1type: trigger
2name: crowdsecurity/cpanel-bf-attempt
3description: "Detect bruteforce attempt on cpanel login"
4filter: "evt.Meta.log_type == 'auth_bf_attempt'"
5groupby: evt.Meta.source_ip
6blackhole: 5m
7labels:
8  confidence: 1
9  spoofable: 0
10  classification:
11   - attack.T1110
12  behavior: "http:bruteforce"
13  label: "cPanel Bruteforce"
14  service: cpanel
15  remediation: true