Hub configuration

Name: Charon IPsec Bruteforce
Author: darkclip

More info

Charon IPsec Bruteforce Detection Scenario by darkclip | CrowdSec Hub

« Charon IPsec Bruteforce »
v0.1 by darkclip / charon-ipsec-bf
Attack scenariocharon_ipsecNot spoofableHigh confidence

Detect Charon IPsec bruteforce

Installation

cscli scenarios install darkclip/charon-ipsec-bf

Description

Detects bruteforce authentications for Charon IPsec server.

leakspeed of 10s, capacity of 5 on same source

YAML Configuration

1name: darkclip/charon-ipsec-bf
2#debug: true
3description: "Detect Charon IPsec bruteforce"
4filter: "evt.Meta.log_type == 'charon_ipsec_auth_fail'"
5type: leaky
6groupby: evt.Meta.source_ip
7leakspeed: "10s"
8capacity: 5
9blackhole: 1m
10labels:
11  service: charon_ipsec
12  behavior: "generic:bruteforce"
13  classification:
14    - attack.T1110
15  spoofable: 0
16  confidence: 3
17  label: "Charon IPsec Bruteforce"
18  remediation: true
19

Hub configuration

« Charon IPsec Bruteforce »v0.1 by darkclip / charon-ipsec-bfAttack scenariocharon_ipsecNot spoofableHigh confidenceMITRE:T1110

« Charon IPsec Bruteforce »
v0.1 by darkclip / charon-ipsec-bf
Attack scenariocharon_ipsecNot spoofableHigh confidence