Access to WordPress wp-config.php Detection Scenario by crowdsecurity | CrowdSec Hub

Access to WordPress wp-config.php

Attack scenariohttp:scanMITRE T1595

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/http-wordpress_wpconfig
Remediation: Ban

Detect WordPress probing: variations around wp-config.php by wpscan

Install with a top-level collection

1 collection include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios, via WordPress - Bruteforce Protection.

View NPMplus →

Installation

sudo cscli scenarios install crowdsecurity/http-wordpress_wpconfig

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/http-wordpress_wpconfig.yaml· 19 linesGitHub

1type: leaky1
2name: crowdsecurity/http-wordpress_wpconfig
3description: "Detect WordPress probing: variations around wp-config.php by wpscan"
4debug: false
5filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name contains 'wp-config.php'"2
6groupby: evt.Meta.source_ip3
7distinct: evt.Parsed.file_name4
8capacity: 55
9leakspeed: "10s"6
10blackhole: 5m7
11labels:
12  remediation: true8
13  classification:9
14    - attack.T1595
15  behavior: "http:scan"
16  label: "Access to WordPress wp-config.php"
17  spoofable: 0
18  confidence: 3
19  service: wordpress

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects probing to find alternate wp-config file, such as done by wpscan.

leakspeed of 10s, capacity of 5