cscli scenarios install crowdsecurity/stirling-pdf-bfDetects authentication bruteforce on stirling-pdf login panel with a capacity of 3 and a leakspeed of 10 seconds per event
1# stirling pdf bruteforce2type: leaky3name: crowdsecurity/stirling-pdf-bf4description: "Detect stirling pdf bruteforce"5filter: "evt.Meta.service == 'stirling-pdf' && evt.Meta.log_type == 'failed_authentication'"6leakspeed: "10s"7capacity: 38groupby: evt.Meta.source_ip9blackhole: 1m10labels:11 service: stirling-pdf12 confidence: 313 spoofable: 014 classification:15 - attack.T111016 label: "Stirling PDF Bruteforce"17 behavior: "generic:bruteforce"18 remediation: true19