Postfix Spam Detection Scenario by crowdsecurity | CrowdSec Hub

Postfix Spam

Attack scenariosmtp:spam

By: crowdsecurity
Version: 0.4
Name: crowdsecurity/postfix-spam
Remediation: Ban

Detect spammers

Install with a top-level collection

2 collections include it

sudo cscli collections install crowdsecurity/apiscp

Installs 9 parsers and 56 scenarios, via Postfix - Bruteforce Protection.

View ApisCP →

Installation

sudo cscli scenarios install crowdsecurity/postfix-spam

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/postfix-spam.yaml· 37 linesGitHub

1# postfix spam
2type: leaky1
3name: crowdsecurity/postfix-spam
4description: "Detect spammers"
5filter: "evt.Meta.log_type_enh == 'spam-attempt' || evt.Meta.log_type == 'postfix' && evt.Meta.action == 'reject'"2
6leakspeed: "10s"3
7references:
8  - https://en.wikipedia.org/wiki/Spamming
9capacity: 54
10groupby: evt.Meta.source_ip5
11blackhole: 1m6
12reprocess: false
13labels:
14  service: postfix
15  remediation: true7
16  confidence: 3
17  spoofable: 0
18  behavior: "smtp:spam"
19  label: "Postfix Spam"
20---
21# postfix spam
22type: trigger1
23name: crowdsecurity/postscreen-rbl
24description: "Detect spammers"
25filter: "evt.Meta.service == 'postscreen' && evt.Meta.pregreet == 'PREGREET'"2
26references:
27  - https://en.wikipedia.org/wiki/Spamming
28groupby: evt.Meta.source_ip5
29blackhole: 1m6
30reprocess: false
31labels:
32  service: postscreen
33  remediation: true7
34  confidence: 3
35  spoofable: 0
36  behavior: "smtp:spam"
37  label: "Postfix Spam"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Contains multiple scenarios:

crowdsecurity/postfix-spam: postfix scenario bruteforce spam attempt (leakspeed of 10s with a capacity of 5)
crowdsecurity/postscreen-rbl: postscreen rb attempt blacklist (capacity of 0)