Sonarr Bruteforce Detection Scenario by schiz0phr3ne | CrowdSec Hub

Sonarr Bruteforce

Attack scenariohttp:bruteforceMITRE T1110

By: schiz0phr3ne
Version: 0.2
Name: schiz0phr3ne/sonarr-bf
Remediation: Ban

Detect Sonarr bruteforce

Install with a top-level collection

1 collection include it

sudo cscli collections install schiz0phr3ne/sonarr

Installs 1 parser and 1 scenario.

View Sonarr - Bruteforce Protection →

Installation

sudo cscli scenarios install schiz0phr3ne/sonarr-bf

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/schiz0phr3ne/sonarr-bf.yaml· 41 linesGitHub

1# Sonarr bruteforce
2type: leaky1
3name: schiz0phr3ne/sonarr-bf
4description: "Detect Sonarr bruteforce"
5filter: "evt.Meta.log_type in ['sonarr_failed_authentication']"2
6leakspeed: "15s"3
7capacity: 54
8groupby: evt.Meta.source_ip5
9blackhole: 1m6
10reprocess: true
11labels:
12  service: sonarr
13  confidence: 3
14  spoofable: 0
15  classification:7
16    - attack.T1110
17  behavior: "http:bruteforce"
18  label: "Sonarr Bruteforce"
19  remediation: true8
20---
21# Sonarr user enum bruteforce
22type: leaky1
23name: schiz0phr3ne/sonarr-bf_user-enum
24description: "Detect Sonarr user enum bruteforce"
25filter: "evt.Meta.log_type in ['sonarr_failed_authentication']"2
26leakspeed: "30s"3
27capacity: 54
28groupby: evt.Meta.source_ip5
29distinct: evt.Meta.username9
30blackhole: 1m6
31reprocess: true
32labels:
33  service: sonarr
34  confidence: 3
35  spoofable: 0
36  classification:7
37    - attack.T1589
38    - attack.T1110
39  behavior: "http:bruteforce"
40  label: "Sonarr User Enumeration"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect failed Sonarr authentications:

leakspeed of 15s, capacity of 5 on source ip
leakspeed of 30s, capacity of 5 on source ip and unique distinct users