1type: leaky
2name: crowdsecurity/http-bf-wordpress_bf
3description: "Detect WordPress bruteforce on admin interface"
4debug: false
5# failed auth on wp-login.php returns 200
6filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name == 'wp-login.php' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '200'"
7groupby: evt.Meta.source_ip
8capacity: 5
9leakspeed: 10s
10blackhole: 5m
11labels:
12  confidence: 3
13  spoofable: 0
14  classification:
15    - attack.T1110
16  behavior: "http:bruteforce"
17  label: "WordPress Bruteforce"
18  service: wordpress
19  remediation: true
20