1# stirling pdf bruteforce
2type: leaky
3name: crowdsecurity/stirling-pdf-bf
4description: "Detect stirling pdf bruteforce"
5filter: "evt.Meta.service == 'stirling-pdf' && evt.Meta.log_type == 'failed_authentication'"
6leakspeed: "10s"
7capacity: 3
8groupby: evt.Meta.source_ip
9blackhole: 1m
10labels:
11  service: stirling-pdf
12  confidence: 3
13  spoofable: 0
14  classification:
15    - attack.T1110
16  label: "Stirling PDF Bruteforce"
17  behavior: "generic:bruteforce"
18  remediation: true
19