APT ate my homeworkApr 28, 2017
Munin, Keeper of Lore

Today's incident: SIEM detects suspicious user-agent.

Tracing through the events, it looks like the cause is a user using a chinese browser to read chinese books.

Apr 27, 2017 at 5:18pmWeb
Show threadMunin, Keeper of LoreApr 27, 2017
As far as incidents go, this one's not so bad. And it provided a useful framework to talk about how the detection works.
Show threadAPT ate my homeworkApr 28, 2017
@munin tell me about it. The number of times I've seen "MALWARE CNC <malware x> User Agent" and it's turned out to be the original legit software that the malware was spoofing...
Show threadAPT ate my homeworkApr 28, 2017
@munin ... number of times I can recall it turning out to be actual malware: 0.