Proxy Traffic with Hello-World/1.0 User-Agent Using GET

Flags proxy GET requests using the Hello-World/1.0 user-agent, which may indicate automated scraping.

FreeUnreviewedSigmamediumv1

proxy-traffic-with-hello-world-1-0-user-agent-using-get-1712bafe

title: Proxy Traffic with Hello-World/1.0 User-Agent Using GET
id: 570b7871-bcc8-48a1-abe8-8bfa2ac6fe00
status: experimental
description: Identifies inbound proxy requests where the client uses the "Hello-World/1.0" user-agent and the HTTP method is GET. This behavior can be consistent with automated scraping activity, which attackers commonly use for reconnaissance, content collection, or reconnaissance at scale. The rule relies on proxy telemetry that includes HTTP method and user-agent strings.
references:
  - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
  - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_hello_world_user_agent.yml
author: Joseph A. M., Huntrule Team
date: 2025-08-02
tags:
  - attack.reconnaissance
  - attack.t1595
logsource:
  category: proxy
detection:
  selection:
    c-useragent: Hello-World/1.0
    cs-method: GET
  condition: selection
falsepositives:
  - Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.
  - Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.
level: medium
license: DRL-1.1
related:
  - id: 1712bafe-be05-4a0e-89d4-17a3ed151bf5
    type: derived

What it detects

Identifies inbound proxy requests where the client uses the "Hello-World/1.0" user-agent and the HTTP method is GET. This behavior can be consistent with automated scraping activity, which attackers commonly use for reconnaissance, content collection, or reconnaissance at scale. The rule relies on proxy telemetry that includes HTTP method and user-agent strings.

Known false positives

Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.
Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.