1#contributed by ltsich
2type: trigger
3name: ltsich/http-w00tw00t
4description: "detect w00tw00t"
5debug: false
6filter: "evt.Meta.log_type == 'http_access-log' and (
7  evt.Parsed.file_name contains 'w00tw00t.at.ISC.SANS.DFind' or
8  Lower(evt.Meta.http_path) == '/core/skin/login.aspx'
9  )"
10groupby: evt.Meta.source_ip
11blackhole: 5m
12labels:
13  service: http
14  classification:
15    - attack.T1595
16  spoofable: 0
17  confidence: 3
18  behavior: "http:scan"
19  label: "w00t w00t Scanner"
20  remediation: true
21