cscli scenarios install crowdsecurity/http-backdoors-attemptsDetect attempts to access common backdoors such as c99.php ...
This scenario will be trigger if an attacker requests a minimum of two differents file of the list/
Configuration:
distinct : evt.Parsed.request (HTTP request URI)
leakspeed : 5 secondes
group_by : evt.Meta.source_ip
This scenario use the following list backdoors.txt from danielmiessler
1type: leaky2#debug: true3name: crowdsecurity/http-backdoors-attempts4description: "Detect attempt to common backdoors"5filter: 'evt.Meta.log_type in ["http_access-log", "http_error-log"] and any(File("backdoors.txt"), { evt.Parsed.file_name == #})'6groupby: "evt.Meta.source_ip"7distinct: evt.Parsed.file_name8data:9 - source_url: https://hub-data.crowdsec.net/web/backdoors.txt10 dest_file: backdoors.txt11 type: string12capacity: 113leakspeed: 5s14blackhole: 5m15labels:16 confidence: 317 spoofable: 018 classification:19 - attack.T159520 behavior: "http:exploit"21 label: "Scanning for backdoors"22 service: http23 remediation: true24