title: Scripting Engine User-Agent Seen At The Proxy
id: d5ff4ec6-2e67-4e3b-8ec1-9c0584c269b1
status: experimental
description: |
  Detects outbound web requests whose user agent is the default of a scripting engine or a
  living-off-the-land download tool rather than a browser. A workstation fetching from the
  internet with the PowerShell, certutil or BITS default agent is a download cradle until shown
  otherwise.
references:
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1105/
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1105
logsource:
  category: proxy
detection:
  selection:
    c-useragent|contains:
      - 'WindowsPowerShell/'
      - 'Microsoft BITS/'
      - 'CertUtil URL Agent'
      - 'Microsoft-CryptoAPI/'
      - 'python-requests/'
      - 'curl/'
      - 'Wget/'
  filter_main_microsoft:
    cs-host|endswith:
      - '.microsoft.com'
      - '.windowsupdate.com'
      - '.windows.com'
      - '.digicert.com'
      - '.msftconnecttest.com'
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Certificate revocation checks use the CryptoAPI agent against many CAs, so expect to extend the host filter with the OCSP and CRL hosts your estate actually contacts.
  - Developer workstations and build servers. Scope the rule to user subnets, or route those hosts to a lower severity.
level: low