cscli scenarios install crowdsecurity/freeswitch-bffreeSWITCH logs when an authentication attempt fails. This scenario will detect when an IP has more than 5 failed attempts. There is also a slower scenarios to detect when an IP has more than 20 failed attempts.
1type: leaky2name: crowdsecurity/freeswitch-bf3description: "Detect freeswitch auth bruteforce"4filter: "evt.Meta.service == 'freeswitch' && evt.Meta.sub_type == 'auth_failure'"5leakspeed: "10s"6capacity: 57groupby: evt.Meta.source_ip8blackhole: 1m9reprocess: true10labels:11 service: freeswitch12 confidence: 313 spoofable: 014 classification:15 - attack.T111016 behavior: "generic:bruteforce"17 label: "Freeswitch Bruteforce"18 remediation: true1920---21type: leaky22name: crowdsecurity/freeswitch-slow-bf23description: "Detect freeswitch auth bruteforce"24filter: "evt.Meta.service == 'freeswitch' && evt.Meta.sub_type == 'auth_failure'"25leakspeed: "1m"26capacity: 2027groupby: evt.Meta.source_ip28blackhole: 1m29labels:30 service: freeswitch31 confidence: 332 spoofable: 033 classification:34 - attack.T111035 behavior: "generic:bruteforce"36 label: "Freeswitch Bruteforce"37 remediation: true38