audiobookshelf-bf Detection Scenario by plague-doctor | CrowdSec Hub

audiobookshelf-bf

Attack scenariohttp:bruteforceMITRE T1110

By: plague-doctor
Version: 0.1
Remediation: Ban

Detect Audiobookshelf bruteforce attacks

Install with a top-level collection

1 collection include it

sudo cscli collections install plague-doctor/audiobookshelf

Installs 1 parser and 1 scenario.

View Audiobookshelf - Bruteforce Protection →

Installation

sudo cscli scenarios install plague-doctor/audiobookshelf-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/plague-doctor/audiobookshelf-bf.yaml· 19 linesGitHub

1# Audiobookshelf bruteforce
2type: leaky1
3name: plague-doctor/audiobookshelf-bf
4description: "Detect Audiobookshelf bruteforce attacks"
5filter: "evt.Meta.service == 'audiobookshelf' && evt.Meta.log_type == 'abs_failed_auth'"2
6leakspeed: 1m3
7capacity: 34
8groupby: evt.Meta.source_ip5
9blackhole: 5m6
10reprocess: true
11labels:
12    service: audiobookshelf
13    type: bruteforce
14    classification:7
15        - attack.T1110
16    remediation: true8
17    behavior: http:bruteforce
18    spoofable: 0
19    confidence: 3

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Description

Detect failed Audiobookshelf authentications:

3 failed authentication attempts within 1 minute leakspeed