Is it not a common assumption to think attacker's are not using the User-Agent header to attack? It is logged by default in Apache and nginx as far as I know.

Is it not a common assumption to think attacker's are not using the User-Agent header to attack? It is logged by default in Apache and nginx as far as I know. Why wouldn't you mask your attacks using another header? Cookies anyone?