Cycbot User-Agent Traffic

[LCMember1607]

I couldn't find this in the threat database.

This is showing up in my Threat log?

Any ideas what this threat is?

[tettema · Accepted solution]

Hi Bill,

This is a signature for the Cycbot C2 traffic.  See http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Backdoor:Win32/Cycbot.B for more information.  The signature detects the user-agent string used in Cycbot phone-home HTTP traffic.