cscli scenarios install melite/dovecot-slow-bfDetects slow brute-force attacks on Dovecot (POP3/IMAP) where attackers space login attempts 7-30 minutes apart to evade standard detection.
This is Tier 2 of the Dovecot detection chain, complementing crowdsecurity/dovecot-spam (Tier 1, ~24min window) and melite/dovecot-time-based-bf (Tier 3, pattern-based).
Uses a leaky bucket with 60-minute (3600s) leak rate and capacity of 3. Triggers after 4 failed authentication attempts from the same IP. At 10-minute intervals, all 4 events arrive before the first leak, guaranteeing detection.
Includes a _user-enum variant that triggers when the same IP tries different Dovecot usernames slowly.
Detection window: 3 hours max (leakspeed 3600s x capacity 3), typically triggers within 30-60 minutes
Ban the attacking IP.
A distributed attacker tests Dovecot credentials with ~10-minute intervals:
1Jan 15 08:00:00 server dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<admin@example.com>, method=PLAIN, rip=192.0.2.1, lip=10.0.0.1, TLS, session=<abc001>2Jan 15 08:10:00 server dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<admin@example.com>, method=PLAIN, rip=192.0.2.1, lip=10.0.0.1, TLS, session=<abc002>3Jan 15 08:20:00 server dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<admin@example.com>, method=PLAIN, rip=192.0.2.1, lip=10.0.0.1, TLS, session=<abc003>4Jan 15 08:30:00 server dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<admin@example.com>, method=PLAIN, rip=192.0.2.1, lip=10.0.0.1, TLS, session=<abc004>
crowdsecurity/dovecot-logs1# Slow bruteforce on Dovecot (POP3/IMAP)2# Tier 2: Detects distributed attacks spacing attempts 7-30 minutes apart3# Complements crowdsecurity/dovecot-spam (Tier 1, 360s/3)4# Detection window: 60min x 3 = 3 hours max (4 failures needed)5type: leaky6name: melite/dovecot-slow-bf7description: "Detect slow Dovecot bruteforce (distributed attacks)"8filter: "evt.Meta.log_type == 'dovecot_logs' && evt.Meta.dovecot_login_result == 'auth_failed'"9leakspeed: 3600s10capacity: 311groupby: evt.Meta.source_ip12blackhole: 5m13reprocess: true14labels:15 service: dovecot16 remediation: true17 confidence: 318 spoofable: 019 classification:20 - attack.T111021 behavior: "pop3/imap:bruteforce"22 label: "Dovecot Slow Bruteforce"23---24# User enumeration variant25type: leaky26name: melite/dovecot-slow-bf_user-enum27description: "Detect slow Dovecot user enumeration"28filter: "evt.Meta.log_type == 'dovecot_logs' && evt.Meta.dovecot_login_result == 'auth_failed'"29groupby: evt.Meta.source_ip30distinct: evt.Parsed.dovecot_user31leakspeed: 3600s32capacity: 333blackhole: 5m34labels:35 service: dovecot36 remediation: true37 confidence: 338 spoofable: 039 classification:40 - attack.T111041 behavior: "pop3/imap:bruteforce"42 label: "Dovecot Slow User Enumeration"43