Web Proxies, User-Agent Strings, and Malware Detection
Summary: Cisco Talos describes how watching for known malicious User-Agent strings in HTTP requests can identify malware-infected machines talking to command and control servers, and notes the VRT has seen countless such declarations in the wild, including one request reading "User-Agent: Malware." Talos also found a BlueCoat Proxy rewriting all client User-Agent strings to "Mozilla/4.0 (compatible;)," which generated false positives with SID 21444 - a rule since fixed after an automated rule-checking process unintentionally stripped a space before the closing parenthesis.
What's compelling: If your IDS sits after a proxy that rewrites User-Agent strings, it will never see the indicators it was built to catch, leaving you with a false sense of security about infected clients on your network.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026