Http Scan
Attack scenariohttp:scanMITRE T1595
- Version
- 0.2
- Name
- cyrille37/sympa_ww-http-scan
- Remediation
- Ban
Detect http scan on Sympa endpoint
Install with a top-level collection
1 collection include itsudo cscli collections install cyrille37/sympa_wwInstalls 1 parser and 1 scenario.
View Sympa →Installation
sudo cscli scenarios install cyrille37/sympa_ww-http-scanThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
# cyrille37/sympa_ww-http-scan# Version: 2025-11-09## @see sympa_ww-http-scan.md## Docs:# - [Creating scenario](https://docs.crowdsec.net/docs/next/log_processor/scenarios/create)# - [expression language](https://expr-lang.org/docs/language-definition)#format: 2.0name: cyrille37/sympa_ww-http-scandescription: "Detect http scan on Sympa endpoint"type: leaky#debug: truefilter: "evt.Meta.service == 'wwsympa' && evt.Meta.sympa_warn != '' && not (hasSuffix(evt.Meta.sympa_message, 'robots.txt') || hasSuffix(evt.Meta.sympa_message, 'sitemap.xml') || hasSuffix(evt.Meta.sympa_message, 'favicon.ico'))"groupby: "evt.Meta.source_ip"# Here we say that if an IP address is doing more than X matches in less than Y seconds,# the scenario will be triggered and will then be silent for Zm for the same IP.capacity: 1leakspeed: 1mblackhole: 15mlabels:service: wwsympaspoofable: 0confidence: 3type: discoverylabel: "Http Scan"behavior: "http:scan"classification:- attack.T1595remediation: true
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
cyrille37/sympa_ww-http-scan
Sympa Web Service scan scenario based on Sympa log parser "cyrille37/sympa_ww-logs".
As Sympa reply HTTP 200 on unexisted files, we cannot detect http scan on http web server logs.
So this "leaky" scenario looks for errors signaled by "sympa_ww-logs" logs parser with meta "evt.Meta.sympa_warn" for blocking source after 1 attempt with a non existing action or list, except for files "robots.txt", "sitemap.xml" and "favicon.ico".