SSHesame Bruteforce Detection Scenario by thespad | CrowdSec Hub

SSHesame Bruteforce

Attack scenariossh:bruteforceMITRE T1110

By: thespad
Version: 0.5
Name: thespad/sshesame-honeypot
Remediation: Ban

Detect sshesame bruteforce

Install with a top-level collection

1 collection include it

sudo cscli collections install thespad/sshesame

Installs 2 parsers and 1 scenario.

View SSHesame - Honeypot Protection →

Installation

sudo cscli scenarios install thespad/sshesame-honeypot

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/thespad/sshesame-honeypot.yaml· 53 linesGitHub

1# sshesame bruteforce
2type: leaky1
3name: thespad/sshesame-bf
4description: "Detect sshesame bruteforce"
5filter: "evt.Meta.log_type == 'sshesame_login'"2
6leakspeed: "30m"3
7capacity: 34
8groupby: evt.Meta.source_ip5
9blackhole: 1m6
10labels:
11  service: sshesame
12  confidence: 3
13  spoofable: 0
14  classification:7
15    - attack.T1110
16  behavior: "ssh:bruteforce"
17  label: "SSHesame Bruteforce"
18  remediation: true8
19---
20# sshesame commands
21type: trigger1
22name: thespad/sshesame-cmd
23description: "Detect sshesame commands"
24filter: "evt.Meta.log_type == 'sshesame_cmd'"2
25groupby: evt.Meta.source_ip5
26blackhole: 1m6
27labels:
28  service: sshesame
29  type: command
30  behavior: "linux:post-exploitation"
31  classification:7
32    - attack.T1059
33  spoofable: 0
34  confidence: 3
35  remediation: true8
36---
37# sshesame input
38type: leaky1
39name: thespad/sshesame-input
40description: "Detect sshesame input spam"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

sshesame scenarios

Scenarios for sshesame honeypot logs.

Scenario setup

All login events: leakspeed of 30m, capacity of 3
Any commands sent by clients as part of a connection attempt will immediately overflow