Hub configuration

Name: VSFTPD Bruteforce
Author: crowdsecurity

More info

VSFTPD Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

« VSFTPD Bruteforce »
v0.2 by crowdsecurity / vsftpd-bf
Attack scenariovsftpdNot spoofableHigh confidence

Detect FTP bruteforce (vsftpd)

Installation

cscli scenarios install crowdsecurity/vsftpd-bf

Description

Detect FTP bruteforce attack.

Rule

leakspeed of 10s, capacity of 5

YAML Configuration

1type: leaky
2#debug: true
3name: crowdsecurity/vsftpd-bf
4description: "Detect FTP bruteforce (vsftpd)"
5filter: evt.Meta.log_type == 'ftp_failed_auth'
6leakspeed: "10s"
7capacity: 5
8groupby: evt.Meta.source_ip
9blackhole: 5m
10labels:
11  confidence: 3
12  spoofable: 0
13  classification:
14    - attack.T1110
15  behavior: "ftp:bruteforce"
16  label: "VSFTPD Bruteforce"
17  remediation: true
18  service: vsftpd
19

Hub configuration

« VSFTPD Bruteforce »v0.2 by crowdsecurity / vsftpd-bfAttack scenariovsftpdNot spoofableHigh confidenceMITRE:T1110

Detect FTP bruteforce attack.

Rule

« VSFTPD Bruteforce »
v0.2 by crowdsecurity / vsftpd-bf
Attack scenariovsftpdNot spoofableHigh confidence