sigmamediumHunting

Potential Hello-World Scraper Botnet Activity

Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.

MITRE ATT&CK

T1595

reconnaissance

Detection Query

selection:
  c-useragent: Hello-World/1.0
  cs-method: GET
condition: selection

Author

Joseph A. M.

Created

2025-08-02

Data Sources

proxy

References

Tags

attack.reconnaissanceattack.t1595

Raw Content

title: Potential Hello-World Scraper Botnet Activity
id: 1712bafe-be05-4a0e-89d4-17a3ed151bf5
status: experimental
description: |
    Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.
references:
    - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
    - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30
author: Joseph A. M.
date: 2025-08-02
tags:
    - attack.reconnaissance
    - attack.t1595
logsource:
    category: proxy
detection:
    selection:
        c-useragent: 'Hello-World/1.0'
        cs-method: 'GET'
    condition: selection
falsepositives:
    - Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.
    - Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.
level: medium