1# 404 scan
2type: leaky
3#debug: true
4name: crowdsecurity/http-generic-bf
5description: "Detect generic http brute force"
6filter: "evt.Meta.service == 'http' && evt.Meta.sub_type == 'auth_fail'"
7groupby: evt.Meta.source_ip
8capacity: 5
9leakspeed: "10s"
10blackhole: 1m
11labels:
12  confidence: 3
13  spoofable: 0
14  classification:
15    - attack.T1110
16  behavior: "http:bruteforce"
17  label: "HTTP Bruteforce"
18  service: http
19  remediation: true
20---
21# Generic 401 Authorization Errors
22type: leaky
23#debug: true
24name: LePresidente/http-generic-401-bf
25description: "Detect generic 401 Authorization error brute force"
26filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '401'"
27groupby: evt.Meta.source_ip
28capacity: 5
29leakspeed: "10s"
30blackhole: 1m
31labels:
32  confidence: 3
33  spoofable: 0
34  classification:
35    - attack.T1110
36  behavior: "http:bruteforce"
37  label: "HTTP Bruteforce"
38  service: http
39  remediation: true
40---
41# Generic 403 Forbidden (Authorization) Errors
42type: leaky
43#debug: true
44name: LePresidente/http-generic-403-bf
45description: "Detect generic 403 Forbidden (Authorization) error brute force"
46filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '403'"
47groupby: evt.Meta.source_ip
48capacity: 5
49leakspeed: "10s"
50blackhole: 1m
51labels:
52  confidence: 3
53  spoofable: 0
54  classification:
55    - attack.T1110
56  behavior: "http:bruteforce"
57  label: "HTTP Bruteforce"
58  service: http
59  remediation: true
60