Hub configuration

Name: WordPress User Enumeration
Author: crowdsecurity

More info

WordPress User Enumeration Detection Scenario by crowdsecurity | CrowdSec Hub

« WordPress User Enumeration »
v0.3 by crowdsecurity / http-wordpress_user-enum
Attack scenariowordpressNot spoofableHigh confidence

Detect WordPress probing: authors enumeration

Installation

cscli scenarios install crowdsecurity/http-wordpress_user-enum

Description

Detects probing to enumerate wordpress authors : /?author=XX

leakspeed of 10s, capacity of 5

YAML Configuration

1type: leaky
2name: crowdsecurity/http-wordpress_user-enum
3description: "Detect WordPress probing: authors enumeration"
4debug: false
5filter: "evt.Meta.log_type == 'http_access-log' && Upper(evt.Parsed.http_args) contains 'AUTHOR='"
6groupby: evt.Meta.source_ip
7distinct: evt.Parsed.http_args
8capacity: 5
9leakspeed: "10s"
10blackhole: 5m
11labels:
12  remediation: true
13  classification:
14    - attack.T1589
15    - attack.T1110
16    - attack.T1595
17  behavior: "http:scan"
18  label: "WordPress User Enumeration"
19  spoofable: 0
20  service: wordpress
21  confidence: 3
22

Hub configuration

« WordPress User Enumeration »v0.3 by crowdsecurity / http-wordpress_user-enumAttack scenarioWordPresswordpressNot spoofableHigh confidenceMITRE:T1589MITRE:T1110MITRE:T1595

« WordPress User Enumeration »
v0.3 by crowdsecurity / http-wordpress_user-enum
Attack scenariowordpressNot spoofableHigh confidence