Hub configuration

Name: Magento Credit Card Stuffing
Author: crowdsecurity

More info

Magento Credit Card Stuffing Detection Scenario by crowdsecurity | CrowdSec Hub

« Magento Credit Card Stuffing »
v0.3 by crowdsecurity / http-magento-ccs
Attack scenariomagentoNot spoofableMedium confidence

Detect credit card stuffing from a single IP

Installation

cscli scenarios install crowdsecurity/http-magento-ccs

Description

Detects credit card stuffing on Magento website.

More than 3 payments failed from a same IP in less than 30 secondes will trigger this scenario.

YAML Configuration

1type: leaky
2name: crowdsecurity/http-magento-ccs
3debug: false
4description: "Detect credit card stuffing from a single IP"
5filter: "evt.Meta.log_type == 'PAYMENT_FAILED'"
6groupby: evt.Meta.source_ip
7capacity: 3
8leakspeed: 30s
9blackhole: 5m
10labels:
11  remediation: true
12  classification:
13    - attack.T1110.004
14  confidence: 2
15  spoofable: 0
16  service: magento
17  behavior: "ecommerce:fraud"
18  label: "Magento Credit Card Stuffing"
19

Hub configuration

« Magento Credit Card Stuffing »v0.3 by crowdsecurity / http-magento-ccsAttack scenariomagentoNot spoofableMedium confidenceMITRE:T1110

« Magento Credit Card Stuffing »
v0.3 by crowdsecurity / http-magento-ccs
Attack scenariomagentoNot spoofableMedium confidence