T1036.012 — Browser Fingerprint

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the…

Sub-technique of Masquerading (T1036).

Sigma detection rules (3)

T1036.012 Masquerading: Browser Fingerprint

title: "T1036.012 Masquerading: Browser Fingerprint"
id: ccf6744b-8fd1-45ee-ab8f-318eac62d56e
description: 'Browser fingerprint spoofing is not visible in Sysmon; uses proxy logs for known outdated/hardcoded User-Agent strings. (Data Component: Web Credential; baseline tier: proxy.) Tune using: HeaderSignatureMatch, UserAgentFingerprint, NonBrowserProcessList.'
references:
  - https://attack.mitre.org/techniques/T1036/012
author: Shahrukh Khan
date: 2026-05-24
license: MIT
tags:
  - attack.stealth
  - attack.t1036.012

logsource:
  category: proxy

detection:
  selection_spoofed_ua:
    c-useragent|contains:
      - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1'
      - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)'
      - 'Trident/7.0; rv:11.0) like Gecko'
  condition: selection_spoofed_ua

falsepositives:
  - Legacy/embedded devices with genuinely outdated UAs.

level: medium

T1036.012 Masquerading: Browser Fingerprint

title: "T1036.012 Masquerading: Browser Fingerprint"
id: dbb3fd39-209d-49eb-9b36-a81622730dee
description: 'Detection of Spoofed User-Agent / browser-attribute masquerading. auditd cannot see application-layer HTTP headers at all -- connect() only shows that a socket connection was made, not what headers rode over it -- so the previous rule (any curl/wget connect syscall) was really a generic "outbound HTTP client" detector mislabeled as fingerprint-spoofing. The closest defensible auditd-observable proxy is the command line itself: a non-browser CLI tool (curl/wget/python) invoked with an explicit User-Agent-setting flag whose value contains a browser-style UA string is a genuine, on-host signal of deliberate browser/OS attribute spoofing, unlike generic HTTP client usage. True inspection of the wire-level header value requires a proxy/web-gateway log (HeaderSignatureMatch, UserAgentFingerprint), which auditd cannot provide.'
references:
  - https://attack.mitre.org/techniques/T1036/012
author: Shahrukh Khan
date: 2026-01-19
license: MIT
tags:
  - attack.stealth
  - attack.t1036.012

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_tool:
    type: EXECVE
    a0|endswith:
      - '/curl'
      - '/wget'
      - '/python3'
  selection_ua_flag:
    - a1|contains: ['-A', '--user-agent']
    - a2|contains: ['-A', '--user-agent']
    - a3|contains: ['-A', '--user-agent']
    - a4|contains: ['-A', '--user-agent']
  selection_spoofed_value:
    - a1|contains: 'Mozilla/5.0'
    - a2|contains: 'Mozilla/5.0'
    - a3|contains: 'Mozilla/5.0'
    - a4|contains: 'Mozilla/5.0'
  condition: selection_tool and selection_ua_flag and selection_spoofed_value

falsepositives:
  - Automated QA/monitoring scripts and API clients that legitimately set a fixed browser-like User-Agent string for compatibility with User-Agent-sniffing web servers; auditd cannot inspect the actual header sent, so this only flags argv where a spoofed value is explicitly set on the command line.

level: low

T1036.012 Masquerading: Browser Fingerprint

title: "T1036.012 Masquerading: Browser Fingerprint"
id: 54ca3197-7e0e-4977-8486-edc37bae6b06
description: 'Detection of Spoofed User-Agent. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserAgentFingerprint, HeaderSignatureMatch.'
references:
  - https://attack.mitre.org/techniques/T1036/012
author: Shahrukh Khan
date: 2026-02-03
license: MIT
tags:
  - attack.stealth
  - attack.t1036.012

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    Image|endswith: '/curl'
  selection_port:
    DestinationPort: 443
  condition: selection and selection_port

falsepositives:
  - Command-line tools that legitimately make HTTPS requests, since actual User-Agent header content is not exposed by the unified log network_connection category.

level: medium

Related sub-techniques

Explore