Scanning for backdoors Detection Scenario by crowdsecurity | CrowdSec Hub

Scanning for backdoors

Attack scenariohttp:scanMITRE T1595

By: crowdsecurity
Version: 0.7
Name: crowdsecurity/http-backdoors-attempts
Remediation: Ban

Detect attempt to common backdoors

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/aws-cloudfront

Installs 2 parsers and 47 scenarios, via HTTP - Generic Protection.

View AWS CloudFront →

Installation

sudo cscli scenarios install crowdsecurity/http-backdoors-attempts

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-backdoors-attempts.yaml· 23 linesGitHub

1type: leaky1
2#debug: true
3name: crowdsecurity/http-backdoors-attempts
4description: "Detect attempt to common backdoors"
5filter: 'evt.Meta.log_type in ["http_access-log", "http_error-log"] and any(File("backdoors.txt"), { evt.Parsed.file_name == #})'2
6groupby: "evt.Meta.source_ip"3
7distinct: evt.Parsed.file_name4
8data:
9  - source_url: https://hub-data.crowdsec.net/web/backdoors.txt
10    dest_file: backdoors.txt
11    type: string
12capacity: 15
13leakspeed: 5s6
14blackhole: 5m7
15labels:
16  confidence: 3
17  spoofable: 0
18  classification:8
19    - attack.T1595
20  behavior: "http:scan"
21  label: "Scanning for backdoors"
22  service: http
23  remediation: true9

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect attempts to access common backdoors such as c99.php ...

Configuration

This scenario will be trigger if an attacker requests a minimum of two differents file of the list/

Configuration:

distinct : evt.Parsed.request (HTTP request URI)

leakspeed : 5 secondes

group_by : evt.Meta.source_ip

Data

This scenario use the following list backdoors.txt from danielmiessler