cscli scenarios install andreasbrett/webmin-bfDetect failed Webmin authentications:
1# Webmin bruteforce2type: leaky3name: andreasbrett/webmin-bf4description: "Detect Webmin bruteforce attacks"5filter: "evt.Meta.log_type == 'webmin_failed_auth_wrong_pass'"6leakspeed: 1m7capacity: 58groupby: evt.Meta.source_ip9blackhole: 5m10reprocess: true11labels:12 service: webmin13 confidence: 314 spoofable: 015 classification:16 - attack.T111017 label: "Webmin Bruteforce"18 behavior: "http:bruteforce"19 remediation: true20---21# Webmin user-enum22type: leaky23name: andreasbrett/webmin-bf_user-enum24description: "Detect Webmin user enum bruteforce"25filter: "evt.Meta.log_type == 'webmin_failed_auth_wrong_pass'"26groupby: evt.Meta.source_ip27distinct: evt.Meta.username28leakspeed: 1m29capacity: 530blackhole: 5m31labels:32 service: webmin33 confidence: 334 spoofable: 035 classification:36 - attack.T158937 label: "Webmin Bruteforce"38 behavior: "http:bruteforce"39 remediation: true40