HTTP Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

HTTP Bruteforce

Attack scenariohttp:bruteforceMITRE T1110

By: crowdsecurity
Version: 0.9
Name: crowdsecurity/http-generic-bf
Remediation: Ban

Detect generic http brute force

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/aws-cloudfront

Installs 2 parsers and 47 scenarios, via HTTP - Generic Protection.

View AWS CloudFront →

Installation

sudo cscli scenarios install crowdsecurity/http-generic-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-generic-bf.yaml· 59 linesGitHub

1# 404 scan
2type: leaky1
3#debug: true
4name: crowdsecurity/http-generic-bf
5description: "Detect generic http brute force"
6filter: "evt.Meta.service == 'http' && evt.Meta.sub_type == 'auth_fail'"2
7groupby: evt.Meta.source_ip3
8capacity: 54
9leakspeed: "10s"5
10blackhole: 1m6
11labels:
12  confidence: 3
13  spoofable: 0
14  classification:7
15    - attack.T1110
16  behavior: "http:bruteforce"
17  label: "HTTP Bruteforce"
18  service: http
19  remediation: true8
20---
21# Generic 401 Authorization Errors
22type: leaky1
23#debug: true
24name: LePresidente/http-generic-401-bf
25description: "Detect generic 401 Authorization error brute force"
26filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '401'"2
27groupby: evt.Meta.source_ip3
28capacity: 54
29leakspeed: "10s"5
30blackhole: 1m6
31labels:
32  confidence: 3
33  spoofable: 0
34  classification:7
35    - attack.T1110
36  behavior: "http:bruteforce"
37  label: "HTTP Bruteforce"
38  service: http
39  remediation: true8
40---

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Alert when a single IP that try to bruteforce http basic auth.

Leakspeed of 10s, capacity of 5.