CAS Bruteforce Detection Scenario by jusabatier | CrowdSec Hub

CAS Bruteforce

Attack scenariohttp:bruteforceMITRE T1110

By: jusabatier
Version: 0.2
Name: jusabatier/apereo-cas-bf
Remediation: Ban

Detect CAS bruteforce

Install with a top-level collection

1 collection include it

sudo cscli collections install jusabatier/apereo-cas

Installs 1 parser and 2 scenarios.

View Apereo CAS - Bruteforce Protection →

Installation

sudo cscli scenarios install jusabatier/apereo-cas-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/jusabatier/apereo-cas-bf.yaml· 42 linesGitHub

1# cas bruteforce
2type: leaky1
3name: jusabatier/apereo-cas-bf
4description: "Detect CAS bruteforce"
5filter: "evt.Meta.log_type == 'cas_failed-auth'"2
6leakspeed: "10s"3
7references:
8  - http://wikipedia.com/cas-bf-is-bad
9capacity: 54
10groupby: evt.Meta.source_ip5
11blackhole: 1m6
12reprocess: true
13labels:
14  service: http
15  confidence: 3
16  spoofable: 0
17  classification:7
18    - attack.T1110
19  behavior: "http:bruteforce"
20  label: "CAS Bruteforce"
21  remediation: true8
22---
23# cas user-enum
24type: leaky1
25name: jusabatier/apereo-cas-bf_user-enum
26description: "Detect CAS user enum bruteforce"
27filter: evt.Meta.log_type == 'cas_failed-auth'2
28groupby: evt.Meta.source_ip5
29distinct: evt.Meta.target_user9
30leakspeed: 10s3
31capacity: 54
32blackhole: 1m6
33labels:
34  service: http
35  confidence: 3
36  spoofable: 0
37  classification:7
38    - attack.T1589
39    - attack.T1110
40  behavior: "http:bruteforce"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect failed CAS authentications :

leakspeed of 10s, capacity of 5 on same target user
leakspeed of 10s, capacity of 5 unique distinct users