cscli scenarios install lourys/pterodactyl-wings-bfDetect failed pterodactyl wings authentications:
Invalid format (this means that someone is trying out a username that doesn't match the correct format):
Invalid username/password:
1####################2## Invalid format ##3####################4type: leaky5name: lourys/pterodactyl-wings-bf6description: "Detect invalid_format ssh bruteforce"7filter: "evt.Meta.log_type == 'pterodactly_wings_invalid_format'"8leakspeed: 15m9capacity: 510groupby: evt.Meta.source_ip11blackhole: 30m12reprocess: true13labels:14 service: pterodactyl15 classification:16 - attack.T111017 spoofable: 018 confidence: 319 behavior: "ssh:bruteforce"20 label: "Pterodactyl Wing Bruteforce"21 remediation: true22---23type: leaky24name: lourys/pterodactyl-wings-bf25description: "Detect invalid_format ssh user enum bruteforce"26filter: evt.Meta.log_type == 'pterodactly_wings_invalid_format'27groupby: evt.Meta.source_ip28distinct: evt.Meta.target_user29leakspeed: 15m30capacity: 531blackhole: 30m32labels:33 service: pterodactyl34 classification:35 - attack.T108736 spoofable: 037 confidence: 338 behavior: "ssh:bruteforce"39 label: "Pterodactyl Wing Bruteforce"40 remediation: true4142###############################43## Invalid username/password ##44###############################45---46type: leaky47name: lourys/pterodactyl-wings-bf48description: "Detect invalid_username_or_password ssh bruteforce"49filter: evt.Meta.log_type == 'pterodactly_wings_invalid_username_or_password'50groupby: evt.Meta.source_ip51leakspeed: 5m52capacity: 1053blackhole: 5m54labels:55 service: pterodactyl56 classification:57 - attack.T111058 spoofable: 059 confidence: 360 behavior: "ssh:bruteforce"61 label: "Pterodactyl Wing Bruteforce"62 remediation: true63