LiteSpeed Admin Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

LiteSpeed Admin Bruteforce

Attack scenariohttp:bruteforceMITRE T1110

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/litespeed-admin-bf
Remediation: Ban

Detect bruteforce against litespeed admin UI

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/litespeed

Installs 2 parsers and 48 scenarios.

View LiteSpeed →

Installation

sudo cscli scenarios install crowdsecurity/litespeed-admin-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/litespeed-admin-bf.yaml· 17 linesGitHub

1type: leaky1
2name: crowdsecurity/litespeed-admin-bf
3description: "Detect bruteforce against litespeed admin UI"
4filter: "evt.Meta.service == 'http' && evt.Meta.sub_type == 'litespeed_admin_auth_fail'"2
5groupby: evt.Meta.source_ip3
6capacity: 54
7leakspeed: "10s"5
8blackhole: 1m6
9labels:
10  remediation: true7
11  classification:8
12    - attack.T1110
13  behavior: "http:bruteforce"
14  label: "LiteSpeed Admin Bruteforce"
15  spoofable: 0
16  confidence: 3
17  service: litespeed

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Alert when a single IP that try to bruteforce litespeed admin UI.

Leakspeed of 10s, capacity of 5.