Wireguard Rejected Packets Detection Scenario by crowdsecurity | CrowdSec Hub

Wireguard Rejected Packets

Attack scenariogeneric:scanMITRE T1595

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/wireguard-auth
Remediation: Ban

Detects rejected connections attempts and unauthorized packets through wireguard tunnels

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/wireguard

Installs 2 parsers and 1 scenario.

View WireGuard - Authentication Detection →

Installation

sudo cscli scenarios install crowdsecurity/wireguard-auth

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/wireguard-auth.yaml· 17 linesGitHub

1type: leaky1
2name: crowdsecurity/wireguard-auth
3description: "Detects rejected connections attempts and unauthorized packets through wireguard tunnels"
4filter: "evt.Meta.log_type == 'wireguard_failed_auth'"2
5groupby: evt.Meta.source_ip3
6leakspeed: "30s"4
7capacity: 35
8blackhole: 1m6
9labels:
10  remediation: true7
11  service: wireguard
12  confidence: 3
13  spoofable: 0
14  classification:8
15    - attack.T1595
16  label: "Wireguard Rejected Packets"
17  behavior: "generic:scan"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects bruteforce attempts against a wireguard server. It will parse the wireguard log file and count the number of failed login attempts per IP address. If the number of failed login attempts exceeds the threshold, the IP address will trigger an alert.