TCP Port Scan Detection Scenario by crowdsecurity | CrowdSec Hub

TCP Port Scan

Attack scenariotcp:scanMITRE T1595.001MITRE T1018MITRE T1046

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/iptables-scan-multi_ports
Remediation: Ban

Detect aggressive portscans

Install with a top-level collection

2 collections include it

sudo cscli collections install crowdsecurity/unifi

Installs 5 parsers and 2 scenarios, via Iptables - Portscan Detection.

View UniFi →

Installation

sudo cscli scenarios install crowdsecurity/iptables-scan-multi_ports

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/iptables-scan-multi_ports.yaml· 19 linesGitHub

1type: leaky1
2name: crowdsecurity/iptables-scan-multi_ports
3description: "Detect aggressive portscans"
4filter: "evt.Meta.log_type == 'iptables_drop' && evt.Meta.service == 'tcp'"2
5groupby: evt.Meta.source_ip3
6distinct: evt.Parsed.dst_port4
7capacity: 155
8leakspeed: 5s6
9blackhole: 1m7
10labels:
11  remediation: true8
12  classification:9
13    - attack.T1595.001
14    - attack.T1018
15    - attack.T1046
16  behavior: "tcp:scan"
17  label: "TCP Port Scan"
18  spoofable: 3
19  confidence: 1

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects a port scan : detects if a single IP attempts connection to many different ports.

Leakspeed of 5s, capacity of 15.