1type: leaky
2name: crowdsecurity/proftpd-bf_user-enum
3description: "Detect proftpd user enum bruteforce"
4filter: evt.Meta.log_type == 'ftp_failed_auth'
5groupby: evt.Meta.source_ip
6distinct: evt.Meta.target_user
7leakspeed: 10s
8capacity: 5
9blackhole: 1m
10labels:
11 service: proftpd
12 remediation: true
13 confidence: 3
14 spoofable: 0
15 classification:
16  - attack.T1110
17  - attack.T1190
18 behavior: "ftp:bruteforce"
19 label: "Proftpd Bruteforce"
20