Windows Bruteforce Detection Scenario by crowdsecurity | CrowdSec Hub

Windows Bruteforce

Attack scenariowindows:bruteforceMITRE T1110

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/windows-bf
Remediation: Ban

Detect windows auth bruteforce

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/exchange

Installs 10 parsers and 49 scenarios.

View Exchange - Bruteforce Protection →

Installation

sudo cscli scenarios install crowdsecurity/windows-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/windows-bf.yaml· 19 linesGitHub

1# windows auth bruteforce
2type: leaky1
3name: crowdsecurity/windows-bf
4description: "Detect windows auth bruteforce"
5filter: "evt.Meta.log_type == 'windows_failed_auth'"2
6leakspeed: "10s"3
7capacity: 54
8groupby: evt.Meta.source_ip5
9blackhole: 1m6
10reprocess: true
11labels:
12  confidence: 3
13  spoofable: 0
14  classification:7
15    - attack.T1110
16  behavior: "windows:bruteforce"
17  label: "Windows Bruteforce"
18  remediation: true8
19  service: windows

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects BF against services using windows authentication (RDP, SMB, OWA, ...).

Buckets have a capacity of 5 and a leakspeed of 10s.