ATT&CK T1036 - Suspicious Fake Browser User-Agent

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects HTTP requests where the User-Agent header appears to be faked or malformed. Specifically, it looks for a User-Agent string that starts with 'Mozilla/5.0' followed by an opening parenthesis, and then contains at least 200 characters before a closing parenthesis. This pattern is often used by malicious actors to evade detection by making their User-Agent string unusually long and potentially obfuscated, while still mimicking a common browser prefix.