Nginx request limit exceeded Detection Scenario by crowdsecurity | CrowdSec Hub

Nginx request limit exceeded

Attack scenariohttp:dosMITRE T1498

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/nginx-req-limit-exceeded
Remediation: Ban

Detects IPs which violate nginx's user set request limit.

Install with a top-level collection

5 collections include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios.

View NPMplus →

Installation

sudo cscli scenarios install crowdsecurity/nginx-req-limit-exceeded

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/nginx-req-limit-exceeded.yaml· 18 linesGitHub

1type: leaky1
2#debug: true
3name: crowdsecurity/nginx-req-limit-exceeded
4description: "Detects IPs which violate nginx's user set request limit."
5filter: evt.Meta.sub_type == 'req_limit_exceeded'2
6leakspeed: "60s"3
7capacity: 54
8groupby: evt.Meta.source_ip5
9blackhole: 5m6
10labels:
11  remediation: true7
12  confidence: 2
13  spoofable: 2
14  classification:8
15    - attack.T1498
16  behavior: "http:dos"
17  label: "Nginx request limit exceeded"
18  service: http

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects IPs which violate nginx's user set request limit.

IP is banned if it violates nginx's user set request limit more than 5 times in a minute.