Mailu web admin authentication attempt Detection Scenario by mwinters-stuff | CrowdSec Hub

Mailu web admin authentication attempt

Attack scenariohttp:bruteforceMITRE T1110.001

By: mwinters-stuff
Version: 0.2
Name: mwinters-stuff/mailu-admin-bf
Remediation: Ban

Detect mailu admin bruteforce

Install with a top-level collection

1 collection include it

sudo cscli collections install mwinters-stuff/mailu-admin

Installs 1 parser and 1 scenario.

View Mailu Admin - Bruteforce Protection →

Installation

sudo cscli scenarios install mwinters-stuff/mailu-admin-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/mwinters-stuff/mailu-admin-bf.yaml· 18 linesGitHub

1# mailu-admin bruteforce
2type: trigger1
3# debug: true
4name: mwinters-stuff/mailu-admin-bf
5description: "Detect mailu admin bruteforce"
6filter: evt.Meta.log_type == 'mailu_admin_auth_attempt'2
7groupby: evt.Meta.source_ip3
8blackhole: 5m4
9# reprocess: true
10labels:
11  service: http
12  classification:5
13    - attack.T1110.001
14  spoofable: 0
15  confidence: 3
16  behavior: "http:bruteforce"
17  label: "Mailu web admin authentication attempt"
18  remediation: true6

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects the brute force attacks on the mailu admin container.