1type: trigger
2format: 2.0
3#debug: true
4name: crowdsecurity/http-dos-invalid-http-versions
5description: "Detect DoS tools using invalid HTTP versions"
6#pattern seen in mhddos tool
7filter: 'evt.Meta.log_type in ["http_access-log", "http_error-log"] && evt.Parsed.http_version != "" && evt.Parsed.http_version not in ["0.9", "1.0", "1.1", "2.0", "3.0"]' 
8groupby: "evt.Meta.source_ip"
9blackhole: 2m
10labels:
11  service: http
12  remediation: true
13  confidence: 2
14  spoofable: 0
15  classification:
16    - attack.T1498
17  behavior: "http:dos"
18  label: "HTTP DOS with invalid HTTP version"
19