cscli scenarios install crowdsecurity/http-magento-ccs-by-asDetects distributed credit card stuffing by AS on Magento website.
More than 10 payments failed in the same AS in less than 30secondes will trigger this scenario.
1type: leaky2name: crowdsecurity/http-magento-ccs-by-as3debug: false4description: "Detect distributed credit card stuffing from same AS"5filter: "evt.Meta.log_type == 'PAYMENT_FAILED' and evt.Meta.ASNNumber != '' "6groupby: evt.Meta.ASNNumber7distinct: evt.Meta.source_ip8capacity: 109leakspeed: 30s10blackhole: 5m11labels:12 remediation: true13 classification:14 - attack.T1110.00415 confidence: 116 spoofable: 317 service: magento18 behavior: "ecommerce:fraud"19 label: "Magento Credit Card Stuffing By AS"20