WordPress User Enumeration Detection Scenario by crowdsecurity | CrowdSec Hub

WordPress User Enumeration

Attack scenariohttp:scanMITRE T1589MITRE T1110MITRE T1595

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/http-wordpress_user-enum
Remediation: Ban

Detect WordPress probing: authors enumeration

Install with a top-level collection

1 collection include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios, via WordPress - Bruteforce Protection.

View NPMplus →

Installation

sudo cscli scenarios install crowdsecurity/http-wordpress_user-enum

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-wordpress_user-enum.yaml· 21 linesGitHub

1type: leaky1
2name: crowdsecurity/http-wordpress_user-enum
3description: "Detect WordPress probing: authors enumeration"
4debug: false
5filter: "evt.Meta.log_type == 'http_access-log' && Upper(evt.Parsed.http_args) contains 'AUTHOR='"2
6groupby: evt.Meta.source_ip3
7distinct: evt.Parsed.http_args4
8capacity: 55
9leakspeed: "10s"6
10blackhole: 5m7
11labels:
12  remediation: true8
13  classification:9
14    - attack.T1589
15    - attack.T1110
16    - attack.T1595
17  behavior: "http:scan"
18  label: "WordPress User Enumeration"
19  spoofable: 0
20  service: wordpress
21  confidence: 3

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects probing to enumerate wordpress authors : /?author=XX

leakspeed of 10s, capacity of 5