cscli scenarios install crowdsecurity/http-wordpress-scan1type: leaky2name: crowdsecurity/http-wordpress-scan3description: "Detect exploitation attempts against common WordPress endpoints"4filter: |5 evt.Meta.service == 'http' and6 evt.Meta.log_type in ['http_access-log', 'http_error-log'] and7 evt.Meta.http_status in ['404', '403'] and8 Lower(evt.Parsed.request) matches "(?i)(/wp-.*\\.php|/wp-content/plugins/.*\\.(txt|md))$"9groupby: evt.Meta.source_ip10distinct: evt.Parsed.request11capacity: 312leakspeed: "10s"13blackhole: 5m14labels:15 remediation: true16 classification:17 - attack.T159518 behavior: "http:scan"19 label: "WordPress Vuln Hunting"20 spoofable: 021 service: wordpress22 confidence: 323