WordPress Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

WordPress Bruteforce

Attack scenariohttp:bruteforceMITRE T1110

By: crowdsecurity
Version: 0.7
Name: crowdsecurity/http-bf-wordpress_bf
Remediation: Ban

Detect WordPress bruteforce on admin interface

Install with a top-level collection

1 collection include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios, via WordPress - Bruteforce Protection.

View NPMplus →

Installation

sudo cscli scenarios install crowdsecurity/http-bf-wordpress_bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-bf-wordpress_bf.yaml· 19 linesGitHub

1type: leaky1
2name: crowdsecurity/http-bf-wordpress_bf
3description: "Detect WordPress bruteforce on admin interface"
4debug: false
5# failed auth on wp-login.php returns 200
6filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name == 'wp-login.php' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '200'"2
7groupby: evt.Meta.source_ip3
8capacity: 54
9leakspeed: 10s5
10blackhole: 5m6
11labels:
12  confidence: 3
13  spoofable: 0
14  classification:7
15    - attack.T1110
16  behavior: "http:bruteforce"
17  label: "WordPress Bruteforce"
18  service: wordpress
19  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects bruteforce on wordpress login page 'wp-login.php'.

leakspeed of 10s, capacity of 5