Anomalous User Agent connection attempt

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Identifies connection attempts (success or fail) from clients with very short or very long User Agent strings and with less than 100 connection attempts.

Attribute	Value
Type	Analytic Rule
Solution	Standalone Content
ID	f845881e-2500-44dc-8ed7-b372af3e1e25
Severity	Low
Kind	Scheduled
Tactics	InitialAccess
Techniques	T1190
Required Connectors	AzureMonitor(IIS)
Source	View on GitHub

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules