w00t w00t Scanner Detection Scenario by ltsich | CrowdSec Hub

w00t w00t Scanner

Attack scenariohttp:scanMITRE T1595

By: ltsich
Version: 0.3
Name: ltsich/http-w00tw00t
Remediation: Ban

detect w00tw00t

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/aws-cloudfront

Installs 2 parsers and 47 scenarios, via HTTP - Generic Protection.

View AWS CloudFront →

Installation

sudo cscli scenarios install ltsich/http-w00tw00t

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/ltsich/http-w00tw00t.yaml· 20 linesGitHub

1#contributed by ltsich
2type: trigger1
3name: ltsich/http-w00tw00t
4description: "detect w00tw00t"
5debug: false
6filter: "evt.Meta.log_type == 'http_access-log' and (2
7  evt.Parsed.file_name contains 'w00tw00t.at.ISC.SANS.DFind' or
8  Lower(evt.Meta.http_path) == '/core/skin/login.aspx'
9  )"
10groupby: evt.Meta.source_ip3
11blackhole: 5m4
12labels:
13  service: http
14  classification:5
15    - attack.T1595
16  spoofable: 0
17  confidence: 3
18  behavior: "http:scan"
19  label: "w00t w00t Scanner"
20  remediation: true6

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

trigger scenario to detect w00tw00t pattern used by http vulnerability scanner, see this ressource

Contributed by https://github.com/LtSich