Client Signature

AC-Hunter Client Signature

User Agent Names Are Sent as Part of HTTP Requests

Many environments maintain standards for both server and end-user computer configurations. This will cause the User Agent field to be consistent across those platforms. Unique user agents can be interesting in that they may identify a non-standard tool or browser being used on the network.

The Client Signature module is used to identify systems on your network that communicate in a unique fashion. While a unique signature is not always a telltale sign of a C2 channel, it occurs often enough that it is worth verifying.