Telnet Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

Telnet Bruteforce

Attack scenariotelnet:bruteforceMITRE T1110

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/telnet-bf
Remediation: Ban

detect telnet bruteforce

Install with a top-level collection

1 collection include it

sudo cscli collections install PumbaLP/cowrie

Installs 2 parsers and 4 scenarios.

View Cowrie Honeypot →

Installation

sudo cscli scenarios install crowdsecurity/telnet-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/telnet-bf.yaml· 18 linesGitHub

1type: leaky1
2name: crowdsecurity/telnet-bf
3description: "detect telnet bruteforce"
4filter: evt.Meta.log_type == 'telnet_new_session'2
5groupby: evt.Meta.source_ip3
6capacity: 54
7leakspeed: "10s"5
8blackhole: 5m6
9labels:
10  service: telnet
11  confidence: 3
12  spoofable: 0
13  classification:7
14    - attack.T1110
15  behavior: "telnet:bruteforce"
16  intent: reconnaissance
17  label: "Telnet Bruteforce"
18  remediation: true8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect Telnet bruteforce attack.

Rule

leakspeed of 10s, capacity of 5