cscli scenarios install crowdsecurity/windows-bfDetects BF against services using windows authentication (RDP, SMB, OWA, ...).
Buckets have a capacity of 5 and a leakspeed of 10s.
1# windows auth bruteforce2type: leaky3name: crowdsecurity/windows-bf4description: "Detect windows auth bruteforce"5filter: "evt.Meta.log_type == 'windows_failed_auth'"6leakspeed: "10s"7capacity: 58groupby: evt.Meta.source_ip9blackhole: 1m10reprocess: true11labels:12 confidence: 313 spoofable: 014 classification:15 - attack.T111016 behavior: "windows:bruteforce"17 label: "Windows Bruteforce"18 remediation: true19 service: windows20