Hub configuration

Name: Magento Credit Card Stuffing By Country
Author: crowdsecurity

More info

Magento Credit Card Stuffing By Country Detection Scenario by crowdsecurity | CrowdSec Hub

« Magento Credit Card Stuffing By Country »
v0.3 by crowdsecurity / http-magento-ccs-by-country
Attack scenariomagentoHighly spoofableLow confidence

Detect distributed credit card stuffing from same country

Installation

cscli scenarios install crowdsecurity/http-magento-ccs-by-country

Description

Detects distributed credit card stuffing by country on Magento website.

More than 10 payments failed in the same country in less than 30secondes will trigger this scenario.

YAML Configuration

1type: leaky
2name: crowdsecurity/http-magento-ccs-by-country
3debug: false
4description: "Detect distributed credit card stuffing from same country"
5filter: "evt.Meta.log_type == 'PAYMENT_FAILED' and evt.Meta.IsoCode != '' "
6groupby: evt.Meta.IsoCode
7distinct: evt.Meta.source_ip
8capacity: 10
9leakspeed: 30s
10blackhole: 5m
11labels:
12  remediation: true
13  classification:
14    - attack.T1110.004
15  confidence: 1
16  spoofable: 3
17  service: magento
18  behavior: "ecommerce:fraud"
19  label: "Magento Credit Card Stuffing By Country"
20

Hub configuration

« Magento Credit Card Stuffing By Country »v0.3 by crowdsecurity / http-magento-ccs-by-countryAttack scenariomagentoHighly spoofableLow confidenceMITRE:T1110

« Magento Credit Card Stuffing By Country »
v0.3 by crowdsecurity / http-magento-ccs-by-country
Attack scenariomagentoHighly spoofableLow confidence