent strings and with less than 100 connection attempts.'
severity: Low
requiredDataConnectors:
  - connectorId: AzureMonitor(IIS)
    dataTypes:
      - W3CIISLog
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
query: |
  let short_uaLength = 5;
  let long_uaLength = 1000;
  let c_threshold = 100;
  W3CIISLog
  // Exclude local IPs as these create noise
  | where cIP !startswith "192.168." and cIP != "::1"
  | where isnotempty(csUserAgent) and csUserAgent !in~ ("-", "MSRPC") and (string_size(csUserAgent) <= short_uaLength or string_size(csUserAgent) >= long_uaLength)
  | extend csUserAgent_size = string_size(csUserAgent)
  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), ConnectionCount = count() by Computer, sSiteName, sPort, csUserAgent, csUserAgent_size, csUserName , csMethod, csUriStem, sIP, cIP, scStatus, scSubStatus, scWin32Status
  | where ConnectionCount < c_threshold
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
  | extend AccountName = tostring(split(csUserName, "@")[0]), AccountUPNSuffix = tostring(split(csUserName, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: csUserName
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: NTDomain
        columnName: HostNameDomain
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: cIP
version: 1.0.3
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Microsoft Security Research
    support:
        tier: Community
    categories:
        domains: [ "Security - Threat Protection" ]

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1190 — T1190

References

• Source Query

False Positive Guidance

• Scenario: A system administrator is using curl or wget to perform a one-time file download from an internal server.
  Filter/Exclusion: Exclude connections where the User Agent string matches known command-line tools (curl, wget, httpie, etc.) or where the source IP is from a known admin workstation.

• Scenario: A scheduled job (e.g., cron job) is running a script that makes a single HTTP request to a monitoring service using a minimal User Agent string.
  Filter/Exclusion: Exclude connections with User Agent strings that match common script-based tools or where the request is to a known internal monitoring endpoint.

• Scenario: A developer is testing a new API endpoint using a tool like Postman or Insomnia, resulting in a single connection attempt with a custom User Agent string.
  Filter/Exclusion: Exclude connections where the User Agent string contains “Postman”, “Insomnia”, or other known API testing tools, or where the request is to a development/test environment.

• Scenario: A security tool like OSSEC or Snort is sending a single alert to a SIEM system, resulting in a connection with a minimal or custom User Agent string.
  Filter/Exclusion: Exclude connections originating from known security tools or where the destination IP is a SIEM or log aggregation system.

• Scenario: A backup job is using a tool like rsync or scp to transfer data over SSH, which may include a custom User Agent string in the connection metadata.
  Filter/Exclusion: Exclude connections where the User Agent string is associated with SSH-based tools or where the source IP is from a known backup server.