HTTP DOS via random URI Detection Scenario by crowdsecurity | CrowdSec Hub

HTTP DOS via random URI

Attack scenariohttp:dosMITRE T1498

By: crowdsecurity
Version: 0.4
Name: crowdsecurity/http-dos-random-uri
Remediation: Ban

Detect DoS tools using random uri

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/http-dos

Installs 0 parser and 4 scenarios.

View HTTP - DoS Detection →

Installation

sudo cscli scenarios install crowdsecurity/http-dos-random-uri

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-dos-random-uri.yaml· 26 linesGitHub

1type: leaky1
2format: 2.0
3#debug: true
4name: crowdsecurity/http-dos-random-uri
5description: "Detect DoS tools using random uri"
6#pattern seen in loic tool
7filter: |2
8  evt.Meta.log_type == "http_access-log" &&
9  evt.Meta.http_verb == 'GET' &&
10  evt.Parsed.static_ressource == 'false' &&
11  Upper(evt.Parsed.file_frag) == evt.Parsed.file_frag &&
12  len(evt.Parsed.file_frag) == 6 &&
13  int(evt.Meta.http_args_len) == 0
14capacity: 303
15leakspeed: 1s4
16groupby: "evt.Meta.source_ip"5
17blackhole: 2m6
18labels:
19  confidence: 2
20  spoofable: 0
21  classification:7
22    - attack.T1498
23  behavior: "http:dos"
24  label: "HTTP DOS via random URI"
25  service: http
26  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

HTTP DOS Random URI

This scenario detects DoS tools that issue a high number of requests, while varying the suffix URL to evade static rules.

Directly inspired by some specific DoS tools TTP.

⚠️ This scenario might trigger false positives, proper testing is advised ⚠️