Possible Hello-World Scraper Botnet Behavior (via proxy)

title: Possible Hello-World Scraper Botnet Behavior (via proxy)
id: 80eaebb2-1c5d-5c97-9b58-e9585a6ff3f0
status: stable
description: This rule detects network traffic potentially linked with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.
references:
    - https://attack.mitre.org/techniques/T1595/
    - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
    - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30
author: Huntrule Team
date: 2026-03-06
tags:
    - attack.reconnaissance
    - attack.t1595
logsource:
    category: proxy
detection:
    selection:
        c-useragent: 'Hello-World/1.0'
        cs-method: 'GET'
    condition: selection
falsepositives:
    - Unknown
level: medium