AdGuardHome Bruteforce Detection Scenario by LePresidente | CrowdSec Hub

AdGuardHome Bruteforce

Attack scenariohttp:bruteforceMITRE T1110

By: LePresidente
Version: 0.2
Name: LePresidente/adguardhome-bf
Remediation: Ban

Detect AdGuardHome bruteforce attacks

Install with a top-level collection

1 collection include it

sudo cscli collections install LePresidente/adguardhome

Installs 1 parser and 1 scenario.

View adguardhome →

Installation

sudo cscli scenarios install LePresidente/adguardhome-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/LePresidente/adguardhome-bf.yaml· 19 linesGitHub

1# AdGuardHome bruteforce
2type: leaky1
3name: LePresidente/adguardhome-bf
4description: "Detect AdGuardHome bruteforce attacks"
5filter: "evt.Meta.log_type == 'adguardhome_failed_auth'"2
6leakspeed: 1m3
7capacity: 54
8groupby: evt.Meta.source_ip5
9blackhole: 5m6
10reprocess: true
11labels:
12  service: adguardhome
13  spoofable: 0
14  confidence: 3
15  classification:7
16    - attack.T1110
17  label: "AdGuardHome Bruteforce"
18  behavior: "http:bruteforce"
19  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect failed AdGuardHome authentications:

leakspeed of 1m, capacity of 5 on same ip address