Blocked by CrowdSec AppSec Detection Scenario by crowdsecurity | CrowdSec Hub

Blocked by CrowdSec AppSec

Attack scenariohttp:likely-botMITRE T1110

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/appsec-bot-challenge-too-many-requests
Remediation: Ban

Client made too many request to challenge page

Install with a top-level collection

3 collections include it

sudo cscli collections install crowdsecurity/appsec-bot-challenge

Installs 2 parsers and 2 scenarios.

View WAF - Bot Challenge →

Installation

sudo cscli scenarios install crowdsecurity/appsec-bot-challenge-too-many-requests

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/appsec-bot-challenge-too-many-requests.yaml· 20 linesGitHub

1type: leaky1
2format: 3.0
3#debug: true
4name: crowdsecurity/appsec-bot-challenge-too-many-requests
5description: "Client made too many request to challenge page"
6filter: "evt.Meta.log_type == 'appsec-challenge' && evt.Meta.challenge_event == 'requested'"2
7cancel_on: "evt.Meta.log_type == 'appsec-challenge' && evt.Meta.challenge_event == 'submitted'"
8leakspeed: "20s"3
9capacity: 104
10groupby: evt.Meta.source_ip5
11blackhole: 1m6
12labels:
13  service: http
14  confidence: 0
15  spoofable: 0
16  classification:7
17    - attack.T1110
18  label: "Blocked by CrowdSec AppSec"
19  behavior: "http:likely-bot"
20  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.