Malicious User Agent Detected

Description: 

This alert monitors all inbound user agent strings communicating with GCP web services. This is a confident indication that the website is being attacked from a 3rd party. 

Based on the user agent string we look for well-known attacking tools for web applications. Example - NMAP, Nikto, ZAP, etc. This shows the source IP of the attacker. 

Solution: 

Our recommendation is to ensure you have no web application vulnerabilities, if you are unsure how to scan for web application vulnerabilities please contact Cybersec@columbia.edu. Additionally, we recommend the GCP account owner review their application logs for any suspicious from the source IP attacking the site.  If this activity is undesirable it would be beneficial for GCP account owners to build a Network ACL blocking the IP. 

Reference: 

• https://www.sans.org/reading-room/whitepapers/hackers/paper/33874

• https://core.ac.uk/download/pdf/76529027.pdf