CAS Slow Bruteforce Detection Scenario by jusabatier | CrowdSec Hub

CAS Slow Bruteforce

Attack scenariohttp:bruteforceMITRE T1110

By: jusabatier
Version: 0.2
Name: jusabatier/apereo-cas-slow-bf
Remediation: Ban

Detect slow CAS bruteforce

Install with a top-level collection

1 collection include it

sudo cscli collections install jusabatier/apereo-cas

Installs 1 parser and 2 scenarios.

View Apereo CAS - Bruteforce Protection →

Installation

sudo cscli scenarios install jusabatier/apereo-cas-slow-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/jusabatier/apereo-cas-slow-bf.yaml· 42 linesGitHub

1# CAS bruteforce
2type: leaky1
3name: jusabatier/cas-slow-bf
4description: "Detect slow CAS bruteforce"
5filter: "evt.Meta.log_type == 'cas_failed-auth'"2
6leakspeed: "60s"3
7references:
8  - http://wikipedia.com/cas-bf-is-bad
9capacity: 104
10groupby: evt.Meta.source_ip5
11blackhole: 1m6
12reprocess: true
13labels:
14  service: http
15  confidence: 3
16  spoofable: 0
17  classification:7
18    - attack.T1110
19  behavior: "http:bruteforce"
20  label: "CAS Slow Bruteforce"
21  remediation: true8
22---
23# cas user-enum
24type: leaky1
25name: jusabatier/cas-slow-bf_user-enum
26description: "Detect slow CAS user enum bruteforce"
27filter: evt.Meta.log_type == 'cas_failed-auth'2
28groupby: evt.Meta.source_ip5
29distinct: evt.Meta.target_user9
30leakspeed: 60s3
31capacity: 104
32blackhole: 1m6
33labels:
34  service: http
35  confidence: 3
36  spoofable: 0
37  classification:7
38    - attack.T1589
39    - attack.T1110
40  behavior: "http:bruteforce"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect slow CAS bruteforce authentications :

leakspeed of 60s, capacity of 10 on same target user
leakspeed of 60s, capacity of 10 unique distinct users