Aggressive Crawl
Attack scenariohttp:crawlMITRE T1595
- Version
- 0.7
- Name
- crowdsecurity/http-crawl-non_statics
- Remediation
- Ban
Detect aggressive crawl on non static resources
Install with a top-level collection
16 collections include itsudo cscli collections install crowdsecurity/aws-cloudfrontInstalls 2 parsers and 47 scenarios, via HTTP - Generic Protection.
View AWS CloudFront →Installation
sudo cscli scenarios install crowdsecurity/http-crawl-non_staticsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
type: leakyname: crowdsecurity/http-crawl-non_staticsdescription: "Detect aggressive crawl on non static resources"filter: "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && evt.Parsed.static_ressource == 'false' && evt.Parsed.verb in ['GET', 'HEAD']"distinct: "evt.Parsed.file_name"leakspeed: 0.5scapacity: 40#debug: true#this limits the memory cache (and event_sequences in output) to five eventscache_size: 5groupby: "evt.Meta.source_ip + '/' + evt.Parsed.target_fqdn"blackhole: 1mlabels:confidence: 1spoofable: 0classification:- attack.T1595behavior: "http:crawl"service: httplabel: "Aggressive Crawl"remediation: true
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
Detect crawl (http GET/HEAD) on non-static (jpg,css,js,etc.) http pages from a single ip.
Leakspeed of 0.5s, capacity of 40