Missing User-Agent Header WAF Rule by crowdsecurity | CrowdSec Hub

Missing User-Agent Header

WAF rulehttp:likely-botMITRE T1595MITRE T1190

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/experimental-no-user-agent

Protect against no user agent

Install with a top-level collection

1 collection include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios, via WAF - Generic Rules.

View NPMplus →

Installation

sudo cscli appsec-rules install crowdsecurity/experimental-no-user-agent

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

appsec-rules/crowdsecurity/experimental-no-user-agent.yaml· 33 linesGitHub

1name: crowdsecurity/experimental-no-user-agent
2description: "Protect against no user agent"
3rules:1
4## Useragent header does not exist
5  - and:
6      - zones:2
7        - METHOD
8        match:3
9          type: regex
10          value: '^GET|POST|PUT|DELETE|PATCH$'
11      - zones:2
12        - HEADERS
13        variables:
14         - "User-Agent"
15        transform:4
16          - count
17        match:3
18          type: equals
19          value: "0"
20
21
22
23    
24labels:5
25   type: exploit
26   service: http
27   confidence: 0
28   spoofable: 0
29   behavior: "http:likely-bot"
30   label: "Missing User-Agent Header"
31   classification:
32     - attack.T1595
33     - attack.T1190

Missing User-Agent Header

Installation

Configuration

Installed on

Know where it runs