HTTP client asserting an obsolete Internet Explorer user agent

Siemphony@siemphonylowT1036.012unverified

AN2031 asks for outbound HTTP whose User-Agent has been shaped to look like a browser when the client is not one. Of the log sources in this strategy, Zeek http.log is the only one that records the header at all — Sysmon EventID 3 and EventID 22, offered by AN2029 for the same technique, carry connection and DNS metadata with no HTTP headers in them, so no selector written against those could ever see a User-Agent. The logic keys on the cheapest and most visible forgery: a client declaring itself as pre-IE11 Internet Explorer, or carrying the Mozilla/4.0 prefix, neither of which any currently shipping browser sends and both of which are long-standing hard-coded values in downloader and implant code. Note what is deliberately absent. A default PowerShell, curl or python-requests agent names its own stack, which is evidence that no browser identity was forged at all, so selecting on it would fill the rule with the negation of the technique it is filed under. The markers are authored here; MITRE names the knobs (HeaderSignatureMatch and UserAgentFingerprint) but supplies no values. Two limits are structural. An adversary who copies a current Chrome or Edge User-Agent verbatim is indistinguishable on this feed and this rule will not see them — it catches stale spoofing, not current spoofing. And the analytic's other half, that no browser appears in the process lineage, cannot be joined here at all, because Zeek carries no process identity and lib/sigma has no correlation to join it with. Prerequisite: the header is only visible in cleartext, so a sensor seeing TLS without interception logs the connection in conn.log and contributes nothing to http.log — zero rows on an HTTPS-dominant estate means blind, not quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0898, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (user_agent="*compatible; MSIE *" OR user_agent="*Mozilla/4.0*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(user_agent) LIKE "*compatible; msie *" OR TO_LOWER(user_agent) LIKE "*mozilla/4.0*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,zeek,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for zeek so this only evaluates relevant events. -->    <field name="user_agent" type="pcre2">(?i)(compatible; MSIE |Mozilla/4\.0)</field>    <description>HTTP client asserting an obsolete Internet Explorer user agent</description>    <mitre>      <id>T1036.012</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"product":"zeek","service":"http"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: http / zeek
Level: low
Category: masquerading
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: b50361d5-9864-4472-a956-a46a52e9828c

ATT&CKT1036.012

T1036.012Browser Fingerprint

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonmasquerading

masqueradingAI draft — unreviewed

01 · What this rule detects

The rule looks for outbound cleartext HTTP whose User-Agent claims to be a browser that no longer exists. MITRE's AN2031 asks for a client that has shaped its headers to look like a browser when it is not one; the cheapest and most visible version of that forgery is a hard-coded pre-IE11 Internet Explorer string, which downloader and implant code has carried for two decades. What the rule deliberately does not select on is as important. A default PowerShell, curl or python-requests agent names its own stack — that client has forged nothing, and selecting on it would fill the rule with the negation of the technique it is filed under. An earlier draft did exactly that and was corrected in review; unauthenticated non-browser HTTP is T1071.001 hunting, not this.

02 · Telemetry you need

The logsource is product: zeek, service: http, copied from the brief. Zeek is the only source in this strategy that records the header at all — Sysmon EventID 3 and EventID 22, offered by AN2029 for the same technique, carry connection and DNS metadata with no HTTP headers in them, so nothing written against those could ever see a User-Agent.
The prerequisite is structural: user_agent is populated only for cleartext HTTP. On a TLS-dominant estate without interception, Zeek records the flow in conn.log and http.log stays near-empty. Zero rows there means blind, not quiet. Note also that the rule is filed under AN2031 (Linux) because that is the only analytic whose sources carry a header, while the behaviour described sits closer to AN2029 (Windows non-GUI process). Zeek sees both, so this is not wrong, but the attribution is looser than it reads.

03 · How the logic works

One block, one field. selection matches user_agent|contains against two strings — 'compatible; MSIE ' and 'Mozilla/4.0' — and the condition is selection. No shipping browser sends either: IE11 dropped the MSIE token entirely, and the Mozilla/4.0 prefix has not been current since Netscape-era compatibility strings. Both markers are authored by this pipeline. MITRE names the knobs — HeaderSignatureMatch and UserAgentFingerprint — but supplies no values for either, so nothing in that list is sourced from ATT&CK. Two limits are worth stating before you trust a quiet result. An adversary who copies a current Chrome or Edge string verbatim is indistinguishable on this feed, and that is a one-line change in any implant and the default in most modern C2 profiles. This rule catches stale spoofing, not current spoofing. And AN2031's other half — no browser in the process lineage — cannot be joined here at all, because Zeek carries no process identity and lib/sigma has no correlation.

04 · Common false positives

The dominant population is legacy software built on WinINet, WinHTTP or an embedded IE control: printer and scanner utilities, older ERP and clinical clients, some Java and .NET installers. They still send Mozilla/4.0 (compatible; MSIE 7.0) and they call fixed hosts on a schedule. Behind them sit compatibility and site-monitoring tools that set an obsolete agent on purpose, and embedded appliances — badge readers, IP cameras, print servers — whose firmware string was never updated.
That first entry is why the rule ships at level: low. It is a hunting filter, not an alert.

05 · Detection maturity

tier_1: Lowest tier. This rule has never been executed against a log line, its two markers have never been counted against a real http.log, and its coverage is limited to careless tooling and older malware families. Scaffold, not detection.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline user_agent against destination host and source subnet, then exclude whole populations rather than individual strings: appliance segments, the scanner hosts, the vendor endpoints your legacy clients poll. What remains — an obsolete agent from a workstation, to a host nobody else contacts — is the interesting residue. A per-user-agent rarity baseline outside Sigma is the real upgrade path.

Declared by the author

Legacy line-of-business and vendor software built on WinINet, WinHTTP or an embedded Internet Explorer control, which is the highest-volume match by a wide margin and is what sets the level here. Printer and scanner utilities, older ERP and clinical clients, and some Java and .NET installers still identify themselves as Mozilla/4.0 (compatible; MSIE 7.0) or similar, and they call fixed internal or vendor hosts on a schedule.
Web compatibility and site-monitoring tooling that deliberately sets an obsolete Internet Explorer user agent to exercise legacy code paths, plus crawler, accessibility and vulnerability scanners configured the same way, arriving as bursts from a small and knowable set of scanner hosts.
Embedded appliances and firmware HTTP clients, such as badge readers, IP cameras, print servers and building-management controllers, whose fixed Mozilla/4.0 user agent was never updated and which poll vendor or internal endpoints at a steady low rate from segments with no interactive user.

Noise checknot tested

No baseline event covers this rule’s log type (http / zeek), so the rule was never evaluated. This is missing data, not a clean result — nothing was checked either way.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1036.012, evaluated against their — events.

Share this rule

/u/siemphony/b50361d5-9864-4472-a956-a46a52e9828c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

HTTP client asserting an obsolete Internet Explorer user agent

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it