1# smb bruteforce
2type: leaky
3name: crowdsecurity/smb-bf
4description: "Detect smb bruteforce"
5filter: evt.Meta.log_type == 'smb_failed_auth'
6leakspeed: "10s"
7capacity: 5
8groupby: evt.Meta.source_ip
9blackhole: 5m
10labels:
11 service: smb
12 remediation: true
13 confidence: 3
14 spoofable: 0
15 classification:
16  - attack.T1110
17 behavior: "smb:bruteforce"
18 label: "SMB Bruteforce"