cscli scenarios install crowdsecurity/http-dos-switching-uaThis scenario detects specific DoS tools that issue a high number of requests, while changing the User-Agent every request.
Directly inspired by some specific DoS tools TTP.
⚠️ This scenario might trigger false positives, proper testing is advised ⚠️
1type: leaky2format: 2.03#debug: true4name: crowdsecurity/http-dos-swithcing-ua5description: "Detect DoS tools switching user-agent too fast"6#pattern seen in mhddos tool7filter: 'evt.Meta.log_type in ["http_access-log", "http_error-log"]'8capacity: 109distinct: evt.Parsed.http_user_agent10leakspeed: 8s11groupby: "evt.Meta.source_ip"12blackhole: 2m13labels:14 service: http15 remediation: true16 confidence: 217 spoofable: 018 classification:19 - attack.T149820 behavior: "http:dos"21 label: "HTTP DOS with varying UA"