SSH CVE-2024-6387 Detection Scenario by crowdsecurity | CrowdSec Hub

SSH CVE-2024-6387

Attack scenariossh:exploitMITRE T1190cve.CVE-2024-6387

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/ssh-cve-2024-6387
Remediation: Ban

Detect exploitation attempt of CVE-2024-6387

Install with a top-level collection

5 collections include it

sudo cscli collections install crowdsecurity/openbsd

Installs 6 parsers and 6 scenarios, via SSHD - Bruteforce Protection.

View OpenBSD →

Installation

sudo cscli scenarios install crowdsecurity/ssh-cve-2024-6387

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/ssh-cve-2024-6387.yaml· 20 linesGitHub

1# ssh bruteforce
2type: leaky1
3name: crowdsecurity/ssh-cve-2024-6387
4description: "Detect exploitation attempt of CVE-2024-6387"
5filter: "evt.Meta.log_type in ['ssh_auth_timeout', 'ssh_dispatch_fatal']"2
6leakspeed: "180s"3
7capacity: 34
8groupby: evt.Meta.source_ip5
9blackhole: 1m6
10reprocess: true
11labels:
12  service: ssh
13  confidence: 3
14  spoofable: 0
15  classification:7
16    - attack.T1190
17    - cve.CVE-2024-6387
18  label: "SSH CVE-2024-6387"
19  behavior: "ssh:exploit"
20  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect exploitation attempts of CVE-2024-6387