Proxy HTTP Requests With Empty User-Agent Header

Flags proxy HTTP traffic with an empty User-Agent header, which may indicate automation or unusual client behavior.

FreeUnreviewedSigmamediumv1

proxy-http-requests-with-empty-user-agent-header-21e44d78

title: Proxy HTTP Requests With Empty User-Agent Header
id: 14b6c638-cc17-4080-b4bd-7961ea81f93e
status: test
description: This rule flags HTTP requests in proxy logs where the User-Agent header is an empty string. Empty or missing User-Agent values can indicate automated tooling, non-browser clients, or atypical request construction used for command-and-control and other automation. The detection relies on proxy telemetry that records the HTTP header value for User-Agent.
references:
  - https://twitter.com/Carlos_Perez/status/883455096645931008
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_empty.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-07-08
modified: 2021-11-27
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
    c-useragent: ""
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 21e44d78-95e7-421b-a464-ffd8395659c4
    type: derived

What it detects

This rule flags HTTP requests in proxy logs where the User-Agent header is an empty string. Empty or missing User-Agent values can indicate automated tooling, non-browser clients, or atypical request construction used for command-and-control and other automation. The detection relies on proxy telemetry that records the HTTP header value for User-Agent.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.