Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added user agent related to nim backdoor used by APT-Q-39 #4561

Closed
wants to merge 2 commits into from

Conversation

MalGamy
Copy link
Contributor

@MalGamy MalGamy commented Nov 9, 2023

Summary of the Pull Request

This PR adds new user agent related to nim backdoor used by APT-Q-39

Changelog

update: add new user agent related to nim backdoor used by APT-Q-39

Example Log Event

N/A

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these [conventions]

@github-actions github-actions bot added the Rules label Nov 9, 2023
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Welcome @MalGamy 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

@MalGamy MalGamy changed the title Add user agent related to nim backdoor used by APT-Q-39 Added user agent related to nim backdoor used by APT-Q-39 Nov 9, 2023
@nasbench nasbench self-requested a review November 9, 2023 16:11
@nasbench nasbench self-assigned this Nov 9, 2023
@nasbench nasbench added the Work In Progress Some changes are needed label Nov 9, 2023
@nasbench nasbench removed their request for review November 9, 2023 16:27
@nasbench nasbench removed the Work In Progress Some changes are needed label Nov 9, 2023
@nasbench
Copy link
Member

nasbench commented Nov 9, 2023

Hey @MalGamy thanks for opening this first PR.

Unfortunately we can't use this UA as its used by legitimate browsers as well. See this ref

Closing this as this reason. Thanks once again.

@nasbench nasbench closed this Nov 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants