Potential Hello-World Scraper Botnet Activity — Sigma Rule

Rule metadata and linked tags

Author: Joseph A. M.. Source status: experimental; severity: medium. Source dates: 2025-08-02 / not supplied.

{
  "category": "proxy"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 9fd2b9fb41d59b4c75d5b05e525da860a649270a88fd874c632d691e63fa2f56

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Potential Hello-World Scraper Botnet Activity
id: 1712bafe-be05-4a0e-89d4-17a3ed151bf5
status: experimental
description: |
    Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.
references:
    - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
    - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30
author: Joseph A. M.
date: 2025-08-02
tags:
    - attack.reconnaissance
    - attack.t1595
logsource:
    category: proxy
detection:
    selection:
        c-useragent: 'Hello-World/1.0'
        cs-method: 'GET'
    condition: selection
falsepositives:
    - Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.
    - Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.
level: medium

Original YAML and metadata in JSON

False positives

• Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.
• Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.

Source references

• https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
• https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30