cscli scenarios install crowdsecurity/freeswitch-user-enumerationFreeSWITCH will log when an a not found user. This scenario will detect when an IP has more than 5 attempts. There is also a slower scenarios to detect when an IP has more than 20 attempts.
1type: leaky2name: crowdsecurity/freeswitch-user-enumeration3description: "Detect freeswitch user enumeration"4filter: "evt.Meta.service == 'freeswitch' && evt.Meta.sub_type == 'user_enumeration'"5leakspeed: "10s"6capacity: 57groupby: evt.Meta.source_ip8blackhole: 1m9reprocess: true10labels:11 service: freeswitch12 confidence: 313 spoofable: 014 classification:15 - attack.T158916 behavior: "generic:bruteforce"17 label: "Freeswitch User Enumeration"18 remediation: true19---20type: leaky21name: crowdsecurity/freeswitch-user-enumeration22description: "Detect freeswitch user enumeration"23filter: "evt.Meta.service == 'freeswitch' && evt.Meta.sub_type == 'user_enumeration'"24leakspeed: "1m"25capacity: 2026groupby: evt.Meta.source_ip27blackhole: 1m28labels:29 service: freeswitch30 confidence: 331 spoofable: 032 classification:33 - attack.T158934 behavior: "generic:bruteforce"35 label: "Freeswitch User Enumeration"36 remediation: true37