- When a normal Firefox engine engages with a web page and performs any kind of request (POST/GET) the User-Agent is set to 'Mozilla (Version)'. However, with some generic malware, they try to disguise their actions by having the User-Agent set to a browser but was poorly executed and set to Firefox instead of Mozilla. The sensor flags this mistake and deems any User-Agent that is set to Firefox as malicious as any legitimate request from a Firefox browser will have the User-Agent set to Mozilla.
- Port 80 HTTP
Known False Positive Indicators
- www.songlyrics.com (Web page for listening to music, and gathering song lyrics)- Web page determines browser but poorly coded to label Firefox as (Firefox) instead of (Mozilla). This appears malicious to the Sentinel and thus gets flagged and blocked accordingly.
MALWARE User-Agent (Firefox) - Possible Trojan Downloader
- None available as this user-agent is seen with generic malware that can fall under many categories.