Suspicious HTTP Scanner User-Agent Detected

Darshan Thummar@Mighty

•updated Jun 5, 2026•0•0•6

Detects HTTP requests with known scanner or automation user-agents commonly used by reconnaissance tools like Nikto, sqlmap, or curl-based scripts. This rule specifically looks for 'sqlmap', 'nikto', 'curl', and 'python-requests' within the HTTP User-Agent header.