Bad User Agent Detection Scenario by crowdsecurity | CrowdSec Hub

Bad User Agent

Attack scenariohttp:scanMITRE T1595

By: crowdsecurity
Version: 1.2
Name: crowdsecurity/http-bad-user-agent
Remediation: Ban

Detect usage of bad User Agent

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/aws-cloudfront

Installs 2 parsers and 47 scenarios, via HTTP - Generic Protection.

View AWS CloudFront →

Installation

sudo cscli scenarios install crowdsecurity/http-bad-user-agent

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-bad-user-agent.yaml· 26 linesGitHub

1type: leaky1
2format: 2.0
3#debug: true
4name: crowdsecurity/http-bad-user-agent
5description: "Detect usage of bad User Agent"
6filter: 'evt.Meta.log_type in ["http_access-log", "http_error-log"] && RegexpInFile(evt.Parsed.http_user_agent, "bad_user_agents.regex.txt")'2
7data:
8  - source_url: https://hub-data.crowdsec.net/web/bad_user_agents.regex.txt
9    dest_file: bad_user_agents.regex.txt
10    type: regexp
11    strategy: LRU
12    size: 40
13    ttl: 10s
14capacity: 13
15leakspeed: 1m4
16groupby: "evt.Meta.source_ip"5
17blackhole: 2m6
18labels:
19  confidence: 1
20  spoofable: 0
21  classification:7
22    - attack.T1595
23  behavior: "http:scan"
24  label: "Bad User Agent"
25  service: http
26  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Known bad user-agents

Detect known bad user-agents.

Bans after two requests per minute.