1type: trigger
2name: crowdsecurity/http-cve-probing
3description: "Detect generic HTTP cve probing"
4filter: |
5  evt.Meta.service == 'http' and 
6  evt.Meta.log_type in ['http_access-log', 'http_error-log'] and 
7  evt.Meta.http_status in ['404', '403'] and
8  any(File("trendy_cves_uris.json"), { 
9    evt.Meta.http_path contains JsonExtract(#, "uri") ? evt.SetMeta("cve", JsonExtract(#, "cve")) : false 
10  })
11groupby: evt.Meta.source_ip
12distinct: "evt.Meta.http_path"
13data:
14  # 
15  - source_url: https://hub-data.crowdsec.net/web/trendy_cves_uris.json
16    dest_file: trendy_cves_uris.json
17    type: string
18blackhole: 1m
19labels:
20  confidence: 3
21  spoofable: 0
22  classification:
23    - attack.T1595
24  behavior: "http:scan"
25  label: "HTTP CVE Probing"
26  service: http
27  remediation: true
28