Authentik Bruteforce Detection Scenario by firix | CrowdSec Hub

Authentik Bruteforce

Attack scenariohttp:bruteforceMITRE T1110

By: firix
Version: 0.2
Name: firix/authentik-bf
Remediation: Ban

Detect authentik bruteforce

Install with a top-level collection

1 collection include it

sudo cscli collections install firix/authentik

Installs 1 parser and 1 scenario.

View Authentik - Bruteforce Protection →

Installation

sudo cscli scenarios install firix/authentik-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/firix/authentik-bf.yaml· 39 linesGitHub

1# Authentik BF scan
2type: leaky1
3name: firix/authentik-bf
4description: "Detect authentik bruteforce"
5filter: evt.Meta.log_type in ['authentik_failed_auth', 'authentik_invalid_username']2
6groupby: evt.Meta.source_ip3
7leakspeed: 20s4
8capacity: 55
9blackhole: 1m6
10labels:
11  service: authentik
12  behavior: "http:bruteforce"
13  spoofable: 0
14  confidence: 3
15  classification:7
16    - attack.T1110
17  label: "Authentik Bruteforce"
18  remediation: true8
19---
20# Authentik user-enum
21type: leaky1
22name: firix/authentik-bf_user-enum
23description: "Detect authentik user enum bruteforce"
24filter: evt.Meta.log_type in ['authentik_failed_auth', 'authentik_invalid_username']2
25groupby: evt.Meta.source_ip3
26distinct: evt.Meta.username9
27leakspeed: 1m4
28capacity: 55
29blackhole: 1m6
30labels:
31  service: authentik
32  behavior: "http:bruteforce"
33  spoofable: 0
34  confidence: 3
35  classification:7
36    - attack.T1589
37    - attack.T1110
38  label: "Authentik User Enumeration"
39  remediation: true 8

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect failed authentik authentications:

leakspeed of 20s, capacity of 5 on same target user
leakspeed of 1m, capacity of 5 unique distinct users