cscli scenarios install crowdsecurity/http-open-proxyTake a remediation against any IP making a CONNECT HTTP request which returns a 400 status code.
This is a trigger bucket, so only one request is enough to trigger the scenario.
1type: trigger2name: crowdsecurity/http-open-proxy3description: "Detect scan for open proxy"4#apache returns 405, nginx 4005filter: "evt.Meta.log_type == 'http_access-log' && evt.Meta.http_status in ['400','405'] && (evt.Parsed.verb == 'CONNECT' || evt.Parsed.request matches '^http[s]?://')"6blackhole: 2m7groupby: evt.Meta.source_ip8labels:9 service: http10 type: scan11 remediation: true12 classification:13 - attack.T159514 behavior: "http:scan"15 label: "HTTP Open Proxy Probing"16 spoofable: 017 confidence: 318