1# Global brouteforce
2type: leaky
3#debug: true
4name: hitech95/email-generic-bf
5description: "Detect generic email brute force"
6filter: "evt.Meta.log_type == 'mail_auth' && evt.Meta.sub_type == 'auth_fail'"
7groupby: evt.Meta.source_ip
8capacity: 5
9leakspeed: "10s"
10blackhole: 1m
11labels:
12  service: pop3/imap
13  confidence: 3
14  spoofable: 0
15  classification:
16    - attack.T1110
17  behavior: "pop3/imap:bruteforce"
18  label: "POP3/IMAP Bruteforce"
19  remediation: true
20---
21# Per user brouteforce
22type: leaky
23#debug: true
24name: hitech95/email-user-bf
25description: "Detect specific user email brute force"
26filter: "evt.Meta.log_type == 'mail_auth' && evt.Meta.sub_type == 'auth_fail'"
27groupby: evt.Meta.source_ip
28distinct: evt.Meta.username
29capacity: 3
30leakspeed: "30s"
31blackhole: 1m
32labels:
33  service: pop3/imap
34  confidence: 3
35  spoofable: 0
36  classification:
37    - attack.T1589.002
38    - attack.T1110
39  behavior: "pop3/imap:bruteforce"
40  label: "Mail User Enum Bruteforce"
41  remediation: true
42