1# mysql bruteforce
2type: leaky
3#debug: true
4name: crowdsecurity/mssql-bf
5description: "Detect mssql bruteforce"
6filter: evt.Meta.log_type == 'mssql_failed_auth'
7leakspeed: "10s"
8capacity: 5
9groupby: evt.Meta.source_ip
10blackhole: 5m
11labels:
12  remediation: true
13  classification:
14    - attack.T1110
15  behavior: "database:bruteforce"
16  label: "MSSQL Bruteforce"
17  spoofable: 0
18  confidence: 3
19  service: mssql
20