Hub configuration

Name: OPNsense GUI Bruteforce
Author: crowdsecurity

More info

OPNsense GUI Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

« OPNsense GUI Bruteforce »
v0.3 by crowdsecurity / opnsense-gui-bf
Attack scenarioopnsenseNot spoofableHigh confidence

Detect bruteforce on opnsense web interface

Installation

cscli scenarios install crowdsecurity/opnsense-gui-bf

Description

OPNSense web portal bruteforce detection

Detects bruteforce attempts on the OPNSense web portal :

more than 5 attempts
10 seconds between each

YAML Configuration

1# opnsense web auth bruteforce
2type: leaky
3#debug: true
4name: crowdsecurity/opnsense-gui-bf
5description: "Detect bruteforce on opnsense web interface"
6filter: evt.Meta.log_type == 'opnsense-gui-failed-auth'
7leakspeed: "10s"
8capacity: 5
9groupby: evt.Meta.source_ip
10blackhole: 5m
11labels:
12  remediation: true
13  confidence: 3
14  spoofable: 0
15  classification:
16    - attack.T1110
17  behavior: "http:bruteforce"
18  label: "OPNsense GUI Bruteforce"
19  service: opnsense
20

Hub configuration

« OPNsense GUI Bruteforce »v0.3 by crowdsecurity / opnsense-gui-bfAttack scenarioOPNsenseopnsenseNot spoofableHigh confidenceMITRE:T1110

OPNSense web portal bruteforce detection

« OPNsense GUI Bruteforce »
v0.3 by crowdsecurity / opnsense-gui-bf
Attack scenarioopnsenseNot spoofableHigh confidence