Blocked by CrowdSec AppSec Detection Scenario by crowdsecurity | CrowdSec Hub

Blocked by CrowdSec AppSec

Attack scenariohttp:likely-botMITRE T1110

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/appsec-bot-challenge-too-many-submissions
Remediation: Ban

Client made too many submissions for challenge

Install with a top-level collection

3 collections include it

sudo cscli collections install crowdsecurity/appsec-bot-challenge-strict

Installs 2 parsers and 2 scenarios.

View WAF - Bot Challenge (strict) →

Installation

sudo cscli scenarios install crowdsecurity/appsec-bot-challenge-too-many-submissions

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/appsec-bot-challenge-too-many-submissions.yaml· 19 linesGitHub

1type: leaky1
2format: 3.0
3#debug: true
4name: crowdsecurity/appsec-bot-challenge-too-many-submissions
5description: "Client made too many submissions for challenge"
6filter: "evt.Meta.log_type == 'appsec-challenge' && evt.Meta.challenge_event == 'submitted'"2
7leakspeed: "20s"3
8capacity: 54
9groupby: evt.Meta.source_ip5
10blackhole: 1m6
11labels:
12  service: http
13  confidence: 0
14  spoofable: 0
15  classification:7
16    - attack.T1110
17  label: "Blocked by CrowdSec AppSec"
18  behavior: "http:likely-bot"
19  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.