Techniques › T1036.012 › AN2029
AN2029 Analytic 2029
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Process execution without GUI context (e.g., powershell.exe, wscript.exe) generates HTTP traffic with a spoofed User-Agent mimicking a legitimate browser. No corresponding UI application (e.g., msedge.exe) is active or in parent lineage. The User-Agent deviates from known enterprise baselines or contains spoofed platform indicators. User-Agent strings can be gathered with API calls such as
ShellExecuteW to open the default browser on a socket to receive an HTTP reply, or by hard coding the User-Agent string for a specific browser.</p>- Detects
- T1036.012 Browser Fingerprint
- Part of
- DET0898 Detection of Spoofed User-Agent
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| NSM:Flow | Inbound HTTP POST with suspicious payload size or user-agent | DC0085 Network Traffic Content |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| etw:Microsoft-Windows-Kernel-Process | API Calls | DC0021 OS API Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
HeaderSignatureMatch | Specific HTTP header anomalies or patterns (e.g., spoofed User-Agent). |
UserAgentFingerprint | Flag browser-based sessions |
NonBrowserProcessList | List of non-browser binaries expected not to initiate web requests (e.g., powershell.exe, cscript.exe) |