Proxy HTTP Requests with Empty User-Agent Header

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule flags HTTP proxy log events where the User-Agent header is present but empty. Attackers and automation frameworks may generate abnormal or minimal HTTP client fingerprints to blend in or hide intent, making empty user agents a useful anomaly signal. The detection relies on proxy log telemetry capturing the request’s user agent field exactly as an empty string.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Suspicious Whisper Backdoor Log File in Windows Temp

Suspicious Lunar Backdoor State File Creation via File System

Malicious OilRig OAuth Application Sign-In via Azure (via azure)

Malicious FIN7 DiceLoader C2 via Placeholder User-Agent (via proxy)

Malicious D3f@ck Loader C2 via Java User-Agent Ready Beacon (via proxy)

Suspicious AddInProcess32 Outbound Connection after Process Hollowing

Suspicious microsoftedgeupdatecore Outbound Connection from Wrong Path

Suspicious RegAsm or AppLaunch Outbound Connection after Injection

Malicious FakeBat Distribution Domain Lookup (via dns_query)

Proxy HTTP Requests with Empty User-Agent Header

Pivot detection · T1071.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

proxy-http-requests-with-empty-user-agent-header-21e44d78

title: Proxy HTTP Requests with Empty User-Agent Header
id: 14b6c638-cc17-4080-b4bd-7961ea81f93e
status: test
description: This rule flags HTTP proxy log events where the User-Agent header is present but empty. Attackers and automation frameworks may generate abnormal or minimal HTTP client fingerprints to blend in or hide intent, making empty user agents a useful anomaly signal. The detection relies on proxy log telemetry capturing the request’s user agent field exactly as an empty string.
references:
  - https://twitter.com/Carlos_Perez/status/883455096645931008
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_empty.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-07-08
modified: 2021-11-27
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
    c-useragent: ""
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 21e44d78-95e7-421b-a464-ffd8395659c4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL