MySQL Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

MySQL Bruteforce

Attack scenariodatabase:bruteforceMITRE T1110

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/mysql-bf
Remediation: Ban

Detect mysql bruteforce

Install with a top-level collection

2 collections include it

sudo cscli collections install crowdsecurity/apiscp

Installs 9 parsers and 56 scenarios, via MySQL - Bruteforce Protection.

View ApisCP →

Installation

sudo cscli scenarios install crowdsecurity/mysql-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/mysql-bf.yaml· 19 linesGitHub

1# mysql bruteforce
2type: leaky1
3#debug: true
4name: crowdsecurity/mysql-bf
5description: "Detect mysql bruteforce"
6filter: evt.Meta.log_type == 'mysql_failed_auth'2
7leakspeed: "10s"3
8capacity: 54
9groupby: evt.Meta.source_ip5
10blackhole: 5m6
11labels:
12  remediation: true7
13  confidence: 3
14  spoofable: 0
15  classification:8
16    - attack.T1110
17  behavior: "database:bruteforce"
18  label: "MySQL Bruteforce"
19  service: mysql

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect several failed mysql authentications.

leakspeed of 10s, capacity of 5