Hub configuration

Name: Magento Bruteforce
Author: crowdsecurity

More info

Magento Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

« Magento Bruteforce »
v0.5 by crowdsecurity / http-magento-bf
Attack scenariomagentoNot spoofableHigh confidence

Detect bruteforce on Magento admin interface

Installation

cscli scenarios install crowdsecurity/http-magento-bf

Description

Detects bruteforce on Magento Admin page.

leakspeed of 10s, capacity of 5

YAML Configuration

1type: leaky
2name: crowdsecurity/http-magento-bf
3debug: false
4description: "Detect bruteforce on Magento admin interface"
5filter: "evt.Meta.log_type == 'ADMIN_LOGIN_FAILED'"
6groupby: evt.Meta.source_ip
7capacity: 5
8leakspeed: 10s
9blackhole: 5m
10labels:
11  service: magento
12  confidence: 3
13  spoofable: 0
14  classification:
15    - attack.T1110
16  behavior: "http:bruteforce"
17  label: "Magento Bruteforce"
18  remediation: true
19

Hub configuration

« Magento Bruteforce »v0.5 by crowdsecurity / http-magento-bfAttack scenariomagentoNot spoofableHigh confidenceMITRE:T1110

« Magento Bruteforce »
v0.5 by crowdsecurity / http-magento-bf
Attack scenariomagentoNot spoofableHigh confidence