cscli scenarios install crowdsecurity/http-dos-bypass-cacheThis scenario detects DoS tools that issue a high number of requests, while attempting to bypass cache rules by appending random numeric suffix.
Directly inspired by some specific DoS tools TTP.
⚠️ This scenario might trigger false positives, proper testing is advised ⚠️
1type: leaky2name: crowdsecurity/http-dos-bypass-cache3description: "Detect DoS tools bypassing cache every request"4#as seen in cc-attack tool5filter: "evt.Meta.log_type == 'http_access-log' && evt.Meta.http_args_len != '' && int(evt.Meta.http_args_len) >= 7 && int(evt.Meta.http_args_len) <= 12 && evt.Parsed.http_args matches '^[0-9]+$' && evt.Parsed.static_ressource == 'false'"6distinct: "evt.Parsed.http_args"7leakspeed: 1s8capacity: 309#debug: true10cache_size: 1011groupby: "evt.Meta.source_ip"12blackhole: 1m13labels:14 service: http15 remediation: true16 confidence: 217 spoofable: 018 classification:19 - attack.T149820 behavior: "http:dos"21 label: "HTTP DOS with cache bypass"22