Hub configuration

Name: MailScanner classified an SMTP email as SPAM with a spam_score higher 20
Author: cbrandlehner

More info

MailScanner classified an SMTP email as SPAM with a spam_score higher 20 Detection Scenario by cbrandlehner | CrowdSec Hub

« MailScanner classified an SMTP email as SPAM with a spam_score higher 20 »
v0.1 by cbrandlehner / mailscanner-highscore-spam
Attack scenariosmtpNot spoofableLow confidence

Detects spam messages in MailScanner logs with score > 20.0

Installation

cscli scenarios install cbrandlehner/mailscanner-highscore-spam

YAML Configuration

1name: cbrandlehner/mailscanner-highscore-spam
2description: Detects spam messages in MailScanner logs with score > 20.0
3type: leaky
4filter: "evt.Meta.log_type == 'mailscanner_spam' && float(evt.Parsed.spam_score) > 20.0"
5groupby: evt.Parsed.source_ip
6leakspeed: 10s
7capacity: 1
8blackhole: 5m
9labels:
10  type: spam
11  remediation: true
12  behavior: "smtp:spam"
13  spoofable: 0
14  confidence: 1
15  label: "MailScanner classified an SMTP email as SPAM with a spam_score higher 20"
16  service: smtp
17
18

Hub configuration

« MailScanner classified an SMTP email as SPAM with a spam_score higher 20 »v0.1 by cbrandlehner / mailscanner-highscore-spamAttack scenariosmtpNot spoofableLow confidence

« MailScanner classified an SMTP email as SPAM with a spam_score higher 20 »
v0.1 by cbrandlehner / mailscanner-highscore-spam
Attack scenariosmtpNot spoofableLow confidence