Hub configuration

Name: HTTP DOS with invalid HTTP version
Author: crowdsecurity

More info

HTTP DOS with invalid HTTP version Detection Scenario by crowdsecurity | CrowdSec Hub

« HTTP DOS with invalid HTTP version »
v0.7 by crowdsecurity / http-dos-invalid-http-versions
Attack scenariohttpNot spoofableMedium confidence

Detect DoS tools using invalid HTTP versions

Installation

cscli scenarios install crowdsecurity/http-dos-invalid-http-versions

Description

This scenario detects DoS tools that issue a high number of requests with invalid HTTP versions.

Directly inspired by some specific DoS tools TTP.

⚠️ This scenario might trigger false positives, proper testing is advised ⚠️

YAML Configuration

1type: trigger
2format: 2.0
3#debug: true
4name: crowdsecurity/http-dos-invalid-http-versions
5description: "Detect DoS tools using invalid HTTP versions"
6#pattern seen in mhddos tool
7filter: 'evt.Meta.log_type in ["http_access-log", "http_error-log"] && evt.Parsed.http_version != "" && evt.Parsed.http_version not in ["0.9", "1.0", "1.1", "2.0", "3.0"]' 
8groupby: "evt.Meta.source_ip"
9blackhole: 2m
10labels:
11  service: http
12  remediation: true
13  confidence: 2
14  spoofable: 0
15  classification:
16    - attack.T1498
17  behavior: "http:dos"
18  label: "HTTP DOS with invalid HTTP version"
19

Hub configuration

« HTTP DOS with invalid HTTP version »v0.7 by crowdsecurity / http-dos-invalid-http-versionsAttack scenariohttpNot spoofableMedium confidenceMITRE:T1498

« HTTP DOS with invalid HTTP version »
v0.7 by crowdsecurity / http-dos-invalid-http-versions
Attack scenariohttpNot spoofableMedium confidence