Norma User Agent

Rule Info

Name
Norma User Agent
Author
X__Junior
Description
Detects Norma user agent strings in proxy logs, an engine that turns a language model into an autonomous agent. It runs a streaming tool-use loop that lets the model read, execute, and reason its way through a task, while the operator retains control over the prompt, the available tools, and the safety boundary. Norma is not malicious on its own.
Date
2026-10-28 00:00:00
Modified
None
Id
a014dd23-48f1-48f5-b6f9-c084fe209a56
Tags
attack.command-and-control attack.t1071.001
Type
Nextron Sigma feed only (private)

Rule History