HarborWatch Agent C2 Communication via Custom User-Agent

Ethan Andrews@eandrews

•updated Jun 8, 2026•2•0•8

This rule identifies web traffic containing the custom User-Agent string 'HarborWatchAgent', which is indicative of Command and Control (C2) communication by the HarborWatch Agent. It searches both endpoint network events and network appliance/proxy logs for this specific User-Agent string.