Impossible travel
Attack scenarioauth:successfulMITRE T1078
- Version
- 0.2
- Name
- crowdsecurity/impossible-travel-user
- Remediation
- Alert only
impossible travel user
Install with a top-level collection
2 collections include itsudo cscli collections install crowdsecurity/sshd-impossible-travelInstalls 1 parser and 2 scenarios.
View SSHD - Impossible Travel Detection →Installation
sudo cscli scenarios install crowdsecurity/impossible-travel-userThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
## Generic bucket to handle impossible travel for authentication with username scopetype: conditionalname: crowdsecurity/impossible-travel-userdescription: "impossible travel user"filter: "evt.Meta.log_type == 'auth_success' && evt.Meta.user not in ['', nil]"groupby: "evt.Meta.service + evt.Meta.user"# To make it generic we concatenate the service name and the usercapacity: -1condition: |len(queue.Queue) >= 2and Distance(queue.Queue[-1].Enriched.Latitude, queue.Queue[-1].Enriched.Longitude,queue.Queue[-2].Enriched.Latitude, queue.Queue[-2].Enriched.Longitude) > 1000leakspeed: 3hscope:type: usernameexpression: evt.Meta.userlabels:remediation: falseclassification:- attack.T1078behavior: "auth:successful"intent: anomalouslabel: "Impossible travel"spoofable: 0service: authenticationconfidence: 3
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
Generic implementation of impossible travel to detect users logging in from two different locations in a short period of time. If you wish write a parser to fall into this generic bucket you must set the following attributes on the meta object:
log_type:auth_successsource_ip: the IP addressuser: the user that logged inservice: the service the user logged in to EGssh
It is important to set the service attribute as this is how the buckets are separated. If you do not set the service attribute, all the events for the same user will fall into the same bucket not matter if it was a different service which could lead to false positives.