Postgres Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

Postgres Bruteforce

Attack scenariodatabase:bruteforceMITRE T1110MITRE T1589

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/pgsql-user-enum
Remediation: Ban

Detect postgresql user enumeration

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/supabase-compose

Installs 3 parsers and 50 scenarios.

View Supabase →

Installation

sudo cscli scenarios install crowdsecurity/pgsql-user-enum

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/pgsql-user-enum.yaml· 19 linesGitHub

1type: leaky1
2name: crowdsecurity/pgsql-user-enum
3description: "Detect postgresql user enumeration"
4filter: evt.Meta.log_type == 'pgsql_failed_auth'2
5groupby: evt.Meta.source_ip3
6distinct: evt.Meta.user4
7leakspeed: 10s5
8capacity: 56
9blackhole: 1m7
10labels:
11 service: pgsql
12 remediation: true8
13 confidence: 3
14 spoofable: 0
15 classification:9
16  - attack.T1110
17  - attack.T1589
18 behavior: "database:bruteforce"
19 label: "Postgres Bruteforce"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects attempts to enumerate postgresql users

leakspeed of 10s, capacity of 5