Sigma rule: Potential Hello-World Scraper Botnet Activity

Rule

Title

Potential Hello-World Scraper Botnet Activity

Status

experimental

Level

medium

Author

Joseph A. M.

Date

2025-08-02

File

rules/web/proxy_generic/proxy_hello_world_user_agent.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.

Log source

category

proxy

Detection

selection:
    c-useragent: 'Hello-World/1.0'
    cs-method: 'GET'
condition: selection

False positives (as the rule lists them)

• Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.
• Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.

Tags

• attack.reconnaissance
• attack.t1595

MITRE ATT&CK ids this rule names

• T1595

References

• https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
• https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/proxy_generic/proxy_hello_world_user_agent.yml