# xway_ir IOC - Webshell 工具默认 User-Agent
# 来源:冰蝎 v3.0 / 蚁剑 v2.1 / Chopper / Cknife 公开特征
# 用法:grep -hE "$(load_ioc_pattern lib/iocs/behinder_uas.txt)" access.log
# 备注:UA 是访问日志最稳定的工具指纹,即使流量加密也能识别

# --- 冰蝎 Behinder ---
Behinder
behinder

# --- 蚁剑 AntSword ---
antSword
AntSword
antSword/v2
antSword/v2.1

# --- 中国菜刀 Chopper / Caidao ---
Chopper
caidao
Caidao

# --- Cknife ---
Cknife
cknife

# --- Godzilla 哥斯拉 ---
Godzilla
godzilla

# --- 天蝎天蝎 ---
天蝎
TianXie

# --- 蚁剑完整 UA (Chrome 伪装,末尾仍带 antSword) ---
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 antSword
