SSH Slow Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

SSH Slow Bruteforce

Attack scenariossh:bruteforceMITRE T1110

By: crowdsecurity
Version: 0.4
Name: crowdsecurity/ssh-slow-bf
Remediation: Ban

Detect slow ssh bruteforce

Install with a top-level collection

6 collections include it

sudo cscli collections install PumbaLP/cowrie

Installs 2 parsers and 4 scenarios.

View Cowrie Honeypot →

Installation

sudo cscli scenarios install crowdsecurity/ssh-slow-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/ssh-slow-bf.yaml· 41 linesGitHub

1# ssh bruteforce
2type: leaky1
3name: crowdsecurity/ssh-slow-bf
4description: "Detect slow ssh bruteforce"
5filter: "evt.Meta.log_type == 'ssh_failed-auth'"2
6leakspeed: "60s"3
7references:
8  - http://wikipedia.com/ssh-bf-is-bad
9capacity: 104
10groupby: evt.Meta.source_ip5
11blackhole: 1m6
12reprocess: true
13labels:
14  service: ssh
15  remediation: true7
16  confidence: 3
17  spoofable: 0
18  classification:8
19    - attack.T1110
20  behavior: "ssh:bruteforce"
21  label: "SSH Slow Bruteforce"
22---
23# ssh user-enum
24type: leaky1
25name: crowdsecurity/ssh-slow-bf_user-enum
26description: "Detect slow ssh user enum bruteforce"
27filter: evt.Meta.log_type == 'ssh_failed-auth'2
28groupby: evt.Meta.source_ip5
29distinct: evt.Meta.target_user9
30leakspeed: 60s3
31capacity: 104
32blackhole: 1m6
33labels:
34  service: ssh
35  remediation: true7
36  confidence: 3
37  spoofable: 0
38  classification:8
39    - attack.T1110
40  behavior: "ssh:bruteforce"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect slow ssh bruteforce authentications :

leakspeed of 60s, capacity of 10 on same target user
leakspeed of 60s, capacity of 10 unique distinct users