cscli scenarios install crowdsecurity/http-bf-wordpress_bf_xmlrpcDetects bruteforce on wordpress API 'xmlrpc.php'.
Warning: Some plugin heavily rely on the xmlrpc, by enabling this scenario you could block your own server. Be sure to check the source of the calls on the XMLRPC API before enabling this.
leakspeed of 2m, capacity of 5
1type: leaky2name: crowdsecurity/http-bf-wordpress_bf_xmlrpc3description: "Detect WordPress bruteforce on XML-RPC endpoint"4debug: false5# XMLRPC always returns 2006filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name == 'xmlrpc.php' && evt.Parsed.verb == 'POST'"7groupby: evt.Meta.source_ip8capacity: 59leakspeed: 2m10blackhole: 5m11labels:12 confidence: 313 spoofable: 014 classification:15 - attack.T111016 behavior: "http:bruteforce"17 label: "WP XMLRPC bruteforce"18 service: wordpress19 remediation: true20