SignalHunt
← All rules

WEB-6001

medium

Known Vulnerability Scanner User-Agent

Detects a request carrying the default User-Agent string of a common vulnerability scanning tool - low-effort attackers and automated scanners frequently don't bother changing the tool's default identity.

T1595.002

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "user_agent|contains": [
      "sqlmap",
      "Nikto",
      "Nmap Scripting Engine"
    ]
  }
}

Log source: category=web_server · Event ID(s): access_log

Required log fields

  • client_ip
  • user_agent
  • uri

Enabling this in your environment

Where: Web server (Apache/Nginx/IIS) access log configuration - ensure the User-Agent header is included in the log format.

# Apache: LogFormat directive must include %{User-agent}i

Default Apache/Nginx combined log formats already include User-Agent - this is usually already available without config changes.

False positives

  • An authorized internal vulnerability scan or pentest engagement using the same tooling without an IP allow-list exception configured

References