1# Audiobookshelf bruteforce
2type: leaky
3name: plague-doctor/audiobookshelf-bf
4description: "Detect Audiobookshelf bruteforce attacks"
5filter: "evt.Meta.service == 'audiobookshelf' && evt.Meta.log_type == 'abs_failed_auth'"
6leakspeed: 1m
7capacity: 3
8groupby: evt.Meta.source_ip
9blackhole: 5m
10reprocess: true
11labels:
12    service: audiobookshelf
13    type: bruteforce
14    classification:
15        - attack.T1110
16    remediation: true
17    behavior: http:bruteforce
18    spoofable: 0
19    confidence: 3
20