Baserow Bruteforce Detection Scenario by LearningSpot | CrowdSec Hub

Baserow Bruteforce

Attack scenariohttp:bruteforceMITRE T1110

By: LearningSpot
Version: 0.2
Name: LearningSpot/baserow-bf
Remediation: Ban

Detect failed login for Baserow

Install with a top-level collection

1 collection include it

sudo cscli collections install LearningSpot/baserow

Installs 1 parser and 1 scenario.

View baserow →

Installation

sudo cscli scenarios install LearningSpot/baserow-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/LearningSpot/baserow-bf.yaml· 17 linesGitHub

1type: leaky1
2name: LearningSpot/baserow-bf
3description: "Detect failed login for Baserow"
4filter: "evt.Meta.log_type == 'baserow_failed_login' && evt.Meta.status == '401'"2
5groupby: evt.Meta.source_ip3
6leakspeed: 1m4
7capacity: 55
8blackhole: 5m6
9labels:
10  service: baserow
11  classification:7
12    - attack.T1110
13  behavior: "http:bruteforce"
14  label: "Baserow Bruteforce"
15  confidence: 3
16  spoofable: 0
17  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect failed baserow authentications:

leakspeed of 1m, capacity of 5, blackhole of 5m on source ip