Hub configuration

Name: Endlessh SSH Scan
Author: crowdsecurity

More info

Endlessh SSH Scan Detection Scenario by crowdsecurity | CrowdSec Hub

« Endlessh SSH Scan »
v0.4 by crowdsecurity / endlessh-bf
Attack scenarioendlesshNot spoofableHigh confidence

Detect SSH scanning caught by Endlessh

Installation

cscli scenarios install crowdsecurity/endlessh-bf

YAML Configuration

1# endlessh bruteforce
2type: leaky
3name: crowdsecurity/endlessh-bf
4description: "Detect SSH scanning caught by Endlessh"
5filter: "evt.Meta.log_type == 'endlessh_accept'"
6leakspeed: "5m"
7references:
8  - http://wikipedia.com/ssh-bf-is-bad
9capacity: 5
10groupby: evt.Meta.source_ip
11blackhole: 120m
12reprocess: true
13labels:
14  confidence: 3
15  spoofable: 0
16  classification:
17    - attack.T1595
18  behavior: "generic:scan"
19  label: "Endlessh SSH Scan"
20  service: endlessh
21  remediation: true
22

Hub configuration

« Endlessh SSH Scan »v0.4 by crowdsecurity / endlessh-bfAttack scenarioendlesshNot spoofableHigh confidenceMITRE:T1595

« Endlessh SSH Scan »
v0.4 by crowdsecurity / endlessh-bf
Attack scenarioendlesshNot spoofableHigh confidence