VSFTPD Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

VSFTPD Bruteforce

Attack scenarioftp:bruteforceMITRE T1110

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/vsftpd-bf
Remediation: Ban

Detect FTP bruteforce (vsftpd)

Install with a top-level collection

2 collections include it

sudo cscli collections install crowdsecurity/apiscp

Installs 9 parsers and 56 scenarios, via vsftpd - Bruteforce Protection.

View ApisCP →

Installation

sudo cscli scenarios install crowdsecurity/vsftpd-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/vsftpd-bf.yaml· 18 linesGitHub

1type: leaky1
2#debug: true
3name: crowdsecurity/vsftpd-bf
4description: "Detect FTP bruteforce (vsftpd)"
5filter: evt.Meta.log_type == 'ftp_failed_auth'2
6leakspeed: "10s"3
7capacity: 54
8groupby: evt.Meta.source_ip5
9blackhole: 5m6
10labels:
11  confidence: 3
12  spoofable: 0
13  classification:7
14    - attack.T1110
15  behavior: "ftp:bruteforce"
16  label: "VSFTPD Bruteforce"
17  remediation: true8
18  service: vsftpd

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect FTP bruteforce attack.

Rule

leakspeed of 10s, capacity of 5