SSH Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

SSH Bruteforce

Attack scenariossh:bruteforceMITRE T1110

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/ssh-bf
Remediation: Ban

Detect ssh bruteforce

Install with a top-level collection

7 collections include it

sudo cscli collections install crowdsecurity/unifi

Installs 5 parsers and 2 scenarios.

View UniFi →

Installation

sudo cscli scenarios install crowdsecurity/ssh-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/ssh-bf.yaml· 41 linesGitHub

1# ssh bruteforce
2type: leaky1
3name: crowdsecurity/ssh-bf
4description: "Detect ssh bruteforce"
5filter: "evt.Meta.log_type == 'ssh_failed-auth'"2
6leakspeed: "10s"3
7references:
8  - http://wikipedia.com/ssh-bf-is-bad
9capacity: 54
10groupby: evt.Meta.source_ip5
11blackhole: 1m6
12reprocess: true
13labels:
14  service: ssh
15  confidence: 3
16  spoofable: 0
17  classification:7
18    - attack.T1110
19  label: "SSH Bruteforce"
20  behavior: "ssh:bruteforce"
21  remediation: true8
22---
23# ssh user-enum
24type: leaky1
25name: crowdsecurity/ssh-bf_user-enum
26description: "Detect ssh user enum bruteforce"
27filter: evt.Meta.log_type == 'ssh_failed-auth'2
28groupby: evt.Meta.source_ip5
29distinct: evt.Meta.target_user9
30leakspeed: 10s3
31capacity: 54
32blackhole: 1m6
33labels:
34  service: ssh
35  remediation: true8
36  confidence: 3
37  spoofable: 0
38  classification:7
39    - attack.T1589
40  behavior: "ssh:bruteforce"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect failed ssh authentications :

leakspeed of 10s, capacity of 5 on same target user
leakspeed of 10s, capacity of 5 unique distinct users