threat-intel
User-Agent Analysis: Spotting Bots, Scanners, Scripted Clients and C2
Info
Summary
This article focuses on using User-Agent (UA) analysis as a hunting technique to identify malicious activity. The core strategy involves parsing UAs, counting their occurrences, and checking for inconsistencies with other headers and network behavior to identify suspicious hosts and potential C2 beacons. The article details several techniques, including stack counting, internal consistency checks, and correlating UAs with process names, to prioritize investigations and avoid blocking legitimate software.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data