Apache Guacamole User Enumeration Detection Scenario by corvese | CrowdSec Hub

Apache Guacamole User Enumeration

Attack scenariohttp:bruteforceMITRE T1589MITRE T1110

By: corvese
Version: 0.2
Name: corvese/apache-guacamole_user_enum
Remediation: Ban

Detect Apache Guacamole user enum bruteforce

Install with a top-level collection

1 collection include it

sudo cscli collections install corvese/apache-guacamole

Installs 2 parsers and 2 scenarios.

View Apache Guacamole - Bruteforce Protection →

Installation

sudo cscli scenarios install corvese/apache-guacamole_user_enum

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/corvese/apache-guacamole_user_enum.yaml· 19 linesGitHub

1type: leaky1
2name: corvese/apache-guacamole_user_enum
3description: "Detect Apache Guacamole user enum bruteforce"
4filter: evt.Meta.log_type == 'apache-guacamole_failed_auth'2
5groupby: evt.Meta.source_ip3
6distinct: evt.Meta.target_user4
7leakspeed: 10s5
8capacity: 56
9blackhole: 1m7
10labels:
11  service: apache-guacamole
12  confidence: 3
13  spoofable: 0
14  classification:8
15    - attack.T1589
16    - attack.T1110
17  behavior: "http:bruteforce"
18  label: "Apache Guacamole User Enumeration"
19  remediation: true9

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Defends against user enumeration attack