MeshCentral Bruteforce
Attack scenariohttp:bruteforceMITRE T1110
- By
- a1ad
- Version
- 0.2
- Name
- a1ad/meshcentral-bf
- Remediation
- Ban
Detect meshcentral bruteforce
Install with a top-level collection
1 collection include itsudo cscli collections install a1ad/meshcentralInstalls 1 parser and 1 scenario.
View meshcentral →Installation
sudo cscli scenarios install a1ad/meshcentral-bfThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
# meshcentral BF scanname: a1ad/meshcentral-bfdescription: "Detect meshcentral bruteforce"filter: "evt.Meta.log_type == 'meshcentral_failed_auth'"#debug: truetype: leakygroupby: evt.Meta.source_ipleakspeed: "20s"capacity: 5blackhole: 1mlabels:service: meshcentralbehavior: "http:bruteforce"classification:- attack.T1110spoofable: 0confidence: 3label: "MeshCentral Bruteforce"remediation: true---# meshcentral user-enumtype: leakyname: a1ad/meshcentral-bf_user-enumdescription: "Detect meshcentral user enum bruteforce"filter: "evt.Meta.log_type == 'meshcentral_failed_auth'"groupby: evt.Meta.source_ipdistinct: evt.Meta.userleakspeed: 10scapacity: 5blackhole: 1mlabels:service: meshcentralbehavior: "http:bruteforce"classification:- attack.T1589- attack.T1110spoofable: 0confidence: 3label: "MeshCentral User Enumeration"remediation: true
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
Detect failed meshcentral authentications:
- leakspeed of 20s, capacity of 5 on same target user
- leakspeed of 1m, capacity of 5 unique distinct users