Hub configuration

Name: Charon IPsec Slow Bruteforce
Author: darkclip

More info

Charon IPsec Slow Bruteforce Detection Scenario by darkclip | CrowdSec Hub

« Charon IPsec Slow Bruteforce »
v0.1 by darkclip / charon-ipsec-slow-bf
Attack scenariocharon_ipsecNot spoofableHigh confidence

Detect Charon IPsec slow bruteforce

Installation

cscli scenarios install darkclip/charon-ipsec-slow-bf

Description

Detects slow bruteforce authentications for Charon IPsec server.

leakspeed of 60s, capacity of 10 on same source

YAML Configuration

1name: darkclip/charon-ipsec-bf
2#debug: true
3description: "Detect Charon IPsec slow bruteforce"
4filter: "evt.Meta.log_type == 'charon_ipsec_auth_fail'"
5type: leaky
6groupby: evt.Meta.source_ip
7leakspeed: "60s"
8capacity: 10
9blackhole: 1m
10labels:
11  service: charon_ipsec
12  behavior: "generic:bruteforce"
13  classification:
14    - attack.T1110
15  spoofable: 0
16  confidence: 3
17  label: "Charon IPsec Slow Bruteforce"
18  remediation: true
19

Hub configuration

« Charon IPsec Slow Bruteforce »v0.1 by darkclip / charon-ipsec-slow-bfAttack scenariocharon_ipsecNot spoofableHigh confidenceMITRE:T1110

« Charon IPsec Slow Bruteforce »
v0.1 by darkclip / charon-ipsec-slow-bf
Attack scenariocharon_ipsecNot spoofableHigh confidence