HTTP DOS with varying UA Detection Scenario by crowdsecurity | CrowdSec Hub

HTTP DOS with varying UA

Attack scenariohttp:dosMITRE T1498

By: crowdsecurity
Version: 0.5
Name: crowdsecurity/http-dos-switching-ua
Remediation: Ban

Detect DoS tools switching user-agent too fast

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/http-dos

Installs 0 parser and 4 scenarios.

View HTTP - DoS Detection →

Installation

sudo cscli scenarios install crowdsecurity/http-dos-switching-ua

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-dos-switching-ua.yaml· 21 linesGitHub

1type: leaky1
2format: 2.0
3#debug: true
4name: crowdsecurity/http-dos-swithcing-ua
5description: "Detect DoS tools switching user-agent too fast"
6#pattern seen in mhddos tool
7filter: 'evt.Meta.log_type in ["http_access-log", "http_error-log"]'2
8capacity: 103
9distinct: evt.Parsed.http_user_agent4
10leakspeed: 8s5
11groupby: "evt.Meta.source_ip"6
12blackhole: 2m7
13labels:
14  service: http
15  remediation: true8
16  confidence: 2
17  spoofable: 0
18  classification:9
19    - attack.T1498
20  behavior: "http:dos"
21  label: "HTTP DOS with varying UA"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

HTTP DOS Changing User-Agent

This scenario detects specific DoS tools that issue a high number of requests, while changing the User-Agent every request.

Directly inspired by some specific DoS tools TTP.

⚠️ This scenario might trigger false positives, proper testing is advised ⚠️

⚠️ The Hub item name is crowdsecurity/http-dos-switching-ua, but the internal runtime name is crowdsecurity/http-dos-swithcing-ua. The misspelling is kept for compatibility. Use the internal name in local configuration, including cscli simulation enable. ⚠️