network:proxy

Web proxy logs

Host type: Network devices and network sensors
Tier, as a whole: Recommended
Techniques: 0
Rules listed: 83
Events: 0

Why this tier

CISA/ASD priority source; OMB M-26-14 A2 (Network source and destination; our analysis); OMB M-26-14 A7 (Indicators of compromise; our analysis)

Standards and guidance naming this source

Requirement	Relation	Basis
OMB M-26-14: Network source and destination	Supports an activity	our analysis
OMB M-26-14: Indicators of compromise	Supports an activity	our analysis: URL indicators
ASD ACSC / CISA et al.: Priority enterprise log sources	priority_source	quoted: web proxies used by organisational users and service accounts

Techniques

No ATT&CK analytic names this source.

Rules

Splunk 3

Sigma 56

.Class Extension URI Ending Request by Andreas Hunkeler (@Karneades)
APT User Agent by Florian Roth (Nextron Systems), Markus Neis
APT40 Dropbox Tool User Agent by Thomas Patzke
Bitsadmin to Uncommon IP Server Address by Florian Roth (Nextron Systems)
Bitsadmin to Uncommon TLD by Florian Roth (Nextron Systems), Tim Shelton
CVE-2023-1389 Potential Exploitation Attempt - Unauthenticated Command Injection In TP-Link Archer AX21 by Nasreddine Bencherchali (Nextron Systems), Rohit Jain
CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy) by Andreas Braathen (mnemonic.io)
CVE-2023-46747 Exploitation Activity - Proxy by Nasreddine Bencherchali (Nextron Systems)
CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy by Nasreddine Bencherchali (Nextron Systems)
CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy by Nasreddine Bencherchali (Nextron Systems), Michael Haag (STRT)
Chafer Malware URL Pattern by Florian Roth (Nextron Systems)
Cisco ASA Exploitation Activity - Proxy by Swachchhanda Shrawan Poudel (Nextron Systems)
ComRAT Network Communication by Florian Roth (Nextron Systems)
Crypto Miner User Agent by Florian Roth (Nextron Systems)
Devil Bait Potential C2 Communication Traffic by Nasreddine Bencherchali (Nextron Systems)
Download From Suspicious TLD - Blacklist by Florian Roth (Nextron Systems)
Download From Suspicious TLD - Whitelist by Florian Roth (Nextron Systems)
Download from Suspicious Dyndns Hosts by Florian Roth (Nextron Systems)
EvilTokens PhaaS Kit Phishing Related Request - Proxy by uniqu3-us3r
Exploit Framework User Agent by Florian Roth (Nextron Systems)
F5 BIG-IP iControl Rest API Command Execution - Proxy by Nasreddine Bencherchali (Nextron Systems), Thurein Oo
Flash Player Update from Suspicious Location by Florian Roth (Nextron Systems)
Goofy Guineapig Backdoor Potential C2 Communication by Nasreddine Bencherchali (Nextron Systems)
HTTP Request With Empty User Agent by Florian Roth (Nextron Systems)
Hack Tool User Agent by Florian Roth (Nextron Systems)
HackTool - BabyShark Agent Default URL Pattern by Florian Roth (Nextron Systems)
HackTool - CobaltStrike Malleable Profile Patterns - Proxy by Markus Neis, Florian Roth (Nextron Systems)
HackTool - Empire UserAgent URI Combo by Florian Roth (Nextron Systems)
Malware User Agent by Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
OWASSRF Exploitation Attempt Using Public POC - Proxy by Nasreddine Bencherchali (Nextron Systems)
PUA - Advanced IP/Port Scanner Update Check by Axel Olsson
Potential Base64 Encoded User-Agent by Florian Roth (Nextron Systems), Brian Ingram (update)
Potential CVE-2023-36884 Exploitation - File Downloads by X__Junior
Potential CVE-2023-36884 Exploitation - URL Marker by X__Junior
Potential CVE-2023-36884 Exploitation Pattern by X__Junior
Potential CVE-2023-36884 URL Request Pattern Traffic by X__Junior
Potential Compromised 3CXDesktopApp Beaconing Activity - Proxy by Nasreddine Bencherchali (Nextron Systems)
Potential Compromised 3CXDesktopApp ICO C2 File Download by Nasreddine Bencherchali (Nextron Systems)
Potential Hello-World Scraper Botnet Activity by Joseph A. M.
Potential Information Disclosure CVE-2023-43261 Exploitation - Proxy by Nasreddine Bencherchali (Nextron Systems), Thurein Oo
Potential OWASSRF Exploitation Attempt - Proxy by Nasreddine Bencherchali (Nextron Systems)
Potential Operation Triangulation C2 Beaconing Activity - Proxy by Florian Roth (Nextron Systems)
Potential Peach Sandstorm APT C2 Communication Activity by X__Junior (Nextron Systems)
PwnDrp Access by Florian Roth (Nextron Systems)
Raw Paste Service Access by Florian Roth (Nextron Systems)
Rclone Activity via Proxy by Janantha Marasinghe
Small Sieve Malware Potential C2 Communication by Nasreddine Bencherchali (Nextron Systems)
Suspicious Base64 Encoded User-Agent by Nasreddine Bencherchali (Nextron Systems)
Suspicious External WebDAV Execution by Ahmed Farouk
Suspicious Network Communication With IPFS by Gavin Knapp
Suspicious User Agent by Florian Roth (Nextron Systems)
Telegram API Access by Florian Roth (Nextron Systems)
Ursnif Malware C2 URL Pattern by Thomas Patzke
Ursnif Malware Download URL Pattern by Thomas Patzke
Windows PowerShell User Agent by Florian Roth (Nextron Systems)
Windows WebDAV User Agent by Florian Roth (Nextron Systems)

Microsoft Sentinel 24

Events

No event-level rows: this source is tiered as a whole.