cscli scenarios install crowdsecurity/exim-bfDetect bruteforce on Exim mail server.
1type: leaky2#debug: true3name: crowdsecurity/exim-bf4description: "Detect Exim brute force"5filter: "evt.Meta.log_type == 'exim_failed_auth'"6groupby: evt.Meta.source_ip7capacity: 58leakspeed: "10s"9blackhole: 1m10labels:11 confidence: 312 spoofable: 013 classification:14 - attack.T111015 behavior: "pop3/imap:bruteforce"16 label: "Exim Bruteforce"17 remediation: true18 service: smtp19---20type: leaky21#debug: true22name: crowdsecurity/exim-user-bf23description: "Detect Exim user email brute force"24filter: "evt.Meta.log_type == 'exim_failed_auth'"25groupby: evt.Meta.source_ip26distinct: evt.Meta.username27capacity: 528leakspeed: "10s"29blackhole: 1m30labels:31 confidence: 332 spoofable: 033 classification:34 - attack.T111035 behavior: "pop3/imap:bruteforce"36 label: "Exim Bruteforce"37 remediation: true38 service: smtp39