cscli scenarios install melite/dovecot-time-based-bfDetects time-based Dovecot brute-force attacks where evasive attackers space POP3/IMAP login attempts 20 minutes or more apart.
This is Tier 3 of the Dovecot detection chain, catching attacks that evade both crowdsecurity/dovecot-spam (Tier 1) and melite/dovecot-slow-bf (Tier 2).
Uses a conditional bucket that triggers when at least 4 failed authentication attempts from the same IP have a median interval of 20 minutes or more. The 4-hour leakspeed defines the maximum bucket lifetime, keeping memory usage bounded.
Remediation is disabled by default because the dovecot-logs parser does not capture successful logins, so cancel_on cannot be used to reduce false positives (unlike crowdsecurity/ssh-time-based-bf which benefits from sshd-success-logs).
Includes a _user-enum variant for time-based Dovecot username enumeration.
Detection: 4+ failures with median interval >= 20 minutes (within 4h window)
Alert only (remediation disabled). Operators can enable remediation via CrowdSec profiles if desired.
An evasive attacker spaces Dovecot login attempts ~30 minutes apart:
1Jan 15 08:00:00 server dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<admin@example.com>, method=PLAIN, rip=198.51.100.1, lip=10.0.0.1, TLS, session=<def001>2Jan 15 08:30:00 server dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<info@example.com>, method=PLAIN, rip=198.51.100.1, lip=10.0.0.1, TLS, session=<def002>3Jan 15 09:00:00 server dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<admin@example.com>, method=PLAIN, rip=198.51.100.1, lip=10.0.0.1, TLS, session=<def003>4Jan 15 09:30:00 server dovecot: imap-login: Disconnected (auth failed, 1 attempts): user=<webmaster@example.com>, method=PLAIN, rip=198.51.100.1, lip=10.0.0.1, TLS, session=<def004>
crowdsecurity/dovecot-logs1# Time-based Dovecot bruteforce detection2# Tier 3: Detects evasive attacks with >= 20min median interval3# Complements melite/dovecot-slow-bf (Tier 2) and crowdsecurity/dovecot-spam (Tier 1)4# Uses conditional type with MedianInterval for pattern-based detection5type: conditional6name: melite/dovecot-time-based-bf7description: "Detect time-based Dovecot bruteforce (evasive attacks)"8filter: "evt.Meta.log_type == 'dovecot_logs' && evt.Meta.dovecot_login_result == 'auth_failed'"9groupby: evt.Meta.source_ip10capacity: -111condition: |12 len(queue.Queue) >= 4 &&13 MedianInterval(map(queue.Queue[-4:], {#.Time})) >= duration("20m")14leakspeed: 4h15blackhole: 5m16reprocess: true17labels:18 service: dovecot19 remediation: false20 confidence: 221 spoofable: 022 classification:23 - attack.T111024 behavior: "pop3/imap:bruteforce"25 label: "Dovecot Time-Based Bruteforce"26---27# User enumeration variant28type: conditional29name: melite/dovecot-time-based-bf_user-enum30description: "Detect time-based Dovecot user enumeration (evasive attacks)"31filter: "evt.Meta.log_type == 'dovecot_logs' && evt.Meta.dovecot_login_result == 'auth_failed'"32groupby: evt.Meta.source_ip33distinct: evt.Parsed.dovecot_user34capacity: -135condition: |36 len(queue.Queue) >= 4 &&37 MedianInterval(map(queue.Queue[-4:], {#.Time})) >= duration("20m")38leakspeed: 4h39blackhole: 5m40labels:41 service: dovecot42 remediation: false43 confidence: 244 spoofable: 045 classification:46 - attack.T111047 behavior: "pop3/imap:bruteforce"48 label: "Dovecot Time-Based User Enumeration"49