Webserver User-Agent Identifies Known Recon and Scanning Tool Strings

title: Webserver User-Agent Identifies Known Recon and Scanning Tool Strings
id: fb2b0963-8015-4f3f-98db-f2fc9a482a78
status: test
description: This rule flags webserver requests whose User-Agent contains strings commonly associated with reconnaissance and scanning tools. Attackers often use automated scanners to enumerate services, discover vulnerabilities, or identify targets before exploitation. It relies on webserver telemetry that records HTTP request headers, specifically the User-Agent field, and matches against a set of predefined substrings.
references:
  - https://github.com/commixproject/commix/blob/c7f1447371524427bb30abe731235acc7386153b/src/utils/settings.py#L281
  - https://github.com/epi052/feroxbuster/blob/ffdf871abe0a358a1531ba4135e208d4dbe8fc31/src/config/utils.rs#L100
  - https://github.com/ffuf/ffuf/blob/ce3cf6bd733a24d3a9f024305234c1a6298198eb/pkg/runner/simple.go#L130
  - https://github.com/lanmaster53/recon-ng/blob/9e907dfe09fce2997f0301d746796408e01a60b7/recon/core/base.py#L92
  - https://github.com/nmap/nmap/blob/2e47fa87469fd358ef64689d2d2de7294e385eb8/nselib/http.lua#L160
  - https://github.com/OJ/gobuster/blob/d20300cc46096984565e82fb73a45bf8d281b990/libgobuster/helpers.go#L124
  - https://github.com/sqlmapproject/sqlmap/blob/be216041e2f255ae43b050d466bd5bf92681e665/lib/core/settings.py#L29
  - https://github.com/sullo/nikto/blob/999670cb6a939b6c93840ce666941756e4c5dcf5/program/plugins/nikto_core.plugin#L3515
  - https://github.com/urbanadventurer/WhatWeb/blob/d279d93042d034f3fd29d5a893d44ccc0595d3f8/lib/whatweb.rb#L68
  - https://github.com/wpscanteam/wpscan/blob/4f1ce142b9768044be3e35bd0cddf1052e35efe8/lib/wpscan/browser.rb#L32
  - https://github.com/xmendez/wfuzz/blob/2263cd0932fef333118cd197656f709141bab615/src/wfuzz/facade.py#L43
  - https://github.com/zmap/zgrab2/blob/e91fc9860ca6611eb7c6fe7d2fe2be70212a37ba/modules/http/scanner.go#L54
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_susp_useragents.yml
author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton, Huntrule Team
date: 2022-07-19
modified: 2026-06-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-user-agent|contains:
      - commix/
      - feroxbuster/
      - Fuzz Faster U Fool
      - GIS - AppSec Team - Project Vision
      - gobuster/
      - Nikto/
      - Nmap Scripting Engine
      - Recon-ng/v
      - sqlmap/
      - WhatWeb/
      - Wfuzz/
      - WPScan v
      - zgrab/
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 19aa4f58-94ca-45ff-bc34-92e533c0994a
    type: derived