Dovecot Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

Dovecot Bruteforce

Attack scenariopop3/imap:bruteforceMITRE T1110

By: crowdsecurity
Version: 0.6
Name: crowdsecurity/dovecot-spam
Remediation: Ban

Detect Dovecot bruteforce

Install with a top-level collection

3 collections include it

sudo cscli collections install crowdsecurity/apiscp

Installs 9 parsers and 56 scenarios, via Dovecot - Bruteforce Protection.

View ApisCP →

Installation

sudo cscli scenarios install crowdsecurity/dovecot-spam

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/dovecot-spam.yaml· 19 linesGitHub

1#contribution by @ltsich
2type: leaky1
3name: crowdsecurity/dovecot-spam
4description: "Detect Dovecot bruteforce"
5debug: false
6filter: "evt.Meta.log_type == 'dovecot_logs' && evt.Meta.dovecot_login_result == 'auth_failed'"2
7groupby: evt.Meta.source_ip3
8capacity: 34
9leakspeed: "360s"5
10blackhole: 5m6
11labels:
12  confidence: 3
13  spoofable: 0
14  classification:7
15    - attack.T1110
16  behavior: "pop3/imap:bruteforce"
17  label: "Dovecot Bruteforce"
18  service: dovecot
19  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Spam detection for dovecot (capacity of 3 and leakspeed of 360s)

allows fail authentication attempt every 6 minutes with a burst of 3

Contribution by https://github.com/LtSich