Attacker Impersonating Vendor via API Call

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects HTTP traffic where the User-Agent header contains 'Microsoft', 'Google', or 'Amazon' (case-insensitive) and the Host header contains an IPv4 address. This combination could indicate an attacker impersonating a legitimate vendor's API client while making direct IP-based requests, potentially bypassing DNS-based security controls or targeting internal services.