Suspicious User-Agent String Observed (IOT)

Tim Peck@timpeck

•updated Nov 11, 2025•0•19

This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This is often indicative of compromised IoT devices or botnet activity attempting to blend in or identify themselves.