Blocked by CrowdSec AppSec Detection Scenario by crowdsecurity | CrowdSec Hub

Blocked by CrowdSec AppSec

Attack scenariohttp:exploitMITRE T1190

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/appsec-native
Remediation: Ban

Identify attacks flagged by CrowdSec AppSec via native rules

Install with a top-level collection

2 collections include it

sudo cscli collections install crowdsecurity/appsec-crs-inband

Installs 1 parser and 1 scenario.

View WAF - OWASP Core Rule Set (Blocking) →

Installation

sudo cscli scenarios install crowdsecurity/appsec-native

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/appsec-native.yaml· 18 linesGitHub

1type: leaky1
2format: 3.0
3name: crowdsecurity/appsec-native
4description: "Identify attacks flagged by CrowdSec AppSec via native rules"
5filter: "evt.Meta.log_type == 'appsec-block' && evt.Meta.rule_name startsWith 'native_rule'"2
6leakspeed: "30s"3
7capacity: 34
8groupby: evt.Meta.source_ip5
9blackhole: 1m6
10labels:
11  service: http
12  confidence: 1
13  spoofable: 0
14  classification:7
15    - attack.T1190
16  label: "Blocked by CrowdSec AppSec"
17  behavior: "http:exploit"
18  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.