cscli scenarios install crowdsecurity/http-technology-probingA scenario that detects fingerprinting for various (300+) vendors and technologies.
It doesn't trigger a ban on its own.
1type: trigger2name: crowdsecurity/http-technology-probing3description: "Detect HTTP technology/vendor probing"4filter: |5 if (evt.Meta.service == 'http' and6 evt.Meta.log_type in ['http_access-log', 'http_error-log'] and7 evt.Meta.http_status in ['404', '403'])8 {9 let target_technology = LookupFile(evt.Meta.http_path, "technology_probing.json");10 target_technology != "" ? evt.SetMeta("target_technology", target_technology) : false11 } else { false }12groupby: evt.Meta.source_ip13blackhole: 1m14data:15 #16 - dest_file: technology_probing.json17 source_url: https://hub-data.crowdsec.net/web/technology_probing.json18 type: map19labels:20 confidence: 321 spoofable: 022 classification:23 - attack.T159524 behavior: "http:scan"25 label: "HTTP Technology Probing"26 service: http27 remediation: false28