Webserver Alerts for libredtail-http User-Agent HTTP Requests
Alerts on web requests carrying the "libredtail-http" User-Agent, indicating likely automated malicious probing.
- Category
- webserver
- Author
- Marco Pedrinazzi (@pedrinazziM) (InTheCyber) (SigmaHQ), DRL 1.1
- Published
- 2026-04-30
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies inbound web requests where the HTTP User-Agent is exactly "libredtail-http". Attackers and automated scanners may use this distinctive string as part of malicious probing and exploitation chains, including cryptocurrency miner deployment. The detection relies on webserver logs that capture the client User-Agent field for each HTTP request.
Reporting behind it
- isc.sans.eduhttps://isc.sans.edu/diary/Danger+of+Libredtail+Guest+Diary/32936/
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/
- cloudsek.comhttps://www.cloudsek.com/blog/honey-for-hackers-a-study-of-attacks-targeting-the-recent-cve-2026-21962-and-other-critical-weblogic-vulnerabilities-on-a-high-interactive-oracle-honeypot
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/RedTail-Cryptominer/web_malware_redtail_useragent.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Webserver Alerts for libredtail-http User-Agent HTTP Requests
id: 8f61077c-652b-422c-8a5a-54dcfeb68193
status: experimental
description: This rule identifies inbound web requests where the HTTP User-Agent is exactly "libredtail-http". Attackers and automated scanners may use this distinctive string as part of malicious probing and exploitation chains, including cryptocurrency miner deployment. The detection relies on webserver logs that capture the client User-Agent field for each HTTP request.
references:
- https://isc.sans.edu/diary/Danger+of+Libredtail+Guest+Diary/32936/
- https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/
- https://www.cloudsek.com/blog/honey-for-hackers-a-study-of-attacks-targeting-the-recent-cve-2026-21962-and-other-critical-weblogic-vulnerabilities-on-a-high-interactive-oracle-honeypot
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/RedTail-Cryptominer/web_malware_redtail_useragent.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-04-30
tags:
- attack.initial-access
- attack.t1190
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-user-agent: libredtail-http
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 6fd25dd1-527b-47c8-baa4-2a0e77279c6f
type: derived