cscli scenarios install crowdsecurity/teleport-bfScenarios to detect teleport authentication bruteforce attacks.
1type: leaky2name: crowdsecurity/teleport-bf3description: "detect teleport bruteforce"4filter: |5 evt.Meta.service == 'teleport' &&6 evt.Meta.sub_type in ['auth', 'user.login'] &&7 evt.Meta.success == 'false'8groupby: evt.Meta.source_ip9capacity: 510leakspeed: "10s"11blackhole: 5m12labels:13 service: teleport14 type: bruteforce15 remediation: true16 confidence: 317 spoofable: 018 classification:19 - attack.T111020 label: "Teleport Bruteforce"21 behavior: "teleport:bruteforce"22---23type: leaky24name: crowdsecurity/teleport-slow-bf25description: "detect slow teleport bruteforce"26filter: |27 evt.Meta.service == 'teleport' &&28 evt.Meta.sub_type in ['auth', 'user.login'] &&29 evt.Meta.success == 'false'30groupby: evt.Meta.source_ip31capacity: 1032leakspeed: 1m33blackhole: 5m34labels:35 service: teleport36 type: bruteforce37 remediation: true38 confidence: 339 spoofable: 040 classification:41 - attack.T111042 label: "Teleport Bruteforce"43 behavior: "teleport:bruteforce"