Skip to content

Instantly share code, notes, and snippets.

@pwnmeow

pwnmeow/Native-Windows-Useragents-malicious.txt

Forked from jivoi/Native-Windows-Useragents-malicious.txt
Created August 1, 2019 01:21
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save pwnmeow/a4a5ab352420d1a239ffb173514a2b92 to your computer and use it in GitHub Desktop.
Save pwnmeow/a4a5ab352420d1a239ffb173514a2b92 to your computer and use it in GitHub Desktop.
Download ZIP
Native Windows UserAgents for Threat Hunting
Raw
Native-Windows-Useragents-malicious.txt
//Invoke-WebRequest in Powershell - manually whitelist legit content first:
Mozilla/*WindowsPowerShell/*
System.Net.WebClient.DownloadFile():
None
//Start-BitsTransfer - manually whitelist legit content first:
Microsoft BITS/*
//certutil.exe - manually whitelist legit content first:
"Microsoft-CryptoAPI/*" & "CertUtil URL Agent"
//regsvr32.exe (unreliable)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)
//Empire Powershell - should never trigger
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Mozilla/6.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205 Firefox/27.0 Iceweasel/25.3.0
Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.0
//MSIexec
Windows_Installer
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment