cscli scenarios install mwinters-stuff/mailu-admin-bfDetects the brute force attacks on the mailu admin container.
1# mailu-admin bruteforce2type: trigger3# debug: true4name: mwinters-stuff/mailu-admin-bf5description: "Detect mailu admin bruteforce"6filter: evt.Meta.log_type == 'mailu_admin_auth_attempt'7groupby: evt.Meta.source_ip8blackhole: 5m9# reprocess: true10labels:11 service: http12 classification:13 - attack.T1110.00114 spoofable: 015 confidence: 316 behavior: "http:bruteforce"17 label: "Mailu web admin authentication attempt"18 remediation: true19