User agent strings are identifiers used by browsers and other applications or systems that access web resources. They are unverified/unauthorised text strings, so what you see in a log does not categorically identify the application or system that connected as this can be spoofed, in fact many browsers have plugins that allow the user to specify the user agent, but on the whole user agent strings can help enrich the information in logs.
The issue is that there are many, many user agent strings in existence and parsing them and identifying their origins can be a PITA.
To this end I’ve searched around and asked the Twitterverse for some good resources that aid user agent identification.
If analysing M365 logs there will also be some mysterious useragent strings, typically poorly documented (if at all) which is a bummer.
A few I have come across:
| UA string | Description |
|---|---|
| CBAInProd | An application or device that signs in with basic authentication. This method was meant to de deprecated October 2020 but is still going. |
| BAVROPC | An application or device signing in with ROPC (the newer OAUTH2 method). For example, many modern IMAP or POP3 mail clients will use this method of authentication. |
| MSWAC | Appears to be the online versions of Office apps (tested with online version of Excel to generate this log entry). |
I’ll add more as I encounter and confirm them.
If you have any suggestions or strings to add send them to me @binarysleeper on Twitter.