Hub configuration

Name: Microsoft Exchange Bruteforce
Author: crowdsecurity

More info

Microsoft Exchange Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

« Microsoft Exchange Bruteforce »
v0.4 by crowdsecurity / exchange-bf
Attack scenarioexchangeNot spoofableHigh confidence

Detect Exchange bruteforce (SMTP,IMAP,POP3)

Installation

cscli scenarios install crowdsecurity/exchange-bf

YAML Configuration

1type: leaky
2name: crowdsecurity/exchange-bf
3description: "Detect Exchange bruteforce (SMTP,IMAP,POP3)"
4filter: evt.Meta.service == 'exchange' && evt.Meta.sub_type == 'auth_fail'
5groupby: evt.Meta.source_ip
6leakspeed: 10s
7capacity: 5
8blackhole: 1m
9labels:
10  confidence: 3
11  spoofable: 0
12  classification:
13    - attack.T1110
14  behavior: "pop3/imap:bruteforce"
15  label: "Microsoft Exchange Bruteforce"
16  remediation: true
17  service: exchange
18

Hub configuration

« Microsoft Exchange Bruteforce »v0.4 by crowdsecurity / exchange-bfAttack scenarioexchangeNot spoofableHigh confidenceMITRE:T1110

« Microsoft Exchange Bruteforce »
v0.4 by crowdsecurity / exchange-bf
Attack scenarioexchangeNot spoofableHigh confidence