USER AGENTS

OVERVIEW

Identifying anomalous user agent strings

SPLUNK> Search & Reporting
 SPL: index=main sourcetype=web_traffic
 DTG: All time
 Events:
  Interesting Fields: user_agent 

FILTER

This excludes common legitimate user agents from the results and only show the suspicious ones

SPLUNK> Search & Reporting
 SPL: index=main sourcetype=web_traffic user_agent!=*Mozilla* user_agent!=*Chrome* user_agent!=*Safari* user_agent!=*Firefox*
 DTG: All time
 Events:
  Interesting Fields: user_agent
  
 * OUTPUT
    Values	                              Count	    %	 
    Wget/1.21.4	                          1,240	    15.744%	
    zgrab/0.x	                            1,238	    15.719%	
    curl/7.88.1	                          1,220	    15.49%	
    Go-http-client/1.1	                  1,201	    15.249%	
    Havij/1.17 (Automated SQL Injection)	  993	    12.608%	
    sqlmap/1.7.9#stable (http://sqlmap.org)	967	    12.278%	
    python-requests/2.28.1	                510	    6.475%	
    Ruby/2.7.0 (Webshell Runner)	          507	    6.437%

IP ADDRESSES

This identifies client ip addresses accessing the web server

SPLUNK> Search & Reporting
 SPL: index=main sourcetype=web_traffic user_agent!=*Mozilla* user_agent!=*Chrome* user_agent!=*Safari* user_agent!=*Firefox*
 DTG: All time
 Events:
  Interesting Fields: client_ip
  
 * OUTPUT
    Values	        Count	  %	 
    198.51.100.55	  7,876	  100%

PATH

This contains the URI being requested and accessed by the client IPs.

SPLUNK> Search & Reporting
 SPL: index=main sourcetype=web_traffic user_agent!=*Mozilla* user_agent!=*Chrome* user_agent!=*Safari* user_agent!=*Firefox*
 DTG: All time
 Events:
  Interesting Fields: path
  
 * OUTPUT
    Top 10 Values	                            Count	  %	 
    /search?q=test	                          666	    8.456%	
    /item.php?id=1	                          661	    8.392%	
    /item.php?id=1 AND SLEEP(5)--	            660	    8.38%	
    /download?file=../../etc/passwd	          658	    8.354%	
    /search.php?q=test'%20AND%20SLEEP(5)--	  639	    8.113%	
    /?redirect=http://evil.site	              633	    8.037%	
    /server-status	                          497	    6.31%	
    /.git/config	                            490	    6.221%	
    /.env	                                    484	    6.145%	
    /phpinfo.php	                            470	    5.967%