WordPress Vuln Hunting Detection Scenario by crowdsecurity | CrowdSec Hub

WordPress Vuln Hunting

Attack scenariohttp:scanMITRE T1595

By: crowdsecurity
Version: 0.4
Name: crowdsecurity/http-wordpress-scan
Remediation: Ban

Detect exploitation attempts against common WordPress endpoints

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/aws-cloudfront

Installs 2 parsers and 47 scenarios, via HTTP - Generic Protection.

View AWS CloudFront →

Installation

sudo cscli scenarios install crowdsecurity/http-wordpress-scan

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-wordpress-scan.yaml· 22 linesGitHub

1type: leaky1
2name: crowdsecurity/http-wordpress-scan
3description: "Detect exploitation attempts against common WordPress endpoints"
4filter: |2
5  evt.Meta.service == 'http' and
6  evt.Meta.log_type in ['http_access-log', 'http_error-log'] and
7  evt.Meta.http_status in ['404', '403'] and
8  Lower(evt.Parsed.request) matches "(?i)(/wp-.*\\.php|/wp-content/plugins/.*\\.(txt|md))$"
9groupby: evt.Meta.source_ip3
10distinct: evt.Parsed.request4
11capacity: 35
12leakspeed: "10s"6
13blackhole: 5m7
14labels:
15  remediation: true8
16  classification:9
17    - attack.T1595
18  behavior: "http:scan"
19  label: "WordPress Vuln Hunting"
20  spoofable: 0
21  service: wordpress
22  confidence: 3

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.