1# Prowlarr bruteforce
2type: leaky
3name: schiz0phr3ne/prowlarr-bf
4description: "Detect Prowlarr bruteforce"
5filter: "evt.Meta.log_type in ['prowlarr_failed_authentication']"
6leakspeed: "15s"
7capacity: 5
8groupby: evt.Meta.source_ip
9blackhole: 1m
10reprocess: true
11labels:
12  service: prowlarr
13  confidence: 3
14  spoofable: 0
15  classification:
16    - attack.T1110
17  behavior: "http:bruteforce"
18  label: "Prowlarr Bruteforce"
19  remediation: true
20---
21# Prowlarr user enum bruteforce
22type: leaky
23name: schiz0phr3ne/prowlarr-bf_user-enum
24description: "Detect Prowlarr user enum bruteforce"
25filter: "evt.Meta.log_type in ['prowlarr_failed_authentication']"
26leakspeed: "30s"
27capacity: 5
28groupby: evt.Meta.source_ip
29distinct: evt.Meta.username
30blackhole: 1m
31reprocess: true
32labels:
33  service: prowlarr
34  confidence: 3
35  spoofable: 0
36  classification:
37    - attack.T1589
38    - attack.T1110
39  behavior: "http:bruteforce"
40  label: "Prowlarr User Enumeration"
41  remediation: true
42