huntrule

Proxy HTTP GET traffic using Hello-World/1.0 user-agent (possible scraper botnet)

Flags proxy GET requests using the Hello-World/1.0 user-agent, which may indicate automated scraping.

FreeReviewedSigma · Medium · v2
Category
proxy
Author
Joseph A. M. (SigmaHQ), DRL 1.1
Published
2025-08-02
Updated
2026-07-31
AnalysisDetection
title: Proxy HTTP GET traffic using Hello-World/1.0 user-agent (possible scraper botnet)
id: 570b7871-bcc8-48a1-abe8-8bfa2ac6fe00
status: experimental
description: This rule flags outbound proxy HTTP requests where the method is GET and the user-agent is exactly "Hello-World/1.0". Such automation can be used by scraping infrastructure to blend in with legitimate browsing patterns, making it valuable for identifying potential bot activity. It relies on proxy telemetry containing HTTP method and user-agent fields.
references:
  - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
  - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_hello_world_user_agent.yml
author: Joseph A. M., Huntrule Team
date: 2025-08-02
tags:
  - attack.reconnaissance
  - attack.t1595
logsource:
  category: proxy
detection:
  selection:
    c-useragent: Hello-World/1.0
    cs-method: GET
  condition: selection
falsepositives:
  - Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.
  - Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.
level: medium
license: DRL-1.1
related:
  - id: 1712bafe-be05-4a0e-89d4-17a3ed151bf5
    type: derived