Authelia Bruteforce Detection Scenario by LePresidente | CrowdSec Hub

Authelia Bruteforce

Attack scenariohttp:bruteforceMITRE T1110

By: LePresidente
Version: 0.5
Name: LePresidente/authelia-bf
Remediation: Ban

Detect authelia bruteforce

Install with a top-level collection

1 collection include it

sudo cscli collections install LePresidente/authelia

Installs 1 parser and 1 scenario.

View authelia →

Installation

sudo cscli scenarios install LePresidente/authelia-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/LePresidente/authelia-bf.yaml· 40 linesGitHub

1# authelia BF scan
2name: LePresidente/authelia-bf
3description: "Detect authelia bruteforce"
4filter: "evt.Meta.service == 'authelia' && evt.Meta.log_type == 'auth_failed'"1
5#debug: true
6type: leaky2
7groupby: evt.Meta.source_ip3
8leakspeed: "20s"4
9capacity: 55
10blackhole: 1m6
11labels:
12  service: authelia
13  behavior: "http:bruteforce"
14  spoofable: 0
15  confidence: 3
16  classification:7
17    - attack.T1110
18  label: "Authelia Bruteforce"
19  remediation: true8
20---
21# authelia user-enum
22type: leaky2
23name: LePresidente/authelia-bf_user-enum
24description: "Detect authelia user enum bruteforce"
25filter: "evt.Meta.service == 'authelia' && evt.Meta.log_type == 'auth_failed'"1
26groupby: evt.Meta.source_ip3
27distinct: evt.Meta.target_user9
28leakspeed: 10s4
29capacity: 55
30blackhole: 1m6
31labels:
32  service: authelia
33  behavior: "http:bruteforce"
34  spoofable: 0
35  confidence: 3
36  classification:7
37    - attack.T1589
38    - attack.T1110
39  label: "Authelia User Enumeration"
40  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect failed authelia authentications:

leakspeed of 20s, capacity of 5 on same target user
leakspeed of 1m, capacity of 5 unique distinct users