Hub configuration

Name: Magento Credit Card Stuffing By AS
Author: crowdsecurity

More info

Magento Credit Card Stuffing By AS Detection Scenario by crowdsecurity | CrowdSec Hub

« Magento Credit Card Stuffing By AS »
v0.3 by crowdsecurity / http-magento-ccs-by-as
Attack scenariomagentoHighly spoofableLow confidence

Detect distributed credit card stuffing from same AS

Installation

cscli scenarios install crowdsecurity/http-magento-ccs-by-as

Description

Detects distributed credit card stuffing by AS on Magento website.

More than 10 payments failed in the same AS in less than 30secondes will trigger this scenario.

YAML Configuration

1type: leaky
2name: crowdsecurity/http-magento-ccs-by-as
3debug: false
4description: "Detect distributed credit card stuffing from same AS"
5filter: "evt.Meta.log_type == 'PAYMENT_FAILED' and evt.Meta.ASNNumber != '' "
6groupby: evt.Meta.ASNNumber
7distinct: evt.Meta.source_ip
8capacity: 10
9leakspeed: 30s
10blackhole: 5m
11labels:
12  remediation: true
13  classification:
14    - attack.T1110.004
15  confidence: 1
16  spoofable: 3
17  service: magento
18  behavior: "ecommerce:fraud"
19  label: "Magento Credit Card Stuffing By AS"
20

Hub configuration

« Magento Credit Card Stuffing By AS »v0.3 by crowdsecurity / http-magento-ccs-by-asAttack scenariomagentoHighly spoofableLow confidenceMITRE:T1110

« Magento Credit Card Stuffing By AS »
v0.3 by crowdsecurity / http-magento-ccs-by-as
Attack scenariomagentoHighly spoofableLow confidence