1type: leaky
2name: crowdsecurity/proftpd-bf
3description: "Detect proftpd bruteforce"
4filter: "evt.Meta.log_type == 'ftp_failed_auth'"
5leakspeed: "10s"
6capacity: 5
7groupby: evt.Meta.source_ip
8blackhole: 1m
9reprocess: true
10labels:
11 service: proftpd
12 remediation: true
13 confidence: 3
14 spoofable: 0
15 classification:
16  - attack.T1110
17 behavior: "ftp:bruteforce"
18 label: "Proftpd Bruteforce"
19