cscli scenarios install crowdsecurity/wireguard-authDetects bruteforce attempts against a wireguard server. It will parse the wireguard log file and count the number of failed login attempts per IP address. If the number of failed login attempts exceeds the threshold, the IP address will trigger an alert.
1type: leaky2name: crowdsecurity/wireguard-auth3description: "Detects rejected connections attempts and unauthorized packets through wireguard tunnels"4filter: "evt.Meta.log_type == 'wireguard_failed_auth'"5groupby: evt.Meta.source_ip6leakspeed: "30s"7capacity: 38blackhole: 1m9labels:10 remediation: true11 service: wireguard12 confidence: 313 spoofable: 014 classification:15 - attack.T111016 label: "Wireguard Bruteforce"17 behavior: "generic:bruteforce"18