Webserver detection of libredtail-http User-Agent inbound requests

title: Webserver detection of libredtail-http User-Agent inbound requests
id: 8f61077c-652b-422c-8a5a-54dcfeb68193
status: experimental
description: This rule flags inbound web requests with the User-Agent string set to "libredtail-http". Using a consistent, campaign-specific User-Agent helps automated scanners and malicious tooling blend into web traffic while probing exposed services. The detection relies on webserver request telemetry that includes the HTTP User-Agent field.
references:
  - https://isc.sans.edu/diary/Danger+of+Libredtail+Guest+Diary/32936/
  - https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/
  - https://www.cloudsek.com/blog/honey-for-hackers-a-study-of-attacks-targeting-the-recent-cve-2026-21962-and-other-critical-weblogic-vulnerabilities-on-a-high-interactive-oracle-honeypot
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/RedTail-Cryptominer/web_malware_redtail_useragent.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-04-30
tags:
  - attack.initial-access
  - attack.t1190
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-user-agent: libredtail-http
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6fd25dd1-527b-47c8-baa4-2a0e77279c6f
    type: derived