++

Author: Aegrah

rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml

@@ -41,32 +41,35 @@ from
   logs-apache.access-*,
   logs-apache_tomcat.access-*,
   logs-iis.access-*
+
+| eval Esql.user_agent_original_lower = to_lower(user_agent.original)
+
 | where
     (url.original is not null or url.full is not null) and
   (
-		user_agent.original like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36" or // Nikto
-		user_agent.original like "nikto*" or // Nikto
-		user_agent.original like "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)" or // Nessus
-		user_agent.original like "sqlmap/*" or // SQLMap
-		user_agent.original like "WPScan *" or // WPScan
-		user_agent.original like "feroxbuster/*" or // Feroxbuster 
-		user_agent.original like "masscan*" or // Masscan & masscan-ng
-		user_agent.original like "Fuzz*" or // Ffuf
-		user_agent.original like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/user_agent.original like~ 87.0.4280.88 Safari/537.36" or // Dirsearch
-		user_agent.original like "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" or // Dirb
-		user_agent.original like "DirBuster*" or // Dirbuster
-		user_agent.original like "gobuster/*" or // Gobuster
-		user_agent.original like "*nmap*" or // Nmap Scripting Engine
-        user_agent.original like "*hydra*" or // Hydra Brute Forcer
-        user_agent.original like "*w3af*" or // w3af Web Application Attack and Audit Framework
-        user_agent.original like "*Arachni*" or // Arachni Web Application Security Scanner
-        user_agent.original like "*Skipfish*" or // Skipfish Web Application Security Scanner
-        user_agent.original like "*OpenVAS*" or // OpenVAS Vulnerability Scanner
-        user_agent.original like "*Acunetix*" or // Acunetix Vulnerability Scanner
-        user_agent.original like "*Nessus*" or // Nessus Vulnerability Scanner
-        user_agent.original like "*dirsearch*" or // dirsearch 
-        user_agent.original like "*ZAP*" or // OWASP ZAP 
-        user_agent.original like "*Burp*" // Burp Suite
+		Esql.user_agent_original_lower like "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/74.0.3729.169 safari/537.36" or // Nikto
+		Esql.user_agent_original_lower like "nikto*" or // Nikto 
+		Esql.user_agent_original_lower like "mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)" or // Nessus Vulnerability Scanner
+        Esql.user_agent_original_lower like "*nessus*" or // Nessus Vulnerability Scanner
+		Esql.user_agent_original_lower like "sqlmap/*" or // SQLMap
+		Esql.user_agent_original_lower like "wpscan*" or // WPScan
+		Esql.user_agent_original_lower like "feroxbuster/*" or // Feroxbuster 
+		Esql.user_agent_original_lower like "masscan*" or // Masscan & masscan-ng
+		Esql.user_agent_original_lower like "fuzz*" or // Ffuf
+		Esql.user_agent_original_lower like "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/user_agent.original like~ 87.0.4280.88 safari/537.36" or // Dirsearch
+		Esql.user_agent_original_lower like "mozilla/4.0 (compatible; msie 6.0; windows nt 5.1)" or // Dirb
+		Esql.user_agent_original_lower like "dirbuster*" or // Dirbuster
+		Esql.user_agent_original_lower like "gobuster/*" or // Gobuster
+        Esql.user_agent_original_lower like "*dirsearch*" or // dirsearch 
+		Esql.user_agent_original_lower like "*nmap*" or // Nmap Scripting Engine
+        Esql.user_agent_original_lower like "*hydra*" or // Hydra Brute Forcer
+        Esql.user_agent_original_lower like "*w3af*" or // w3af Web Application Attack and Audit Framework
+        Esql.user_agent_original_lower like "*arachni*" or // Arachni Web Application Security Scanner
+        Esql.user_agent_original_lower like "*skipfish*" or // Skipfish Web Application Security Scanner
+        Esql.user_agent_original_lower like "*openvas*" or // OpenVAS Vulnerability Scanner
+        Esql.user_agent_original_lower like "*acunetix*" or // Acunetix Vulnerability Scanner
+        Esql.user_agent_original_lower like "*zap*" or // OWASP ZAP 
+        Esql.user_agent_original_lower like "*burp*" // Burp Suite
   )
 
 | eval Esql.url_text  = case(url.original is not null, url.original, url.full)
@@ -79,19 +82,19 @@ from
     source.ip,
     agent.id,
     host.name,
-	Esql.url_lower
+	Esql.url_lower,
+    Esql.user_agent_original_lower
 | stats
     Esql.event_count = count(),
     Esql.url_path_count_distinct = count_distinct(Esql.url_lower),
     Esql.host_name_values = values(host.name),
     Esql.agent_id_values = values(agent.id),
     Esql.url_path_values = values(Esql.url_lower),
-    Esql.user_agent_original_values = values(user_agent.original),
+    Esql.user_agent_original_values = values(Esql.user_agent_original_lower),
     Esql.event_dataset_values = values(event.dataset)
     by source.ip, agent.id
 | where
     Esql.event_count > 50 and Esql.url_path_count_distinct > 10
-| limit 100
 '''
 
 [[rule.threat]]