cscli scenarios install crowdsecurity/http-wordpress_wpconfigDetects probing to find alternate wp-config file, such as done by wpscan.
leakspeed of 10s, capacity of 5
1type: leaky2name: crowdsecurity/http-wordpress_wpconfig3description: "Detect WordPress probing: variations around wp-config.php by wpscan"4debug: false5filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name contains 'wp-config.php'"6groupby: evt.Meta.source_ip7distinct: evt.Parsed.file_name8capacity: 59leakspeed: "10s"10blackhole: 5m11labels:12 remediation: true13 classification:14 - attack.T159515 behavior: "http:scan"16 label: "Access to WordPress wp-config.php"17 spoofable: 018 confidence: 319 service: wordpress20