detection.wiki

Detection rules › Sigma

Potential Hello-World Scraper Botnet Activity

Status
experimental
Severity
medium
Log source
category proxy
Author
Joseph A. M.
Source
github.com/SigmaHQ/sigma

Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.

MITRE ATT&CK coverage

TacticTechniques
ReconnaissanceT1595 Active Scanning

Rule body yaml

title: Potential Hello-World Scraper Botnet Activity
id: 1712bafe-be05-4a0e-89d4-17a3ed151bf5
status: experimental
description: |
    Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.
references:
    - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
    - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30
author: Joseph A. M.
date: 2025-08-02
tags:
    - attack.reconnaissance
    - attack.t1595
logsource:
    category: proxy
detection:
    selection:
        c-useragent: 'Hello-World/1.0'
        cs-method: 'GET'
    condition: selection
falsepositives:
    - Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.
    - Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    c-useragent: 'Hello-World/1.0'
    cs-method: 'GET'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
c-useragenteq
  • Hello-World/1.0
cs-methodeq
  • GET