Webserver detection: User-Agent contains known recon and scanning tool strings

title: "Webserver detection: User-Agent contains known recon and scanning tool strings"
id: fb2b0963-8015-4f3f-98db-f2fc9a482a78
status: test
description: This rule flags webserver HTTP requests whose User-Agent header contains strings associated with common reconnaissance and vulnerability scanning tools. Attackers often use these tools to enumerate services, discover endpoints, and probe for weaknesses, making distinctive client identifiers valuable for early detection. It relies on webserver telemetry that includes the HTTP User-Agent field and matches it against the configured substrings.
references:
  - https://github.com/commixproject/commix/blob/c7f1447371524427bb30abe731235acc7386153b/src/utils/settings.py#L281
  - https://github.com/epi052/feroxbuster/blob/ffdf871abe0a358a1531ba4135e208d4dbe8fc31/src/config/utils.rs#L100
  - https://github.com/ffuf/ffuf/blob/ce3cf6bd733a24d3a9f024305234c1a6298198eb/pkg/runner/simple.go#L130
  - https://github.com/lanmaster53/recon-ng/blob/9e907dfe09fce2997f0301d746796408e01a60b7/recon/core/base.py#L92
  - https://github.com/nmap/nmap/blob/2e47fa87469fd358ef64689d2d2de7294e385eb8/nselib/http.lua#L160
  - https://github.com/OJ/gobuster/blob/d20300cc46096984565e82fb73a45bf8d281b990/libgobuster/helpers.go#L124
  - https://github.com/sqlmapproject/sqlmap/blob/be216041e2f255ae43b050d466bd5bf92681e665/lib/core/settings.py#L29
  - https://github.com/sullo/nikto/blob/999670cb6a939b6c93840ce666941756e4c5dcf5/program/plugins/nikto_core.plugin#L3515
  - https://github.com/urbanadventurer/WhatWeb/blob/d279d93042d034f3fd29d5a893d44ccc0595d3f8/lib/whatweb.rb#L68
  - https://github.com/wpscanteam/wpscan/blob/4f1ce142b9768044be3e35bd0cddf1052e35efe8/lib/wpscan/browser.rb#L32
  - https://github.com/xmendez/wfuzz/blob/2263cd0932fef333118cd197656f709141bab615/src/wfuzz/facade.py#L43
  - https://github.com/zmap/zgrab2/blob/e91fc9860ca6611eb7c6fe7d2fe2be70212a37ba/modules/http/scanner.go#L54
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_susp_useragents.yml
author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton, Huntrule Team
date: 2022-07-19
modified: 2026-06-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-user-agent|contains:
      - commix/
      - feroxbuster/
      - Fuzz Faster U Fool
      - GIS - AppSec Team - Project Vision
      - gobuster/
      - Nikto/
      - Nmap Scripting Engine
      - Recon-ng/v
      - sqlmap/
      - WhatWeb/
      - Wfuzz/
      - WPScan v
      - zgrab/
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 19aa4f58-94ca-45ff-bc34-92e533c0994a
    type: derived