HTTP DOS with cache bypass Detection Scenario by crowdsecurity | CrowdSec Hub

HTTP DOS with cache bypass

Attack scenariohttp:dosMITRE T1498

By: crowdsecurity
Version: 0.5
Name: crowdsecurity/http-dos-bypass-cache
Remediation: Ban

Detect DoS tools bypassing cache every request

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/http-dos

Installs 0 parser and 4 scenarios.

View HTTP - DoS Detection →

Installation

sudo cscli scenarios install crowdsecurity/http-dos-bypass-cache

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-dos-bypass-cache.yaml· 21 linesGitHub

1type: leaky1
2name: crowdsecurity/http-dos-bypass-cache
3description: "Detect DoS tools bypassing cache every request"
4#as seen in cc-attack tool
5filter: "evt.Meta.log_type == 'http_access-log' && evt.Meta.http_args_len != '' && int(evt.Meta.http_args_len) >= 7 && int(evt.Meta.http_args_len) <= 12 && evt.Parsed.http_args matches '^[0-9]+$' && evt.Parsed.static_ressource == 'false'"2
6distinct: "evt.Parsed.http_args"3
7leakspeed: 1s4
8capacity: 305
9#debug: true
10cache_size: 10
11groupby: "evt.Meta.source_ip"6
12blackhole: 1m7
13labels:
14  service: http
15  remediation: true8
16  confidence: 2
17  spoofable: 0
18  classification:9
19    - attack.T1498
20  behavior: "http:dos"
21  label: "HTTP DOS with cache bypass"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detecting DOS with cache bypass

This scenario detects DoS tools that issue a high number of requests, while attempting to bypass cache rules by appending random numeric suffix.

Directly inspired by some specific DoS tools TTP.

⚠️ This scenario might trigger false positives, proper testing is advised ⚠️