admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
develop
splunk-security_content/lookups/csv/suspicious_c2_user_agents.csv
T

11 KiB
Raw Permalink Blame History

1c2_user_agenttooldescription
2antSword/v*antSwordantSword webshell pentest tools abused by APT41 and other attackers
3Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Brute RatelDefault user agent string for Brute Ratel
4CanisRufusCanisRufusA stealthy Python based Windows backdoor that uses Github as a command and control server
5PologiyKolokolCapLoaderCapLoader
6sliveruaCloudflarePagesRedirectorCloudFlare C2 default examples UA
7ligolouaCloudflarePagesRedirectorCloudFlare C2 default examples UA
8Microsoft Internet ExplorerCobalt StrikeDefault user agent string for pitty_tiger Malleable C2 Profile
9Microsoft-CryptoAPI/6.1Cobalt StrikeDefault user agent string for oscp Malleable C2 Profile
10Mozilla Firefox/4.0Cobalt StrikeDefault user agent string for formbook Malleable C2 Profile
11Mozilla Firefox/4.0(compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0;SLC2; .NET CLD 3.5.30729; Media Center PC 6.0;)Cobalt StrikeDefault user agent string for globeimposter Malleable C2 Profile
12Mozilla/4.0Cobalt StrikeDefault user agent string for string_of_paerls Malleable C2 Profile
13Mozilla/4.0 (Windows 7 6.1) Java/1.7.0_11Cobalt StrikeDefault user agent string for fiesta Malleable C2 Profile
14Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)Cobalt StrikeDefault user agent string for comfoo Malleable C2 Profile
15Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914)Cobalt StrikeDefault user agent string for asprox Malleable C2 Profile
16Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)Cobalt StrikeDefault user agent string for zeus Malleable C2 Profile
17Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729Cobalt StrikeDefault user agent string for covid19_koadic Malleable C2 Profile
18Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E )Cobalt StrikeDefault user agent string for chches_APT10 Malleable C2 Profile
19Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; Media Center PC 6.0)Cobalt StrikeDefault user agent string for emotet Malleable C2 Profile
20Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)Cobalt StrikeDefault user agent string for magnitude, taidoor Malleable C2 Profiles
21Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; Media Center PC 6.0)Cobalt StrikeDefault user agent string for POSeidon Malleable C2 Profile
22Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCobalt StrikeDefault user agent string for bazarloader, dukes_apt29, mayoclinic, randomized Malleable C2 Profiles
23Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Cobalt StrikeDefault user agent string for bing_maps Malleable C2 Profile
24Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.104 Safari/537.36Cobalt StrikeDefault user agent string for mscrl Malleable C2 Profile
25Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (XHTML, like Gecko) Chrome/87.0.4280.89 Safari/537.36Cobalt StrikeDefault user agent string for salesforce_api Malleable C2 Profile
26Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko)Cobalt StrikeDefault user agent string for iheartradio, office365_calendar, slack, trevor, youtube_video Malleable C2 Profiles
27Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36Cobalt StrikeDefault user agent string for kronos Malleable C2 Profile
28Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36Cobalt StrikeDefault user agent string for reddit, stackoverflow Malleable C2 Profiles
29Mozilla/5.0 (Windows NT 6.1) AppleWebKit/587.38Cobalt StrikeDefault user agent string for jasperloader Malleable C2 Profile
30Mozilla/5.0 (Windows NT 6.1) AppleWebKit/587.38 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36Cobalt StrikeDefault user agent string for gotomeeting, msu_edu, template Malleable C2 Profiles
31Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36Cobalt StrikeDefault user agent string for gandcrab, quantloader Malleable C2 Profiles
32Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCobalt StrikeDefault user agent string for amazon, cnnvideo_getonly, googledrive_getonly, msnbcvideo_getonly, onedrive_getonly, pandora, safebrowsing, trick_ryuk, ursnif_IcedID, wikipedia_getonly Malleable C2 Profiles
33Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko)Cobalt StrikeDefault user agent string for hancitor Malleable C2 Profile
34Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0Cobalt StrikeDefault user agent string for bluenoroff_rat, ratankba Malleable C2 Profiles
35Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0Cobalt StrikeDefault user agent string for backoff Malleable C2 Profile
36Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36Cobalt StrikeDefault user agent string for zloader Malleable C2 Profile
37Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0Cobalt StrikeDefault user agent string for sofacy Malleable C2 Profile
38Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2) Java/1.5.0_08Cobalt StrikeDefault user agent string for havex Malleable C2 Profile
39Mozilla/5.0 (compatible, MSIE 11, Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoCobalt StrikeDefault user agent string for bingsearch_getonly Malleable C2 Profile
40Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; SLCC1; .NET CLR 1.1.4322)Cobalt StrikeDefault user agent string for trickbot Malleable C2 Profile
41Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)Cobalt StrikeDefault user agent string for etumbot Malleable C2 Profile
42Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET4.0E; QQBrowser/7.0.3698.400)Cobalt StrikeDefault user agent string for xbash Malleable C2 Profile
43Mozilla/5.0 (iPhone; CPU iPhone OS 12_1_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/16C104Cobalt StrikeDefault user agent string for zoom Malleable C2 Profile
44Mozilla/5.2 (Windows NT 6.2; rv:50.2) Gecko/20200103 Firefox/50.2Cobalt StrikeDefault user agent string for jaff Malleable C2 Profile
45Shockwave FlashCobalt StrikeDefault user agent string for rtmp Malleable C2 Profile
46Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.40Cobalt StrikeDefault user agent string for microsoftupdate_getonly, windows-updates Malleable C2 Profiles
47Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0)Cobalt StrikeDefault user agent string for Cobalt Strike
48Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)Cobalt StrikeDefault user agent string for Cobalt Strike
49Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; XBLWP7; ZuneWP7)Cobalt StrikeDefault user agent string for Cobalt Strike
50Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C; .NET4.0E)Cobalt StrikeDefault user agent string for Cobalt Strike
51Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Cobalt Strike / KoadicDefault user agent string for qakbot Malleable C2 Profile and Koadic Stage 1
52Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoCobalt Strike / Mythic C2Default User-Agent string for Several C2 Frameworks
53Mozilla/6.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36GraphStrikeDefault User-Agent string for Cobaltstrike GraphStrike server (not a legitimate UA)
54Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Havoc C2Default user agent string for Havoc C2 HTTP Listener
55Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)KoadicDefault user agent string for Koadic Stage 0 and Stage 2
56Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko*MultipleDefault user agent string used by multpile C2 frameworks including Metasploit, Cobalt Strike, Merlin, and more
57dvadcatnetsupport RATnetsupport RAT
58Mozilla/5.0 (compatible; ngrok)ngrokngrok user agent
59nimplantnimplantuser agent default for a light-weight first-stage C2 implant written in Nim
60NimPlant C2 Clientnimplantuser agent default for a light-weight first-stage C2 implant written in Nim
61linux:feeds:v2 (by /u/pico-sh)picoshhacker labs - open source and managed web services leveraging SSH
62pivotnacci/*pivotnacciPivotnacci allows you to create a socks server which communicates with HTTP agents
63Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 Safari/537.36PoshC2Default user agent string for PoshC2
64azure-logic-apps/1.0Power AutomatePower Automate user-agent also used by C2 NTT-Security-Japan/pac2 (LOLC2)
65remoteit/*remoteitremoteit
66C2FunctionAgentServerlessRedirectorServerlessRedirector
67Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.8827.897 Safari/537.36Sliver C2Default user agent string for Sliver Windows agent
68Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.8827.897 Safari/537.36Sliver C2Default user agent string for Sliver Linux agent
69Mozilla/5.0 (Macintosh; Intel Mac OS X %s) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.8827.897 Safari/537.36Sliver C2Default user agent string for Sliver Mac agent
70CatSmartLoaderSmartLoader
71SmartLoaderSmartLoaderSmartLoader
72Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 10.0; WOW64; Trident/7.0; Specula; Microsoft Outlook*Speculadefault user agent template for specula C2
73Mozilla/5.0 (compatible, MSIE 11, Windows NT 6.3; Trident/7.0; rv:11.0) like TsunamiWaveTsunamiTsunami C2 framework default UA
74tunnelto-clienttunneltotunnelto.dev client default user agent
75Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.0.0Tuoni C2Default user agent string for Tuoni C2
76*Dev-Tunnels-Service-*vscodecould be used when accessing a vscode dev tunnel - abused by attackers as a C2
77Yakit/1.0.0YakitWebShell
78Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0EmpireEmpire default User agents
79Mozilla/6.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205 Firefox/27.0 Iceweasel/25.3.0EmpireEmpire default User agents
Reference in New Issue View Git Blame Copy Permalink