cscli scenarios install crowdsecurity/cpanel-bfDetects bruteforce attempts in cpanel login.
1type: leaky2name: crowdsecurity/cpanel-bf3capacity: 54leakspeed: 10s5description: "Detect bruteforce on cpanel login"6filter: "evt.Meta.log_type == 'auth_bf_log'"7groupby: evt.Meta.source_ip8blackhole: 5m9labels:10 confidence: 311 spoofable: 012 classification:13 - attack.T111014 behavior: "http:bruteforce"15 label: "cPanel Bruteforce"16 service: cpanel17 remediation: true1819