Access to sensitive files over HTTP Detection Scenario by crowdsecurity | CrowdSec Hub

Access to sensitive files over HTTP

Attack scenariohttp:scanMITRE T1595.003

By: crowdsecurity
Version: 0.4
Name: crowdsecurity/http-sensitive-files
Remediation: Ban

Detect attempt to access to sensitive files (.log, .db ..) or folders (.git)

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/aws-cloudfront

Installs 2 parsers and 47 scenarios, via HTTP - Generic Protection.

View AWS CloudFront →

Installation

sudo cscli scenarios install crowdsecurity/http-sensitive-files

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-sensitive-files.yaml· 24 linesGitHub

1type: leaky1
2format: 2.0
3#debug: true
4name: crowdsecurity/http-sensitive-files
5description: "Detect attempt to access to sensitive files (.log, .db ..) or folders (.git)"
6filter: 'evt.Meta.log_type in ["http_access-log", "http_error-log"] and any(File("sensitive_data.txt"), { evt.Parsed.request endsWith #})'2
7groupby: "evt.Meta.source_ip"3
8distinct: evt.Parsed.request4
9data:
10  - source_url: https://hub-data.crowdsec.net/web/sensitive_data.txt
11    dest_file: sensitive_data.txt
12    type: string
13capacity: 45
14leakspeed: 5s6
15blackhole: 5m7
16labels:
17  remediation: true8
18  classification:9
19    - attack.T1595.003
20  behavior: "http:scan"
21  label: "Access to sensitive files over HTTP"
22  spoofable: 0
23  service: http
24  confidence: 3

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

HTTP Sensitive files

Detect tentative of dangerous file scanning such as logs file, database backup, zip archive etc ...

Rule

More than 3 access to sensitive files in this list