HTTP DOS with invalid HTTP version Detection Scenario by crowdsecurity | CrowdSec Hub

HTTP DOS with invalid HTTP version

Attack scenariohttp:dosMITRE T1498

By: crowdsecurity
Version: 0.7
Name: crowdsecurity/http-dos-invalid-http-versions
Remediation: Ban

Detect DoS tools using invalid HTTP versions

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/http-dos

Installs 0 parser and 4 scenarios.

View HTTP - DoS Detection →

Installation

sudo cscli scenarios install crowdsecurity/http-dos-invalid-http-versions

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-dos-invalid-http-versions.yaml· 18 linesGitHub

1type: trigger1
2format: 2.0
3#debug: true
4name: crowdsecurity/http-dos-invalid-http-versions
5description: "Detect DoS tools using invalid HTTP versions"
6#pattern seen in mhddos tool
7filter: 'evt.Meta.log_type in ["http_access-log", "http_error-log"] && evt.Parsed.http_version != "" && evt.Parsed.http_version not in ["0.9", "1.0", "1.1", "2.0", "3.0"]' 2
8groupby: "evt.Meta.source_ip"3
9blackhole: 2m4
10labels:
11  service: http
12  remediation: true5
13  confidence: 2
14  spoofable: 0
15  classification:6
16    - attack.T1498
17  behavior: "http:dos"
18  label: "HTTP DOS with invalid HTTP version"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detecting DOS with invalid HTTP versions

This scenario detects DoS tools that issue a high number of requests with invalid HTTP versions.

Directly inspired by some specific DoS tools TTP.

⚠️ This scenario might trigger false positives, proper testing is advised ⚠️