Postgres Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

Postgres Bruteforce

Attack scenariodatabase:bruteforceMITRE T1110

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/pgsql-bf
Remediation: Ban

Detect PgSQL bruteforce

Install with a top-level collection

3 collections include it

sudo cscli collections install crowdsecurity/supabase-compose

Installs 3 parsers and 50 scenarios.

View Supabase →

Installation

sudo cscli scenarios install crowdsecurity/pgsql-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/pgsql-bf.yaml· 19 linesGitHub

1# pgsql bruteforce
2type: leaky1
3#debug: true
4name: crowdsecurity/pgsql-bf
5description: "Detect PgSQL bruteforce"
6filter: evt.Meta.log_type == 'pgsql_failed_auth'2
7leakspeed: "10s"3
8capacity: 54
9groupby: evt.Meta.source_ip5
10blackhole: 5m6
11labels:
12 service: pgsql
13 remediation: true7
14 confidence: 3
15 spoofable: 0
16 classification:8
17  - attack.T1110
18 behavior: "database:bruteforce"
19 label: "Postgres Bruteforce"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect several failed postgresql authentications.

leakspeed of 10s, capacity of 5