1
2type: leaky
3name: vspaziani/fireflyiii-logs-bf
4description: "Detect Fireflyiii bruteforce"
5filter: "evt.Meta.log_type == 'fireflyiii_bad_password'"
6leakspeed: 1m
7capacity: 5
8groupby: evt.Meta.source_ip
9blackhole: 5m
10reprocess: true
11labels:
12 service: fireflyiii
13 behavior: "http:bruteforce"
14 classification:
15 - attack.T1110
16 label: "Fireflyiii Bruteforce"
17 spoofable: 0
18 confidence: 3
19 remediation: true
20---
21
22type: leaky
23name: vspaziani/fireflyiii-logs-enum
24description: "Detect Fireflyiii user enum bruteforce"
25filter: "evt.Meta.log_type == 'fireflyiii_bad_user' || evt.Meta.log_type == 'fireflyiii_bad_password'"
26groupby: evt.Meta.source_ip
27distinct: evt.Meta.username
28reprocess: true
29leakspeed: 10s
30capacity: 5
31blackhole: 1m
32labels:
33 service: fireflyiii
34 behavior: "http:bruteforce"
35 classification:
36 - attack.T1589
37 label: "Fireflyiii Bruteforce"
38 spoofable: 0
39 confidence: 3
40 remediation: true
41---
42
43type: leaky
44name: vspaziani/fireflyiii-logs-MFA-bf
45description: "Detect Fireflyiii MFA bruteforce"
46filter: "evt.Meta.log_type == 'fireflyiii_bad_mfa'"
47groupby: evt.Meta.source_ip
48leakspeed: 20s
49capacity: 5
50blackhole: 1m
51labels:
52 service: fireflyiii
53 confidence: 3
54 spoofable: 0
55 classification:
56 - attack.T1621
57 - attack.T1110
58 label: "Fireflyiii Bruteforce"
59 behavior: "http:bruteforce"
60 remediation: true
61
