generic http brute force detection about hub HOT 3 CLOSED

Thinking more about it I believe the "client denied by server configuration" errors should belong to the crowdsecurity/http-crawl-non_statics or crowdsecurity/http-probing. Fail2ban does not make the distinction and catch them with apache-auth plugin.

Crowdsec could benefit from #51 to detect a login/password brute force with specific error log messages.

from hub.

Hello @ririsoft
Thanks for you feedback!

A PR has been opened and is in work in progress about this issue which add/fix the following things:

• apache2 errors log support
• add a generic http brute force detection scenario

Note: Once the PR will be merged, those change will only be available for the crowdsec >= v1 which is currently in pre-release.

About the access.log that you shared, it is normal that the IP has not been detected by crowdsec.
Indeed, we can see that the attacker only try to access to 5 files, and then come back hours later.
As we can see in the crowdsecurity/http-probing configuration, the bucket capacity is 10, so it can't overflow .

Last thing, i think that if the http_probing scenario is not triggered, it's because your access.log are not parsed. I can help you to parse them in #52

I hope i answered your question,

from hub.

@AlteredCoder Are there plans to link those to a scenario? As of now it gets detected but not remediated because sub_type "permission_denied" is not linked to a scenario afaik.

from hub.