splunk-security_content/lookups/csv/pua_user_agents.csv

1	pua_user_agent	tool	description
2	AADInternals	AADInternals	Default user agent used by AADInternals
3	OWASP Amass	amass	Default user agent for amass recon tool
4	ArgusCrawler/1.0	Argus	User agent used by the Information Gathering Toolkit named Argus
5	ArgusDataLeakChecker/1.0	Argus	User agent used by the Information Gathering Toolkit named Argus
6	Argus-Scanner/1.0	Argus	User agent used by the Information Gathering Toolkit named Argus
7	Mozilla/5.0 (compatible; ArgusBot/1.0*	Argus	User agent used by the Information Gathering Toolkit named Argus
8	autocert	autocert	Provides automatic access to certificates from Let's Encrypt (used in sshamble)
9	azurehound*	AzureHound	AzureHound - Azure Data Exporter for BloodHound - default user agent
10	BAV2ROPC	BAV2ROPC	User agent commonly used by older email apps and devices that rely on basic authentication to access email accounts - often observed in Business email compromise
11	Box Edit/*	box	Used by box agent file host
12	Box/2.*	box	Used by box agent file host
13	ccminer*	ccminer	ccminer user-agent
14	Certipy	certipy	Default user agent for nltm lib of certipy
15	Cr3dOv3r-Framework	Cr3dOv3r	Default user agent used by Cr3dOv3r - ispwned.py
16	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
17	Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
18	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
19	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/604.5.6 (KHTML, like Gecko) Version/11.0.3 Safari/604.5.6	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
20	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
21	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
22	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:59.0) Gecko/20100101 Firefox/59.0	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
23	Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
24	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
25	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
26	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
27	Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
28	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1 Safari/605.1.15	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
29	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
30	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
31	Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36	CredMaster	Old user agent (from 2018-era or older) used by CredMaster credential access tool
32	FUCKUSA	Cryptominer	Used by cryptomining campaigns
33	Lomond/*	dataplicity	User agent used by lemond python package with the websocket request - used by dataplicity (enables connecting local systems to dataplicity cloud for remotely accessing them over the internet)
34	dirhunt	dirhunt	Default user agent for a tool used to find web directories without bruteforce
35	WebServices;eM Client/*	eM Client	Desktop-based email solution fully synchronized with O365 - abused for data exfiltration - observed in multiple BEC cases
36	*(Hackintosh*	Hackintosh OS	Default user agent for Hackintosh OS
37	KrbRelayUp/1.0	KrbRelayUp	KrbRelayUp default user-agent
38	Lemon-Duck-*	Lemon-Duck	cryptominer default user agent
39	*UCCAPI/16.0.13328.20130 OC/16.0.13426.20234*	lyncsmash	Default user agent used by lyncsmash.py - a collection of tools to enumerate and attack self-hosted Skype for Business and Microsoft Lync installations
40	MEGA/MEGAcmdUpdaterTask	MEGAcmd	Command Line Interactive and Scriptable Application to access MEGA
41	MEGAcmd/*	MEGAcmd	Command Line Interactive and Scriptable Application to access MEGA
42	MEGAupdater *	MEGASYNC	Used by MEGASYNC software when installed
43	Windows Installer	msiexec	Typically associated with .msi installation processes that perform HTTP downloads. While it can be legitimate - it may also indicate the use of remotely hosted malicious installers
44	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36	Phishing Kit	Old version of legitimate Chrome browser used in phishing Kit
45	Mozilla/5.0 (Windows NT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22621	Phishing Kit	Old version of legitimate Chrome browser used in phishing Kit
46	PingCastleAutoUpdater*	Pingcastle	Default user agent used by Pingcastle (PingCastleAutoUpdater)
47	rclone/*	rclone	User agent used by rclone
48	Rubeus/1.0	Rubeus	User agent used by Rubeus
49	ShadowSpray.Kerb/1.0	ShadowSpray	Default user agent for the tool ShadowSpray (spray Shadow Credentials across an entire domain)
50	SharpBuster	SharpBuster	SharpBuster default UA
51	Valve/Steam HTTP Client	Steam	Steam client (games)
52	subfinder	subfinder	subfinder subdomain passive enumeration tool default UA
53	syncthing v*	synchthing	Used by syncthing software
54	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.3.00.30866 Chrome/80.0.3987.165 Electron/8.5.1 Safari/537.36	TeamFiltration	Used in Teamfiltration default conf
55	* Toolbar *	Toolbars	Random toolbar software
56	*torrent*	Torrents	Many torrent clients use torrent in their user agent strings
57	*Your Moms Smart Vibrator*	TREVORspray	Default user agent for TREVORspray example module - a modular password sprayer with threading - clever proxying - loot modules and more
58	TruffleHog*	TruffleHog	Find - verify and analyze leaked credentials open source github project
59	VirtualBox *	Virtualbox	Default user agent seen during Virtualbox activities
60	*SearchToolbar*	wyzo	Browser with torrent search integrated + other junk softwares
61	XMRig*	xmrig	xmrig cryptominer user agent