Attack Scenarios

Detect adguardhome bruteforce attacks

Ban ips that are blocked by amavis

Detect apache guacamole user bruteforce

Detect apache guacamole user enum bruteforce

Detect cve-2021-44228 exploitation attempts

Detect cas bruteforce

Detect slow cas bruteforce

Client made too many request to challenge page

Client made too many submissions for challenge

Crowdsec generic test scenario for appsec: generate an alert for appsec out of band rule for testing

Identify attacks flagged by crowdsec appsec via native rules

Identify attacks flagged by crowdsec appsec

Detect asterisk user bruteforce

Detect asterisk user enumeration bruteforce

Detect audiobookshelf bruteforce attacks

Detect post-exploitation behaviour : base64 + interpreter (perl/bash/python)

Detect post-exploitation behaviour : curl/wget and exec

Detect post-exploitation behaviour : pkill execve bursts

Detect post-exploitation behaviour : rm execve bursts

Detect root suid process crashing