cscli scenarios install ltsich/http-w00tw00ttrigger scenario to detect w00tw00t pattern used by http vulnerability scanner, see this ressource
Contributed by https://github.com/LtSich
1#contributed by ltsich2type: trigger3name: ltsich/http-w00tw00t4description: "detect w00tw00t"5debug: false6filter: "evt.Meta.log_type == 'http_access-log' and (7 evt.Parsed.file_name contains 'w00tw00t.at.ISC.SANS.DFind' or8 Lower(evt.Meta.http_path) == '/core/skin/login.aspx'9 )"10groupby: evt.Meta.source_ip11blackhole: 5m12labels:13 service: http14 classification:15 - attack.T159516 spoofable: 017 confidence: 318 behavior: "http:scan"19 label: "w00t w00t Scanner"20 remediation: true21