Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a local pySigma backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,779
Ready to search
Backends
3
Loaded from pysigma-node
pySigma Versions
2
Newest: 2.0.1
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
RedTail Cryptominer User-Agent
Backends follow their supported pySigma version. Select 1.5.1 for Elasticsearch, Kusto, and other 1.x plugins.
Target Profile
Splunk
Splunk through pysigma-backend-splunk.
Format Mode
Default
Default pySigma output mode for this backend.
RedTail Cryptominer User-Agent
Using Splunk · Default · pySigma 2.0.1
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
title: RedTail Cryptominer User-Agent
id: 6fd25dd1-527b-47c8-baa4-2a0e77279c6f
status: experimental
description: |
Detects inbound web requests using the "libredtail-http" User-Agent.
libredtail-http is a unique User-Agent string associated with a campaign of automated, malicious scans and attacks targeting exposed container environments and web applications,notably identified in activities stemming from late 2024 through early 2026.
It is primarily used by the RedTail cryptominer malware to identify and exploit vulnerabilities for deploying cryptocurrency miners.
references:
- https://isc.sans.edu/diary/Danger+of+Libredtail+Guest+Diary/32936/
- https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/
- https://www.cloudsek.com/blog/honey-for-hackers-a-study-of-attacks-targeting-the-recent-cve-2026-21962-and-other-critical-weblogic-vulnerabilities-on-a-high-interactive-oracle-honeypot
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2026-04-30
tags:
- attack.initial-access
- attack.t1190
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-user-agent: 'libredtail-http'
condition: selection
falsepositives:
- Unknown
level: medium
CLI command
Sigma CLI 4.0.0 · Install matching versions, then run from the Phoenix project directory.
python -m pip install 'sigma-cli==4.0.0' 'pysigma==2.0.1' 'pysigma-backend-splunk==3.0.0'
sigma convert --without-pipeline -t splunk -f default 'sigma/rules-emerging-threats/2026/Malware/RedTail-Cryptominer/web_malware_redtail_useragent.yml'