1# windows auth bruteforce
2type: leaky
3name: crowdsecurity/windows-bf
4description: "Detect windows auth bruteforce"
5filter: "evt.Meta.log_type == 'windows_failed_auth'"
6leakspeed: "10s"
7capacity: 5
8groupby: evt.Meta.source_ip
9blackhole: 1m
10reprocess: true
11labels:
12  confidence: 3
13  spoofable: 0
14  classification:
15    - attack.T1110
16  behavior: "windows:bruteforce"
17  label: "Windows Bruteforce"
18  remediation: true
19  service: windows
20