Infected Email Detection Scenario by crowdsecurity | CrowdSec Hub

Infected Email

Attack scenariosmtp:spamMITRE T1203MITRE T1204

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/amavis-blocked
Remediation: Ban

Ban IPs that are blocked by amavis

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/amavis

Installs 2 parsers and 1 scenario.

View Amavis - Bruteforce Protection →

Installation

sudo cscli scenarios install crowdsecurity/amavis-blocked

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/amavis-blocked.yaml· 16 linesGitHub

1type: trigger1
2name: crowdsecurity/amavis-blocked
3description: "Ban IPs that are blocked by amavis"
4filter: evt.Meta.log_type == 'amavis' && evt.Parsed.amavis_action == 'Blocked' && evt.Parsed.amavis_category == 'INFECTED'2
5groupby: evt.Meta.source_ip3
6blackhole: 5m4
7labels:
8  service: amavis
9  confidence: 3
10  spoofable: 0
11  classification:5
12    - attack.T1203
13    - attack.T1204
14  behavior: "smtp:spam"
15  label: "Infected Email"
16  remediation: true6

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

This amavis scenario bans an IP as soon as it is detected sending messages that have been blocked by amavis.