Apache Guacamole Bruteforce Detection Scenario by corvese | CrowdSec Hub

Apache Guacamole Bruteforce

Attack scenariohttp:bruteforceMITRE T1110

By: corvese
Version: 0.2
Name: corvese/apache-guacamole_bf
Remediation: Ban

Detect Apache Guacamole user bruteforce

Install with a top-level collection

1 collection include it

sudo cscli collections install corvese/apache-guacamole

Installs 2 parsers and 2 scenarios.

View Apache Guacamole - Bruteforce Protection →

Installation

sudo cscli scenarios install corvese/apache-guacamole_bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/corvese/apache-guacamole_bf.yaml· 17 linesGitHub

1type: leaky1
2name: corvese/apache-guacamole_bf
3description: "Detect Apache Guacamole user bruteforce"
4filter: evt.Meta.log_type == 'apache-guacamole_failed_auth'2
5groupby: evt.Meta.source_ip3
6leakspeed: 10s4
7capacity: 55
8blackhole: 1m6
9labels:
10  service: apache-guacamole
11  confidence: 3
12  spoofable: 0
13  classification:7
14    - attack.T1110
15  behavior: "http:bruteforce"
16  label: "Apache Guacamole Bruteforce"
17  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Defends against a single user's account being bruteforced