huntrule

Suspicious HTTP Request With Empty User Agent (via proxy)

This rule detects a potentially anomalous empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

SigmamediumWebv1
sigma
title: Suspicious HTTP Request With Empty User Agent (via proxy)
id: ba2afc27-1a1e-5451-8cc9-768cab7f4b2c
status: stable
description: This rule detects a potentially anomalous empty user agent strings in proxy log. Could potentially indicate an uncommon request method.
references:
    - https://attack.mitre.org/techniques/T1071/001/
    - https://twitter.com/Carlos_Perez/status/883455096645931008
author: Huntrule Team
date: 2026-02-19
tags:
    - attack.command-and-control
    - attack.t1071.001
logsource:
    category: proxy
detection:
    selection:
        c-useragent: ''
    condition: selection
falsepositives:
    - Unknown
level: medium

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.