Sigma rule: RedTail Cryptominer User-Agent

Rule

Title

RedTail Cryptominer User-Agent

Status

experimental

Level

medium

Author

Marco Pedrinazzi (@pedrinazziM) (InTheCyber)

Date

2026-04-30

File

rules-emerging-threats/2026/Malware/RedTail-Cryptominer/web_malware_redtail_useragent.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects inbound web requests using the "libredtail-http" User-Agent.
libredtail-http is a unique User-Agent string associated with a campaign of automated, malicious scans and attacks targeting exposed container environments and web applications,notably identified in activities stemming from late 2024 through early 2026.
It is primarily used by the RedTail cryptominer malware to identify and exploit vulnerabilities for deploying cryptocurrency miners.

Log source

category

webserver

Detection

selection:
    cs-user-agent: 'libredtail-http'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.t1190
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1190

References

• https://isc.sans.edu/diary/Danger+of+Libredtail+Guest+Diary/32936/
• https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/
• https://www.cloudsek.com/blog/honey-for-hackers-a-study-of-attacks-targeting-the-recent-cve-2026-21962-and-other-critical-weblogic-vulnerabilities-on-a-high-interactive-oracle-honeypot

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2026/Malware/RedTail-Cryptominer/web_malware_redtail_useragent.yml