HTTP Request With Empty User Agent

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•29

Detects HTTP requests with an empty user agent string in proxy logs. This can indicate an uncommon or potentially malicious request method, as legitimate browsers and many applications typically send a user agent. PowerShell's `(New-Object Net.WebClient).DownloadString` is one example of a tool that might generate such a request.