1type: leaky
2name: crowdsecurity/http-wordpress_user-enum
3description: "Detect WordPress probing: authors enumeration"
4debug: false
5filter: "evt.Meta.log_type == 'http_access-log' && Upper(evt.Parsed.http_args) contains 'AUTHOR='"
6groupby: evt.Meta.source_ip
7distinct: evt.Parsed.http_args
8capacity: 5
9leakspeed: "10s"
10blackhole: 5m
11labels:
12  remediation: true
13  classification:
14    - attack.T1589
15    - attack.T1110
16    - attack.T1595
17  behavior: "http:scan"
18  label: "WordPress User Enumeration"
19  spoofable: 0
20  service: wordpress
21  confidence: 3
22