huntrule

Proxy HTTP Requests with Empty User-Agent Header

Flags proxy HTTP traffic with an empty User-Agent header, which may indicate automation or unusual client behavior.

FreeReviewedSigma · Medium · v2
Category
proxy
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2017-07-08
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags HTTP proxy log events where the User-Agent header is present but empty. Attackers and automation frameworks may generate abnormal or minimal HTTP client fingerprints to blend in or hide intent, making empty user agents a useful anomaly signal. The detection relies on proxy log telemetry capturing the request’s user agent field exactly as an empty string.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange
Suspicious Whisper Backdoor Log File in Windows Temp
Suspicious Lunar Backdoor State File Creation via File System
Malicious OilRig OAuth Application Sign-In via Azure (via azure)
Malicious FIN7 DiceLoader C2 via Placeholder User-Agent (via proxy)
Malicious D3f@ck Loader C2 via Java User-Agent Ready Beacon (via proxy)
Suspicious AddInProcess32 Outbound Connection after Process Hollowing
Suspicious microsoftedgeupdatecore Outbound Connection from Wrong Path
Suspicious RegAsm or AppLaunch Outbound Connection after Injection
Malicious FakeBat Distribution Domain Lookup (via dns_query)
Proxy HTTP Requests with Empty User-Agent Header
Pivot detection · T1071.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.