Blocked by CrowdSec AppSec Detection Scenario by crowdsecurity | CrowdSec Hub

Blocked by CrowdSec AppSec

Attack scenariohttp:exploitMITRE T1190

By: crowdsecurity
Version: 0.7
Name: crowdsecurity/appsec-vpatch
Remediation: Ban

Identify attacks flagged by CrowdSec AppSec

Install with a top-level collection

1 collection include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios, via WAF - Generic Rules.

View NPMplus →

Installation

sudo cscli scenarios install crowdsecurity/appsec-vpatch

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/appsec-vpatch.yaml· 20 linesGitHub

1type: leaky1
2format: 3.0
3name: crowdsecurity/appsec-vpatch
4description: "Identify attacks flagged by CrowdSec AppSec"
5## See appsec-native.yaml for reasons why we created a negative startsWith here, we want to ignore is native_rules but catch any of our DSL rules.
6filter: "evt.Meta.log_type == 'appsec-block' && evt.Meta.rule_name not startsWith 'native_rule'"2
7distinct: evt.Meta.rule_name3
8leakspeed: "60s"4
9capacity: 15
10groupby: evt.Meta.source_ip6
11blackhole: 1m7
12labels:
13  service: http
14  confidence: 3
15  spoofable: 0
16  classification:8
17    - attack.T1190
18  label: "Blocked by CrowdSec AppSec"
19  behavior: "http:exploit"
20  remediation: true9

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.