detection.wiki

Detection rules › Sigma

Potential Hello-World Scraper Botnet Activity

Status
experimental
Severity
medium
Log source
category proxy
Author
Joseph A. M.
Source
github.com/SigmaHQ/sigma

Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.

Known false positives

  • Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.
  • Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.

MITRE ATT&CK coverage

TacticTechniques
Reconnaissance

Rule body

title: Potential Hello-World Scraper Botnet Activity
id: 1712bafe-be05-4a0e-89d4-17a3ed151bf5
status: experimental
description: |
    Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.
references:
    - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
    - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30
author: Joseph A. M.
date: 2025-08-02
tags:
    - attack.reconnaissance
    - attack.t1595
logsource:
    category: proxy
detection:
    selection:
        c-useragent: 'Hello-World/1.0'
        cs-method: 'GET'
    condition: selection
falsepositives:
    - Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.
    - Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    c-useragent: 'Hello-World/1.0'
    cs-method: 'GET'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
c-useragenteq
  • Hello-World/1.0
field:"c-useragent" kind:eq value:"Hello-World/1.0"
cs-methodeq
  • GET
field:"cs-method" kind:eq value:"GET"