Non-browser HTTP client user agent in web traffic

Siemphony@siemphonylowT1071.001unverified

Matches Zeek http.log requests whose User-Agent identifies a scripting or library HTTP client rather than a browser, plus the obsolete "Mozilla/4.0 (compatible; MSIE" family that off-the-shelf C2 profiles still use to imitate one. This is the UserAgentAnomalies knob of AN0075 turned into logic, and the network view is chosen over the brief's Sysmon leg because the header only exists on the wire — a Sysmon EventID 3 record carries the process and the port and nothing about the request. The user agent list is authored for this rule; MITRE names the knob but supplies no values. Three limits belong in the reader's head before this is deployed: http.log holds cleartext HTTP only, so a C2 channel over HTTPS or a WebSocket upgraded inside TLS is invisible here and is what the brief's ssl.log and websocket.log sources exist for; a User-Agent is attacker-chosen and copying a current Chrome string defeats the rule entirely; and the beaconing, volume-ratio and byte-count discriminators the analytic leans on (OutboundByteRatioThreshold, BeaconIntervalWindow) need aggregation over time, which Sigma has no way to express, so this fires on a single request. There is also no direction test here: http.log carries requests in both directions, and where the sensor watches an internet-facing service the inbound scanners using these same libraries will outweigh anything leaving the estate, so the first tuning step is to constrain the originator to internal address space. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0027, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (user_agent="*python-requests*" OR user_agent="*python-urllib*" OR user_agent="*Go-http-client*" OR user_agent="*curl/*" OR user_agent="*Wget/*" OR user_agent="*libwww-perl*" OR user_agent="*Java/*" OR user_agent="*WindowsPowerShell*" OR user_agent="*PowerShell/*" OR user_agent="*WinHttp.WinHttpRequest*" OR user_agent="*Microsoft BITS*" OR user_agent="*Mozilla/4.0 (compatible; MSIE*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(user_agent) LIKE "*python-requests*" OR TO_LOWER(user_agent) LIKE "*python-urllib*" OR TO_LOWER(user_agent) LIKE "*go-http-client*" OR TO_LOWER(user_agent) LIKE "*curl/*" OR TO_LOWER(user_agent) LIKE "*wget/*" OR TO_LOWER(user_agent) LIKE "*libwww-perl*" OR TO_LOWER(user_agent) LIKE "*java/*" OR TO_LOWER(user_agent) LIKE "*windowspowershell*" OR TO_LOWER(user_agent) LIKE "*powershell/*" OR TO_LOWER(user_agent) LIKE "*winhttp.winhttprequest*" OR TO_LOWER(user_agent) LIKE "*microsoft bits*" OR TO_LOWER(user_agent) LIKE "*mozilla/4.0 (compatible; msie*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,zeek,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for zeek so this only evaluates relevant events. -->    <field name="user_agent" type="pcre2">(?i)(python-requests|python-urllib|Go-http-client|curl/|Wget/|libwww-perl|Java/|WindowsPowerShell|PowerShell/|WinHttp\.WinHttpRequest|Microsoft BITS|Mozilla/4\.0 \(compatible; MSIE)</field>    <description>Non-browser HTTP client user agent in web traffic</description>    <mitre>      <id>T1071.001</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"product":"zeek","service":"http"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: http / zeek
Level: low
Category: reverse_shell
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: ec95ccdd-c836-4ff6-85ec-fdf9d6366ea0

ATT&CKT1071.001

T1071.001Web Protocols

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

AN0075 names UserAgentAnomalies as a tuning knob — non-browser or spoofed user-agent headers on web traffic. This rule turns that one knob into logic: a Zeek http.log request whose User-Agent identifies a scripting or library HTTP client, or the obsolete Mozilla/4.0 (compatible; MSIE family that off-the-shelf C2 profiles still use to imitate a browser. Be blunt about what that is. This is a hygiene sweep for default-configured clients, not coverage of T1071.001. The whole discriminator is a header the adversary chooses; a copied current Chrome string defeats it with no other change to the channel. A match is a lead to triage against destination rarity and request cadence, not evidence of command and control.

02 · Telemetry you need

product: zeek / service: http, copied verbatim from AN0075. The network view is chosen over the brief's Sysmon leg because the header only exists on the wire — a Sysmon EventID 3 record carries process and port and nothing about the request. http.log holds cleartext HTTP only, so C2 inside TLS or an upgraded WebSocket is invisible here; that is what the brief's ssl.log and websocket.log sources are for. Splunk, Elastic and Wazuh render this rule; Sentinel refuses the logsource because no Zeek table is modelled, and that refusal is recorded rather than worked around.

03 · How the logic works

One selection, one field: user_agent|contains over twelve strings. There is no second clause — no port test, no destination test, no direction test. The list is authored for this rule. MITRE names the knob and supplies no values. It splits three ways: scripted clients (python-requests, python-urllib, Go-http-client, curl/, Wget/, libwww-perl, Java/), Windows-native transports (WindowsPowerShell, PowerShell/, WinHttp.WinHttpRequest, Microsoft BITS), and the one browser-spoof pattern. contains is deliberately broad and cuts both ways. curl/ matches any product that embeds libcurl and appends it to its own agent string, and Java/ matches every JVM client including sanctioned middleware. In the other direction the list has no okhttp, axios or node-fetch entry, which are the common current scripted clients — worth adding.

04 · Common false positives

Continuously. Monitoring, uptime and load-balancer health checks poll internal endpoints with curl or Wget every few seconds, and on any network with a monitoring stack that single source outweighs everything else the rule returns. That is why level is low.
Behind it: package managers, CI runners and container builds pulling dependencies over plain HTTP; BITS and WinHTTP components doing normal update and inventory work; legacy WinINet line-of-business apps still identifying as an old MSIE version.
The one that breaks calibration if missed: http.log records both directions, so a sensor in front of an internet-facing service sees inbound scanners and crawlers using these exact libraries, forever, with nothing internal beaconing.

05 · Detection maturity

tier_1: , the lowest tier, and it stays there until the rule has been run against real data. It was authored from a MITRE scaffold containing no query logic and has never been executed against a log line — the user-agent list is a plausible inventory, not a measured one.
tier_2: run it read-only, count matches by user agent and destination, and turn the result into the internal-source constraint and the poller exclusions.
tier_3: ** stop alerting on the header and use it as one feature beside destination rarity, POST ratio and interval jitter — the discriminators the analytic actually leans on.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Constrain the originator to internal address space first. Nothing else matters
Then exclude the pollers and build hosts by source address, not by shortening
Treat MITRE's ProcessNameExclusions knob as the host-side companion, and

Declared by the author

Monitoring, uptime and load-balancer health checks polling internal endpoints with curl or Wget every few seconds. On any network with a monitoring stack this single source outweighs everything else the rule returns, which is why the level here is low and why the first tuning step is to exclude the pollers by source address rather than to shorten the user agent list.
Package managers, CI runners and container builds pulling dependencies over plain HTTP from internal mirrors, which produce python-requests, Go-http-client and Java/ user agents in bulk from build hosts and registry proxies.
Windows software distribution and telemetry components: BITS transfers publish the Microsoft BITS string and WinHTTP-based agents publish the WinHttpRequest one, both as a normal part of update and inventory traffic.
Legacy intranet and line-of-business applications built on WinINet that still identify as an old MSIE version, which match the browser-spoof pattern with nothing unusual happening at all.
Inbound internet scanning and crawling of any web service the sensor sits in front of, which arrives with python-requests, Go-http-client and curl user agents continuously and has nothing to do with an internal host beaconing out.

Noise checknot tested

No baseline event covers this rule’s log type (http / zeek), so the rule was never evaluated. This is missing data, not a clean result — nothing was checked either way.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1071.001, evaluated against their — events.

Share this rule

/u/siemphony/ec95ccdd-c836-4ff6-85ec-fdf9d6366ea0

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Non-browser HTTP client user agent in web traffic

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it