NextCloud Bruteforce

1---
2type: leaky1
3name: crowdsecurity/nextcloud-bf
4description: "Detect Nextcloud bruteforce"
5filter: "evt.Meta.log_type in ['nextcloud_failed_auth', 'nextcloud_bruteforce_attempt']"2
6leakspeed: "1m"3
7capacity: 54
8# if we have bruteforce protection enabled in nextcloud, the same login attempt
9# can log # both login failure and bruteforce attempt at the same time, so
10# keep them in seperate buckets
11groupby: evt.Meta.source_ip + '--' + evt.Meta.log_type5
12blackhole: 5m6
13reprocess: true
14labels:
15  remediation: true7
16  confidence: 3
17  spoofable: 0
18  classification:8
19    - attack.T1110
20  behavior: "http:bruteforce"
21  label: "NextCloud Bruteforce"
22  service: nextcloud
23---
24type: leaky1
25name: crowdsecurity/nextcloud-bf_user_enum
26description: "Detect Nextcloud user enum bruteforce"
27filter: "evt.Meta.log_type == 'nextcloud_failed_auth'"2
28leakspeed: "1m"3
29capacity: 54
30groupby: evt.Meta.source_ip5
31distinct: evt.Meta.target_user9
32blackhole: 5m6
33reprocess: true
34labels:
35  remediation: true7
36  confidence: 3
37  spoofable: 0
38  classification:8
39    - attack.T1110
40  behavior: "http:bruteforce"