Zimbra Bruteforce Detection Scenario by firewallservices | CrowdSec Hub

Zimbra Bruteforce

Attack scenariopop3/imap:bruteforceMITRE T1110

By: firewallservices
Version: 0.2
Name: firewallservices/zimbra-bf
Remediation: Ban

Detect Zimbra bruteforce

Install with a top-level collection

1 collection include it

sudo cscli collections install firewallservices/zimbra

Installs 1 parser and 1 scenario.

View Zimbra - Bruteforce Protection →

Installation

sudo cscli scenarios install firewallservices/zimbra-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/firewallservices/zimbra-bf.yaml· 42 linesGitHub

1# Zimbra brutforce
2type: leaky1
3#debug: true
4name: firewallservices/zimbra-bf
5description: "Detect Zimbra bruteforce"
6filter: evt.Meta.log_type == 'zimbra_auth_fail'2
7leakspeed: 30s3
8capacity: 54
9groupby: evt.Meta.source_ip5
10blackhole: 1m6
11reprocess: true
12labels:
13  service: zimbra
14  confidence: 3
15  spoofable: 0
16  classification:7
17    - attack.T1110
18  behavior: "pop3/imap:bruteforce"
19  label: "Zimbra Bruteforce"
20  remediation: true8
21---
22# Zimbra user enumeration
23type: leaky1
24#debug: true
25name: firewallservices/zimbra-user-enum
26description: "Detect Zimbra user enum bruteforce"
27filter: evt.Meta.log_type == 'zimbra_auth_fail'2
28groupby: evt.Meta.source_ip5
29distinct: evt.Meta.user9
30leakspeed: 2m3
31capacity: 54
32blackhole: 1m6
33labels:
34  service: zimbra
35  confidence: 3
36  spoofable: 0
37  classification:7
38    - attack.T1589.002
39    - attack.T1110
40  behavior: "pop3/imap:bruteforce"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect various authentication failures on Zimbra

On the web login page
On the SMTP server (SMTPS and SUBMISSION)
On the IMAP server

This scenario uses two leaky buckets:

leakspeed of 30s, capacity of 5 (per client IP)
leakspeed of 2m, capacity of 5, on uniq target user (per client IP)