apisCP bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

apisCP bruteforce

Attack scenariohttp:bruteforceMITRE T1110

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/http-apiscp-bf
Remediation: Ban

detect apisCP dashboard bruteforce

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/apiscp

Installs 9 parsers and 56 scenarios.

View ApisCP →

Installation

sudo cscli scenarios install crowdsecurity/http-apiscp-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-apiscp-bf.yaml· 19 linesGitHub

1type: leaky1
2name: crowdsecurity/http-apiscp-bf
3description: "detect apisCP dashboard bruteforce"
4debug: false
5# success auth on apisCP returns 303
6filter: "evt.Meta.log_type == 'http_access-log' && evt.Meta.http_path startsWith '/apps/login' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '200'"2
7groupby: evt.Meta.source_ip3
8capacity: 54
9leakspeed: 10s5
10blackhole: 5m6
11labels:
12  service: apisCP
13  confidence: 3
14  spoofable: 0
15  classification:7
16    - attack.T1110
17  behavior: "http:bruteforce"
18  label: "apisCP bruteforce"
19  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects bruteforce on apisCP login page '/apps/login'.

leakspeed of 10s, capacity of 5