RedTail Cryptominer User-Agent
Detects inbound web requests using the "libredtail-http" User-Agent. libredtail-http is a unique User-Agent string associated with a campaign of automated, malicious scans and attacks targeting exposed container environments and web applications,notably identified in activities stemming from late 2024 through early 2026. It is primarily used by the RedTail cryptominer malware to identify and exploit vulnerabilities for deploying cryptocurrency miners.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
HTTP access logs from web servers capturing request paths, methods, and status codes.
detection:
selection:
cs-user-agent: 'libredtail-http'
condition: selectionFalse positive likelihood has not been assessed. Additional context may be needed during triage.
Tactics
Other