From 7817b40ae2b9e47be6fc23233b2d6e5e8833f875 Mon Sep 17 00:00:00 2001 From: bms8197 Date: Mon, 23 Oct 2023 15:56:04 +0300 Subject: [PATCH] saving uncommitted changes in /etc prior to dnf run --- .etckeeper | 30 +- crowdsec/hub/.index.json | 4173 +++++++++++++---- .../collections/crowdsecurity/http-cve.yaml | 2 + .../s02-enrich/crowdsecurity/http-logs.yaml | 2 +- .../crowdsecurity/CVE-2019-18935.yaml | 9 + .../crowdsecurity/CVE-2022-26134.yaml | 9 + .../crowdsecurity/CVE-2022-35914.yaml | 9 + .../crowdsecurity/CVE-2022-37042.yaml | 22 +- .../crowdsecurity/CVE-2022-40684.yaml | 10 +- .../crowdsecurity/CVE-2022-41082.yaml | 13 +- .../crowdsecurity/CVE-2022-41697.yaml | 16 +- .../crowdsecurity/CVE-2022-42889.yaml | 11 +- .../crowdsecurity/CVE-2022-44877.yaml | 17 +- .../crowdsecurity/CVE-2022-46169.yaml | 35 +- .../crowdsecurity/CVE-2023-22515.yaml | 22 + .../apache_log4j2_cve-2021-44228.yaml | 10 +- .../f5-big-ip-cve-2020-5902.yaml | 10 +- .../fortinet-cve-2018-13379.yaml | 10 +- .../crowdsecurity/grafana-cve-2021-43798.yaml | 10 +- .../http-backdoors-attempts.yaml | 7 +- .../crowdsecurity/http-bad-user-agent.yaml | 8 +- .../crowdsecurity/http-crawl-non_statics.yaml | 11 +- .../crowdsecurity/http-cve-2021-41773.yaml | 10 +- .../crowdsecurity/http-cve-2021-42013.yaml | 10 +- .../crowdsecurity/http-generic-bf.yaml | 33 +- .../crowdsecurity/http-open-proxy.yaml | 12 +- .../http-path-traversal-probing.yaml | 11 +- .../scenarios/crowdsecurity/http-probing.yaml | 11 +- .../crowdsecurity/http-sensitive-files.yaml | 9 +- .../crowdsecurity/http-sqli-probing.yaml | 9 +- .../crowdsecurity/http-xss-probing.yaml | 9 +- .../crowdsecurity/jira_cve-2021-26086.yaml | 10 +- .../hub/scenarios/crowdsecurity/mysql-bf.yaml | 11 +- .../scenarios/crowdsecurity/netgear_rce.yaml | 11 +- .../nginx-req-limit-exceeded.yaml | 11 +- .../pulse-secure-sslvpn-cve-2019-11510.yaml | 9 +- .../spring4shell_cve-2022-22965.yaml | 9 +- .../hub/scenarios/crowdsecurity/ssh-bf.yaml | 23 +- .../scenarios/crowdsecurity/ssh-slow-bf.yaml | 23 +- .../thinkphp-cve-2018-20062.yaml | 10 +- .../crowdsecurity/vmware-cve-2022-22954.yaml | 10 +- .../vmware-vcenter-vmsa-2021-0027.yaml | 10 +- .../hub/scenarios/ltsich/http-w00tw00t.yaml | 11 +- crowdsec/scenarios/CVE-2023-22515.yaml | 1 + csf/changelog.txt | 10 + csf/csf.ignore | 21 +- csf/version.txt | 2 +- httpd/conf.d/ssl.conf | 203 - kernel/install.d/dkms | 9 - letsencrypt/archive/mully.898.ro/cert1.pem | 29 + letsencrypt/archive/mully.898.ro/chain1.pem | 61 + .../archive/mully.898.ro/fullchain1.pem | 90 + letsencrypt/archive/mully.898.ro/privkey1.pem | 28 + letsencrypt/csr/0545_csr-certbot.pem | 16 + letsencrypt/keys/0545_key-certbot.pem | 28 + letsencrypt/live/mully.898.ro/README | 14 + letsencrypt/live/mully.898.ro/cert.pem | 1 + letsencrypt/live/mully.898.ro/chain.pem | 1 + letsencrypt/live/mully.898.ro/fullchain.pem | 1 + letsencrypt/live/mully.898.ro/privkey.pem | 1 + letsencrypt/renewal/mully.898.ro.conf | 14 + nagios/nrpe.cfg | 8 +- nginx/conf.d/_zira.go.ro.conf | 44 - nginx/conf.d/mully.go.ro.conf | 33 + nginx/conf.d/zira.898.ro.conf | 12 - nginx/conf.d/zira.go.ro.conf | 12 - pki/ca-trust/extracted/edk2/cacerts.bin | Bin 155907 -> 161259 bytes pki/ca-trust/extracted/java/cacerts | Bin 156478 -> 161817 bytes .../extracted/openssl/ca-bundle.trust.crt | 2308 ++++----- .../extracted/pem/email-ca-bundle.pem | 293 +- .../extracted/pem/objsign-ca-bundle.pem | 2191 +++++---- pki/ca-trust/extracted/pem/tls-ca-bundle.pem | 365 +- resolv.conf | 3 +- rspamd/modules.d/aws_s3.conf | 6 +- rspamd/modules.d/known_senders.conf | 31 + rspamd/modules.d/phishing.conf | 6 + rspamd/modules.d/rbl.conf | 20 +- rspamd/modules.d/redis.conf | 1 + rspamd/scores.d/phishing_group.conf | 4 + rspamd/scores.d/surbl_group.conf | 28 +- selinux/targeted/.policy.sha512 | 2 +- selinux/targeted/policy/policy.31 | Bin 8814482 -> 8814587 bytes ssh/sshrc | 3 - tor/torrc | 20 +- 84 files changed, 6999 insertions(+), 3629 deletions(-) create mode 100644 crowdsec/hub/scenarios/crowdsecurity/CVE-2023-22515.yaml create mode 120000 crowdsec/scenarios/CVE-2023-22515.yaml delete mode 100644 httpd/conf.d/ssl.conf delete mode 100755 kernel/install.d/dkms create mode 100644 letsencrypt/archive/mully.898.ro/cert1.pem create mode 100644 letsencrypt/archive/mully.898.ro/chain1.pem create mode 100644 letsencrypt/archive/mully.898.ro/fullchain1.pem create mode 100644 letsencrypt/archive/mully.898.ro/privkey1.pem create mode 100644 letsencrypt/csr/0545_csr-certbot.pem create mode 100644 letsencrypt/keys/0545_key-certbot.pem create mode 100644 letsencrypt/live/mully.898.ro/README create mode 120000 letsencrypt/live/mully.898.ro/cert.pem create mode 120000 letsencrypt/live/mully.898.ro/chain.pem create mode 120000 letsencrypt/live/mully.898.ro/fullchain.pem create mode 120000 letsencrypt/live/mully.898.ro/privkey.pem create mode 100644 letsencrypt/renewal/mully.898.ro.conf delete mode 100644 nginx/conf.d/_zira.go.ro.conf create mode 100644 nginx/conf.d/mully.go.ro.conf delete mode 100644 nginx/conf.d/zira.898.ro.conf delete mode 100644 nginx/conf.d/zira.go.ro.conf create mode 100644 rspamd/modules.d/known_senders.conf diff --git a/.etckeeper b/.etckeeper index 80322c8..e83eb6b 100755 --- a/.etckeeper +++ b/.etckeeper @@ -293,10 +293,14 @@ maybe chmod 0644 'clamav-unofficial-sigs/user.conf' maybe chown 'amavis' 'clamd.conf' maybe chgrp 'amavis' 'clamd.conf' maybe chmod 0640 'clamd.conf' +maybe chown 'amavis' 'clamd.d' +maybe chgrp 'amavis' 'clamd.d' maybe chmod 0755 'clamd.d' maybe chown 'amavis' 'clamd.d/amavisd.conf' maybe chgrp 'amavis' 'clamd.d/amavisd.conf' maybe chmod 0644 'clamd.d/amavisd.conf' +maybe chown 'amavis' 'clamd.d/scan.conf' +maybe chgrp 'amavis' 'clamd.d/scan.conf' maybe chmod 0644 'clamd.d/scan.conf' maybe chmod 0755 'cloud' maybe chmod 0755 'cockpit' @@ -378,6 +382,7 @@ maybe chmod 0644 'crowdsec/hub/scenarios/crowdsecurity/CVE-2022-41697.yaml' maybe chmod 0644 'crowdsec/hub/scenarios/crowdsecurity/CVE-2022-42889.yaml' maybe chmod 0644 'crowdsec/hub/scenarios/crowdsecurity/CVE-2022-44877.yaml' maybe chmod 0644 'crowdsec/hub/scenarios/crowdsecurity/CVE-2022-46169.yaml' +maybe chmod 0644 'crowdsec/hub/scenarios/crowdsecurity/CVE-2023-22515.yaml' maybe chmod 0644 'crowdsec/hub/scenarios/crowdsecurity/apache_log4j2_cve-2021-44228.yaml' maybe chmod 0644 'crowdsec/hub/scenarios/crowdsecurity/f5-big-ip-cve-2020-5902.yaml' maybe chmod 0644 'crowdsec/hub/scenarios/crowdsecurity/fortinet-cve-2018-13379.yaml' @@ -1018,7 +1023,6 @@ maybe chmod 0644 'httpd/conf.d/perl.conf' maybe chmod 0644 'httpd/conf.d/php.conf' maybe chmod 0644 'httpd/conf.d/phpmyadmin.conf' maybe chmod 0644 'httpd/conf.d/squid.conf' -maybe chmod 0644 'httpd/conf.d/ssl.conf' maybe chmod 0644 'httpd/conf.d/ssl.conf_disabled' maybe chmod 0644 'httpd/conf.d/userdir.conf' maybe chmod 0644 'httpd/conf.d/welcome.conf' @@ -1187,7 +1191,6 @@ maybe chmod 0755 'kernel' maybe chmod 0755 'kernel/install.d' maybe chmod 0644 'kernel/install.d/20-grubby.install' maybe chmod 0644 'kernel/install.d/90-loaderentry.install' -maybe chmod 0755 'kernel/install.d/dkms' maybe chmod 0755 'kernel/postinst.d' maybe chmod 0755 'kernel/postinst.d/dkms' maybe chmod 0755 'kernel/prerm.d' @@ -1786,6 +1789,11 @@ maybe chmod 0640 'letsencrypt/archive/mail.club3d.ro/privkey6.pem' maybe chmod 0640 'letsencrypt/archive/mail.club3d.ro/privkey7.pem' maybe chmod 0640 'letsencrypt/archive/mail.club3d.ro/privkey8.pem' maybe chmod 0640 'letsencrypt/archive/mail.club3d.ro/privkey9.pem' +maybe chmod 0750 'letsencrypt/archive/mully.898.ro' +maybe chmod 0640 'letsencrypt/archive/mully.898.ro/cert1.pem' +maybe chmod 0640 'letsencrypt/archive/mully.898.ro/chain1.pem' +maybe chmod 0640 'letsencrypt/archive/mully.898.ro/fullchain1.pem' +maybe chmod 0600 'letsencrypt/archive/mully.898.ro/privkey1.pem' maybe chmod 0750 'letsencrypt/archive/rspamd.club3d.ro' maybe chmod 0640 'letsencrypt/archive/rspamd.club3d.ro/cert1.pem' maybe chmod 0640 'letsencrypt/archive/rspamd.club3d.ro/cert10.pem' @@ -2799,6 +2807,7 @@ maybe chmod 0640 'letsencrypt/csr/0541_csr-certbot.pem' maybe chmod 0640 'letsencrypt/csr/0542_csr-certbot.pem' maybe chmod 0640 'letsencrypt/csr/0543_csr-certbot.pem' maybe chmod 0640 'letsencrypt/csr/0544_csr-certbot.pem' +maybe chmod 0640 'letsencrypt/csr/0545_csr-certbot.pem' maybe chown 'setroubleshoot' 'letsencrypt/keys' maybe chgrp 'setroubleshoot' 'letsencrypt/keys' maybe chmod 0700 'letsencrypt/keys' @@ -3379,6 +3388,7 @@ maybe chmod 0600 'letsencrypt/keys/0541_key-certbot.pem' maybe chmod 0600 'letsencrypt/keys/0542_key-certbot.pem' maybe chmod 0600 'letsencrypt/keys/0543_key-certbot.pem' maybe chmod 0600 'letsencrypt/keys/0544_key-certbot.pem' +maybe chmod 0600 'letsencrypt/keys/0545_key-certbot.pem' maybe chown 'setroubleshoot' 'letsencrypt/live' maybe chgrp 'setroubleshoot' 'letsencrypt/live' maybe chmod 0700 'letsencrypt/live' @@ -3405,6 +3415,8 @@ maybe chmod 0750 'letsencrypt/live/mail.anywhere.ro' maybe chmod 0640 'letsencrypt/live/mail.anywhere.ro/README' maybe chmod 0750 'letsencrypt/live/mail.club3d.ro' maybe chmod 0640 'letsencrypt/live/mail.club3d.ro/README' +maybe chmod 0750 'letsencrypt/live/mully.898.ro' +maybe chmod 0640 'letsencrypt/live/mully.898.ro/README' maybe chmod 0750 'letsencrypt/live/rspamd.club3d.ro' maybe chmod 0640 'letsencrypt/live/rspamd.club3d.ro/README' maybe chmod 0750 'letsencrypt/live/secure.898.ro' @@ -3456,6 +3468,7 @@ maybe chmod 0640 'letsencrypt/renewal/git.898.ro.conf' maybe chmod 0644 'letsencrypt/renewal/mail.898.ro.conf' maybe chmod 0640 'letsencrypt/renewal/mail.anywhere.ro.conf' maybe chmod 0640 'letsencrypt/renewal/mail.club3d.ro.conf' +maybe chmod 0640 'letsencrypt/renewal/mully.898.ro.conf' maybe chmod 0640 'letsencrypt/renewal/rspamd.club3d.ro.conf' maybe chmod 0640 'letsencrypt/renewal/secure.898.ro.conf' maybe chmod 0640 'letsencrypt/renewal/trace.898.ro.conf' @@ -4491,9 +4504,6 @@ maybe chown 'nginx' 'nginx/allowed_clients.config' maybe chgrp 'nginx' 'nginx/allowed_clients.config' maybe chmod 0640 'nginx/allowed_clients.config' maybe chmod 0755 'nginx/conf.d' -maybe chown 'nginx' 'nginx/conf.d/_zira.go.ro.conf' -maybe chgrp 'nginx' 'nginx/conf.d/_zira.go.ro.conf' -maybe chmod 0640 'nginx/conf.d/_zira.go.ro.conf' maybe chown 'nginx' 'nginx/conf.d/anywhere.ro.conf' maybe chgrp 'nginx' 'nginx/conf.d/anywhere.ro.conf' maybe chmod 0640 'nginx/conf.d/anywhere.ro.conf' @@ -4954,6 +4964,9 @@ maybe chmod 0640 'nginx/conf.d/maintenance.898.ro.conf' maybe chown 'nginx' 'nginx/conf.d/mtr.898.ro.conf' maybe chgrp 'nginx' 'nginx/conf.d/mtr.898.ro.conf' maybe chmod 0640 'nginx/conf.d/mtr.898.ro.conf' +maybe chown 'nginx' 'nginx/conf.d/mully.go.ro.conf' +maybe chgrp 'nginx' 'nginx/conf.d/mully.go.ro.conf' +maybe chmod 0640 'nginx/conf.d/mully.go.ro.conf' maybe chown 'nginx' 'nginx/conf.d/padmin.club3d.ro.conf' maybe chgrp 'nginx' 'nginx/conf.d/padmin.club3d.ro.conf' maybe chmod 0640 'nginx/conf.d/padmin.club3d.ro.conf' @@ -4992,12 +5005,6 @@ maybe chmod 0640 'nginx/conf.d/webmail.vrem.ro.conf' maybe chown 'nginx' 'nginx/conf.d/wordpress.club3d.ro.conf' maybe chgrp 'nginx' 'nginx/conf.d/wordpress.club3d.ro.conf' maybe chmod 0640 'nginx/conf.d/wordpress.club3d.ro.conf' -maybe chown 'nginx' 'nginx/conf.d/zira.898.ro.conf' -maybe chgrp 'nginx' 'nginx/conf.d/zira.898.ro.conf' -maybe chmod 0640 'nginx/conf.d/zira.898.ro.conf' -maybe chown 'nginx' 'nginx/conf.d/zira.go.ro.conf' -maybe chgrp 'nginx' 'nginx/conf.d/zira.go.ro.conf' -maybe chmod 0640 'nginx/conf.d/zira.go.ro.conf' maybe chown 'nginx' 'nginx/default.d' maybe chgrp 'nginx' 'nginx/default.d' maybe chmod 0750 'nginx/default.d' @@ -5774,6 +5781,7 @@ maybe chmod 0644 'rspamd/modules.d/greylist.conf' maybe chmod 0644 'rspamd/modules.d/hfilter.conf' maybe chmod 0644 'rspamd/modules.d/history_redis.conf' maybe chmod 0644 'rspamd/modules.d/http_headers.conf' +maybe chmod 0644 'rspamd/modules.d/known_senders.conf' maybe chmod 0644 'rspamd/modules.d/maillist.conf' maybe chmod 0644 'rspamd/modules.d/metadata_exporter.conf' maybe chmod 0644 'rspamd/modules.d/metric_exporter.conf' diff --git a/crowdsec/hub/.index.json b/crowdsec/hub/.index.json index 7872aa0..e934bb5 100644 --- a/crowdsec/hub/.index.json +++ b/crowdsec/hub/.index.json @@ -554,7 +554,7 @@ }, "crowdsecurity/auditd": { "path": "collections/crowdsecurity/auditd.yaml", - "version": "0.5", + "version": "0.6", "versions": { "0.1": { "digest": "784496b8295720e314a9a5da7bbc6645605781a4cb46595ebb4c04b158468768", @@ -575,10 +575,14 @@ "0.5": { "digest": "f0e852bed7179bd9e82595036714e49ec124d199d3dac02b20fe44c9aa1fdc92", "deprecated": false + }, + "0.6": { + "digest": "22934d51878ef76b5cece7d8af7788803d9c735f9f4a1926e1beaac56259f5f6", + "deprecated": false } }, - "long_description": "Ondhcm5pbmc6IFRoaXMgdmVyc2lvbiByZXF1aXJlcyBjcm93ZHNlYyB2ZXJzaW9uID49IDEuNSA6d2FybmluZzoKCiMjIEF1ZGl0ZCBjb2xsZWN0aW9uCgpBIGNvbGxlY3Rpb24gZm9yIGF1ZGl0ZDoKIC0gYXVkaXRkIGxvZyBwYXJzZXIKIC0gcG9zdCBleHBsb2l0YXRpb24gYmVoYXZpb3IgZGV0ZWN0aW9uCgojIyMgQmFja2Rvb3IgaW5pdGlhbCBleGVjdXRpb24gZGV0ZWN0aW9uCgogLSBkZXRlY3QgYSBwcm9jZXNzIGNhbGxpbmcgYHdnZXRgL2BjdXJsYCBhbmQgZXhlY3V0aW5nIHRoZSBkb3dubG9hZCBzY3JpcHQvYmluYXJ5IHZlcnkgcXVpY2tseSBhZnRlcgogLSBkZXRlY3QgaW52b2NhdGlvbiBvZiBvYmZ1c2NhdGVkIHBheWxvYWRzIChpZS4gYGJhc2U2NCBkZWNvZGUgfCBpbnRlcnByZXRlcmApCiAtIGRldGVjdCBpbnZvY2F0aW9uIG9mIHNjcmlwdHMvYmluYXJpZXMgZnJvbSBoaWRkZW4gZGlyZWN0b3JpZXMKCiAtIGRldGVjdCBiYWNrZG9vcnMgdHJ5aW5nIHRvICJraWxsIGNvbXBldGl0b3JzIiA6CiAgIC0gcmVwZWF0ZWQvZmFzdCBpbnZva2F0aW9uIG9mIGBybWAgCiAgIC0gcmVwZWF0ZWQvZmFzdCBpbnZva2F0aW9uIG9mIGBraWxsYCAvIGBwa2lsbGAKCiMjIEFjcXVpc2l0aW9uIHRlbXBsYXRlCgpFeGFtcGxlIGFjcXVpc2l0aW9uIGZvciB0aGlzIGNvbGxlY3Rpb24gOgoKYGBgeWFtbApmaWxlbmFtZXM6CiAgLSAvdmFyL2xvZy9hdWRpdC8qLmxvZwpsYWJlbHM6CiAgdHlwZTogYXVkaXRkCmBgYAoKIyMgV2FybmluZwoKVGhlIHNjZW5hcmlvJ3MgZWZmZWN0aXZlbmVzcyByZWxpZXMgb24geW91ciBgYXVkaXRkYCBjb25maWd1cmF0aW9uIGxvZ2dpbmcgRVhFQ1ZFIDoKCmBgYGJhc2gKYXVkaXRjdGwgLWEgZXhpdCxhbHdheXMgLUYgYXJjaD1iNjQgLVMgZXhlY3ZlCmF1ZGl0Y3RsIC1hIGV4aXQsYWx3YXlzIC1GIGFyY2g9YjMyIC1TIGV4ZWN2ZQpgYGAKCkFzIGFuIGV4YW1wbGUsIHlvdSBjYW5yZXN0cmljdCBpdCB0byBhIHNwZWNpZmljIHVpZCAoaWUgYC1GIGV1aWQ9MzNgKSBpZiB5b3Ugd2FudCB0byBtb25pdG9yIG9ubHkgeW91ciB3ZWIgc2VydmVyLgoKQXMgYW4gZXhhbXBsZSwgc2VlIFtGbG9yaWFuIFJvdGgncyBleGFtcGxlIGF1ZGl0ZCBjb25maWddKGh0dHBzOi8vZ2l0aHViLmNvbS9OZW8yM3gwL2F1ZGl0ZC9ibG9iL21hc3Rlci9hdWRpdC5ydWxlcykuCgojIyBOb3RpZmljYXRpb24gdGVtcGxhdGUKClRvIGhhdmUgbmljZS1sb29raW5nIG5vdGlmaWNhdGlvbnMgb24gYXVkaXRkIGFsZXJ0cywgeW91IGNhbiB1c2UgdGhlIGZvbGxvd2luZyBmb3JtYXQgdGVtcGxhdGU6CgpgYGB5YW1sCmZvcm1hdDogfAogIHt7IHJhbmdlIC4gLX19CiAge3skYWxlcnQgOj0gLiB9fQogICp7eyRhbGVydC5TY2VuYXJpb319KgogIHt7IHJhbmdlIC5FdmVudHMgfX0KICBge3suR2V0TWV0YSAiZXhlIn19YCBpbnZva2VkIGJ5IHBhcmVudCBwcm9jZXNzIGB7ey5HZXRNZXRhICJwYXJlbnRfcHJvZ25hbWUifX1gICh1aWQ9e3suR2V0TWV0YSAidWlkIn19KQogIHt7IGVuZCAtfX0KICB7ey0gZW5kIH19CmBgYAoKWW91IHNob3VsZG4ndCB1c2UgYW4gZXhpc3Rpbmcgbm90aWZpY2F0aW9uIHRlbXBsYXRlLCBhcyBpdCB3aWxsIG5vdCBkaXNwbGF5IHRoZSBmdWxsIGluZm9ybWF0aW9uIGFzIGl0IGlzIHRhaWxvcmVkIHRvIElQIGJhc2UgYWxlcnRzLgoKT25jZSB5b3UgaGF2ZSBzZXR1cCB5b3VyIG5vdGlmaWNhdGlvbiB0ZW1wbGF0ZSwgeW91ICoqTVVTVCoqIGFkZCBhIHByb2ZpbGUgdG8gZWl0aGVyIGBwcm9maWxlcy55YW1sYCBvciBgcHJvZmlsZXMueWFtbC5sb2NhbGAKCmBgYHlhbWwKbmFtZTogcGlkX2FsZXJ0CmZpbHRlcnM6CiAtIEFsZXJ0LkdldFNjb3BlKCkgPT0gInBpZCIKZGVjaXNpb25zOiBbXQpub3RpZmljYXRpb25zOgogIC0gc2xhY2tfZGVmYXVsdAojIyBQbGVhc2UgZWRpdCB0aGUgYWJvdmUgbGluZSB0byBtYXRjaCB5b3VyIG5vdGlmaWNhdGlvbiBuYW1lCm9uX3N1Y2Nlc3M6IGJyZWFrCi0tLQpgYGA=", - "content": "cGFyc2VyczoKICAtIGNyb3dkc2VjdXJpdHkvYXVkaXRkLWxvZ3MKc2NlbmFyaW9zOgogIC0gY3Jvd2RzZWN1cml0eS9hdWRpdGQtcG9zdGV4cGxvaXQtcm0KICAtIGNyb3dkc2VjdXJpdHkvYXVkaXRkLXBvc3RleHBsb2l0LXBraWxsCiAgLSBjcm93ZHNlY3VyaXR5L2F1ZGl0ZC1wb3N0ZXhwbG9pdC1leGVjLWZyb20tbmV0CiAgLSBjcm93ZHNlY3VyaXR5L2F1ZGl0ZC1zdXMtZXhlYwogIC0gY3Jvd2RzZWN1cml0eS9hdWRpdGQtYmFzZTY0LWV4ZWMtYmVoYXZpb3IKcG9zdG92ZXJmbG93czoKICAtIGNyb3dkc2VjdXJpdHkvYXVkaXRkLXdoaXRlbGlzdGVkLXByb2Nlc3MKZGVzY3JpcHRpb246ICJhdWRpdGQgc3VwcG9ydCA6IHBhcnNlcnMgYW5kIHNjZW5hcmlvcyIKYXV0aG9yOiBjcm93ZHNlY3VyaXR5CnRhZ3M6CiAgLSBhdWRpdGQKICAtIGNvbXBsaWFuY2UKICAtIHBvc3RleHBsb2l0YXRpb24KCgo=", + "long_description": "Ondhcm5pbmc6IFRoaXMgdmVyc2lvbiByZXF1aXJlcyBjcm93ZHNlYyB2ZXJzaW9uID49IDEuNSA6d2FybmluZzoKCiMjIEF1ZGl0ZCBjb2xsZWN0aW9uCgpBIGNvbGxlY3Rpb24gZm9yIGF1ZGl0ZDoKIC0gYXVkaXRkIGxvZyBwYXJzZXIKIC0gcG9zdCBleHBsb2l0YXRpb24gYmVoYXZpb3IgZGV0ZWN0aW9uCgojIyMgQmFja2Rvb3IgaW5pdGlhbCBleGVjdXRpb24gZGV0ZWN0aW9uCgogLSBkZXRlY3QgYSBwcm9jZXNzIGNhbGxpbmcgYHdnZXRgL2BjdXJsYCBhbmQgZXhlY3V0aW5nIHRoZSBkb3dubG9hZCBzY3JpcHQvYmluYXJ5IHZlcnkgcXVpY2tseSBhZnRlcgogLSBkZXRlY3QgaW52b2NhdGlvbiBvZiBvYmZ1c2NhdGVkIHBheWxvYWRzIChpZS4gYGJhc2U2NCBkZWNvZGUgfCBpbnRlcnByZXRlcmApCiAtIGRldGVjdCBpbnZvY2F0aW9uIG9mIHNjcmlwdHMvYmluYXJpZXMgZnJvbSBoaWRkZW4gZGlyZWN0b3JpZXMKCiAtIGRldGVjdCBiYWNrZG9vcnMgdHJ5aW5nIHRvICJraWxsIGNvbXBldGl0b3JzIiA6CiAgIC0gcmVwZWF0ZWQvZmFzdCBpbnZva2F0aW9uIG9mIGBybWAgCiAgIC0gcmVwZWF0ZWQvZmFzdCBpbnZva2F0aW9uIG9mIGBraWxsYCAvIGBwa2lsbGAKCiMjIyBMb2NhbCBleHBsb2l0YXRpb24KCiAtIGRldGVjdCBhIHJvb3Qgc3VpZCBiaW5hcnkgdGhhdCBjcmFzaGVzIHNvb24gYWZ0ZXIgc3RhcnR1cCB3aXRoIGEgU0lHU0VHViwgU0lHQUJSVCwgU0lHQlVTIG9yIFNJR1RSQVAuCgojIyBBY3F1aXNpdGlvbiB0ZW1wbGF0ZQoKRXhhbXBsZSBhY3F1aXNpdGlvbiBmb3IgdGhpcyBjb2xsZWN0aW9uIDoKCmBgYHlhbWwKZmlsZW5hbWVzOgogIC0gL3Zhci9sb2cvYXVkaXQvKi5sb2cKbGFiZWxzOgogIHR5cGU6IGF1ZGl0ZApgYGAKCiMjIFdhcm5pbmcKClRoZSBzY2VuYXJpbydzIGVmZmVjdGl2ZW5lc3MgcmVsaWVzIG9uIHlvdXIgYGF1ZGl0ZGAgY29uZmlndXJhdGlvbiBsb2dnaW5nIEVYRUNWRSA6CgpgYGBiYXNoCmF1ZGl0Y3RsIC1hIGV4aXQsYWx3YXlzIC1GIGFyY2g9YjY0IC1TIGV4ZWN2ZQphdWRpdGN0bCAtYSBleGl0LGFsd2F5cyAtRiBhcmNoPWIzMiAtUyBleGVjdmUKYGBgCgpBcyBhbiBleGFtcGxlLCB5b3UgY2FucmVzdHJpY3QgaXQgdG8gYSBzcGVjaWZpYyB1aWQgKGllIGAtRiBldWlkPTMzYCkgaWYgeW91IHdhbnQgdG8gbW9uaXRvciBvbmx5IHlvdXIgd2ViIHNlcnZlci4KCkFzIGFuIGV4YW1wbGUsIHNlZSBbRmxvcmlhbiBSb3RoJ3MgZXhhbXBsZSBhdWRpdGQgY29uZmlnXShodHRwczovL2dpdGh1Yi5jb20vTmVvMjN4MC9hdWRpdGQvYmxvYi9tYXN0ZXIvYXVkaXQucnVsZXMpLgoKIyMgTm90aWZpY2F0aW9uIHRlbXBsYXRlCgpUbyBoYXZlIG5pY2UtbG9va2luZyBub3RpZmljYXRpb25zIG9uIGF1ZGl0ZCBhbGVydHMsIHlvdSBjYW4gdXNlIHRoZSBmb2xsb3dpbmcgZm9ybWF0IHRlbXBsYXRlOgoKYGBgeWFtbApmb3JtYXQ6IHwKICB7eyByYW5nZSAuIC19fQogIHt7JGFsZXJ0IDo9IC4gfX0KICAqe3skYWxlcnQuU2NlbmFyaW99fSoKICB7eyByYW5nZSAuRXZlbnRzIH19CiAgYHt7LkdldE1ldGEgImV4ZSJ9fWAgaW52b2tlZCBieSBwYXJlbnQgcHJvY2VzcyBge3suR2V0TWV0YSAicGFyZW50X3Byb2duYW1lIn19YCAodWlkPXt7LkdldE1ldGEgInVpZCJ9fSkKICB7eyBlbmQgLX19CiAge3stIGVuZCB9fQpgYGAKCllvdSBzaG91bGRuJ3QgdXNlIGFuIGV4aXN0aW5nIG5vdGlmaWNhdGlvbiB0ZW1wbGF0ZSwgYXMgaXQgd2lsbCBub3QgZGlzcGxheSB0aGUgZnVsbCBpbmZvcm1hdGlvbiBhcyBpdCBpcyB0YWlsb3JlZCB0byBJUCBiYXNlIGFsZXJ0cy4KCk9uY2UgeW91IGhhdmUgc2V0dXAgeW91ciBub3RpZmljYXRpb24gdGVtcGxhdGUsIHlvdSAqKk1VU1QqKiBhZGQgYSBwcm9maWxlIHRvIGVpdGhlciBgcHJvZmlsZXMueWFtbGAgb3IgYHByb2ZpbGVzLnlhbWwubG9jYWxgCgpgYGB5YW1sCm5hbWU6IHBpZF9hbGVydApmaWx0ZXJzOgogLSBBbGVydC5HZXRTY29wZSgpID09ICJwaWQiCmRlY2lzaW9uczogW10Kbm90aWZpY2F0aW9uczoKICAtIHNsYWNrX2RlZmF1bHQKIyMgUGxlYXNlIGVkaXQgdGhlIGFib3ZlIGxpbmUgdG8gbWF0Y2ggeW91ciBub3RpZmljYXRpb24gbmFtZQpvbl9zdWNjZXNzOiBicmVhawotLS0KYGBg", + "content": "cGFyc2VyczoKICAtIGNyb3dkc2VjdXJpdHkvYXVkaXRkLWxvZ3MKc2NlbmFyaW9zOgogIC0gY3Jvd2RzZWN1cml0eS9hdWRpdGQtcG9zdGV4cGxvaXQtcm0KICAtIGNyb3dkc2VjdXJpdHkvYXVkaXRkLXBvc3RleHBsb2l0LXBraWxsCiAgLSBjcm93ZHNlY3VyaXR5L2F1ZGl0ZC1wb3N0ZXhwbG9pdC1leGVjLWZyb20tbmV0CiAgLSBjcm93ZHNlY3VyaXR5L2F1ZGl0ZC1zdXMtZXhlYwogIC0gY3Jvd2RzZWN1cml0eS9hdWRpdGQtYmFzZTY0LWV4ZWMtYmVoYXZpb3IKICAtIGNyb3dkc2VjdXJpdHkvYXVkaXRkLXN1aWQtY3Jhc2gKcG9zdG92ZXJmbG93czoKICAtIGNyb3dkc2VjdXJpdHkvYXVkaXRkLXdoaXRlbGlzdGVkLXByb2Nlc3MKZGVzY3JpcHRpb246ICJhdWRpdGQgc3VwcG9ydCA6IHBhcnNlcnMgYW5kIHNjZW5hcmlvcyIKYXV0aG9yOiBjcm93ZHNlY3VyaXR5CnRhZ3M6CiAgLSBhdWRpdGQKICAtIGNvbXBsaWFuY2UKICAtIHBvc3RleHBsb2l0YXRpb24KCgo=", "description": "auditd support : parsers and scenarios", "author": "crowdsecurity", "labels": null, @@ -593,7 +597,8 @@ "crowdsecurity/auditd-postexploit-pkill", "crowdsecurity/auditd-postexploit-exec-from-net", "crowdsecurity/auditd-sus-exec", - "crowdsecurity/auditd-base64-exec-behavior" + "crowdsecurity/auditd-base64-exec-behavior", + "crowdsecurity/auditd-suid-crash" ] }, "crowdsecurity/aws-cis-benchmark": { @@ -1004,7 +1009,7 @@ }, "crowdsecurity/http-cve": { "path": "collections/crowdsecurity/http-cve.yaml", - "version": "2.1", + "version": "2.3", "versions": { "0.1": { "digest": "30748e051a470c1bc91506ae63e8784cd054564f90ccc23eb655823fc30e3019", @@ -1089,10 +1094,19 @@ "2.1": { "digest": "bf083cddb42468da403bdcba02efc6e287ef640512a0442f7b180dc091e1fb44", "deprecated": false + }, + "2.2": { + "digest": "a80217f6b47bfb101bad21a25666123b1f940d1dcd31e1e1e320b6213fa9f4b0", + "deprecated": false + }, + "2.3": { + "digest": "00e148cb998efbf5668391f2971ec39ee3c2bcc8e0e6c952fe436709678abf72", + "deprecated": false } }, - "long_description": "QSBjb2xsZWN0aW9uIG9mIGh0dHAgc3BlY2lmaWMgQ1ZFcyA6CgogLSBbQXBhY2hlIENWRS0yMDIxLTQxNzczXShodHRwczovL2N2ZS5jaXJjbC5sdS9jdmUvQ1ZFLTIwMjEtNDE3NzMpCiAtIFtBcGFjaGUgQ1ZFLTIwMjEtNDIwMTNdKGh0dHBzOi8vY3ZlLmNpcmNsLmx1L2N2ZS9DVkUtMjAyMS00MjAxMykKIC0gW0dyYWZhbmEgQ1ZFLTIwMjEtNDM3OThdKGh0dHBzOi8vY3ZlLmNpcmNsLmx1L2N2ZS9DVkUtMjAyMS00Mzc5OCkKIC0gW0ZvcnRpbmV0IENWRS0yMDE4LTEzMzc5XShodHRwczovL2N2ZS5jaXJjbC5sdS9jdmUvQ1ZFLTIwMTgtMTMzNzkpCiAtIFtQdWxzZSBTZWN1cmUgQ1ZFLTIwMTktMTE1MTBdKGh0dHBzOi8vY3ZlLmNpcmNsLmx1L2N2ZS9DVkUtMjAxOS0xMTUxMCkKIC0gW0Y1IEJJRy1JUCBDVkUtMjAyMC01OTAyXShodHRwczovL2N2ZS5jaXJjbC5sdS9jdmUvQ1ZFLTIwMjAtNTkwMikKIC0gW1RoaW5rUEhQIENWRS0yMDE4LTIwMDYyXShodHRwczovL2N2ZS5jaXJjbC5sdS9jdmUvQ1ZFLTIwMTgtMjAwNjIpCiAtIFtBcGFjaGUgTG9nNGoyIENWRS0yMDIxLTQ0MjI4XShodHRwczovL2N2ZS5jaXJjbC5sdS9jdmUvQ1ZFLTIwMjEtNDQyMjgpCiAtIFtWTXdhcmUgVk1TQS0yMDIxLTAwMjddKGh0dHBzOi8vd3d3LnZtd2FyZS5jb20vc2VjdXJpdHkvYWR2aXNvcmllcy9WTVNBLTIwMjEtMDAyNy5odG1sKQogLSBbQXRsYXNzaWFuIEppcmEgQ1ZFLTIwMjEtMjYwODZdKGh0dHBzOi8vY3ZlLmNpcmNsLmx1L2N2ZS9DVkUtMjAyMS0yNjA4NikKIC0gW1NwcmluZzRTaGVsbCBDVkUtMjAyMi0yMjk2NV0oaHR0cHM6Ly9jdmUubWl0cmUub3JnL2NnaS1iaW4vY3ZlbmFtZS5jZ2k/bmFtZT1DVkUtMjAyMi0yMjk2NSkKIC0gW1ZNd2FyZSBDVkUtMjAyMi0yMjk1NF0oaHR0cHM6Ly93d3cudm13YXJlLmNvbS9zZWN1cml0eS9hZHZpc29yaWVzL1ZNU0EtMjAyMi0wMDExLmh0bWwpCiAtIFtHTFBJIENWRS0yMDIyLTM1OTE0XShodHRwczovL252ZC5uaXN0Lmdvdi92dWxuL2RldGFpbC9DVkUtMjAyMi0zNTkxNCkKIC0gW0ZvcnRpbmV0IENWRS0yMDIyLTQwNjg0XShodHRwczovL3d3dy5ob3Jpem9uMy5haS9mb3J0aW9zLWZvcnRpcHJveHktYW5kLWZvcnRpc3dpdGNobWFuYWdlci1hdXRoZW50aWNhdGlvbi1ieXBhc3MtdGVjaG5pY2FsLWRlZXAtZGl2ZS1jdmUtMjAyMi00MDY4NC8pCiAtIFtDb25mbHVlbmNlIENWRS0yMDIyLTI2MTM0XShodHRwczovL2N2ZS5taXRyZS5vcmcvY2dpLWJpbi9jdmVuYW1lLmNnaT9uYW1lPUNWRS0yMDIyLTI2MTM0KQogLSBbVGV4dDRTaGVsbCBDVkUtMjAyMi00Mjg4OV0oaHR0cHM6Ly9jdmUubWl0cmUub3JnL2NnaS1iaW4vY3ZlbmFtZS5jZ2k/bmFtZT1DVkUtMjAyMi00Mjg4OSkKIC0gW0dob3N0IENNUyBDVkUtMjAyMi00MTY5N10oaHR0cHM6Ly9udmQubmlzdC5nb3YvdnVsbi9kZXRhaWwvQ1ZFLTIwMjItNDE2OTcpCiAtIFtDYWN0aSBDVkUtMjAyMi00NjE2OV0oaHR0cHM6Ly9udmQubmlzdC5nb3YvdnVsbi9kZXRhaWwvQ1ZFLTIwMjItNDYxNjkpCiAtIFtDZW50b3MgV2ViIFBhbmVsIDcgQ1ZFLTIwMjItNDQ4NzddKGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDIyLTQ0ODc3KQogLSBbVGVsZXJpayBVSSBDVkUtMjAxOS0xODkzNV0oaHR0cHM6Ly9jdmUubWl0cmUub3JnL2NnaS1iaW4vY3ZlbmFtZS5jZ2k/bmFtZT1DVkUtMjAxOS0xODkzNSkKIC0gW05ldGdlYXIgREdOMTAwMCAvIERHTjIyMDAgUmVtb3RlIENvbW1hbmQgRXhlY3V0aW9uXShodHRwczovL3d3dy5leHBsb2l0LWRiLmNvbS9leHBsb2l0cy8yNTk3OCkKCgo6d2FybmluZzogVGhpcyBjb2xsZWN0aW9uIGlzIF9ub3RfIGEgV0FGIGFuZCB0aGlzIGNvbGxlY3Rpb24gZG9lcyBfbm90XyBhaW1zIGF0IHJlcGxhY2luZyBhIFdBRi4KCkFzIHN1Y2gsIGFuIGF0dGFja2VyIG1pZ2h0IGJlIGFibGUgdG8gYnlwYXNzIHRob3NlIHNpZ25hdHVyZXMuCgo=", - "content": "c2NlbmFyaW9zOgogIC0gY3Jvd2RzZWN1cml0eS9odHRwLWN2ZS0yMDIxLTQxNzczCiAgLSBjcm93ZHNlY3VyaXR5L2h0dHAtY3ZlLTIwMjEtNDIwMTMKICAtIGNyb3dkc2VjdXJpdHkvZ3JhZmFuYS1jdmUtMjAyMS00Mzc5OAogIC0gY3Jvd2RzZWN1cml0eS92bXdhcmUtdmNlbnRlci12bXNhLTIwMjEtMDAyNwogIC0gY3Jvd2RzZWN1cml0eS9mb3J0aW5ldC1jdmUtMjAxOC0xMzM3OQogIC0gY3Jvd2RzZWN1cml0eS9wdWxzZS1zZWN1cmUtc3NsdnBuLWN2ZS0yMDE5LTExNTEwCiAgLSBjcm93ZHNlY3VyaXR5L2Y1LWJpZy1pcC1jdmUtMjAyMC01OTAyCiAgLSBjcm93ZHNlY3VyaXR5L3RoaW5rcGhwLWN2ZS0yMDE4LTIwMDYyCiAgLSBjcm93ZHNlY3VyaXR5L2FwYWNoZV9sb2c0ajJfY3ZlLTIwMjEtNDQyMjgKICAtIGNyb3dkc2VjdXJpdHkvamlyYV9jdmUtMjAyMS0yNjA4NgogIC0gY3Jvd2RzZWN1cml0eS9zcHJpbmc0c2hlbGxfY3ZlLTIwMjItMjI5NjUKICAtIGNyb3dkc2VjdXJpdHkvdm13YXJlLWN2ZS0yMDIyLTIyOTU0CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTM3MDQyCiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTQxMDgyCiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTM1OTE0CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTQwNjg0CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTI2MTM0CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTQyODg5CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTQxNjk3CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTQ2MTY5CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTQ0ODc3CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDE5LTE4OTM1CiAgLSBjcm93ZHNlY3VyaXR5L25ldGdlYXJfcmNlCmF1dGhvcjogY3Jvd2RzZWN1cml0eQp0YWdzOgogIC0gd2ViCiAgLSBleHBsb2l0CiAgLSBjdmUKICAtIGh0dHAK", + "long_description": "CgpBIGNvbGxlY3Rpb24gdG8gZGV0ZWN0IGV4cGxvaXRhdGlvbiBvZiBzb21lIHNwZWNpZmljIGh0dHAgQ1ZFcy4KCldvcmtzIHdpdGggW2FwYWNoZTJdKGh0dHBzOi8vaHViLmNyb3dkc2VjLm5ldC9hdXRob3IvY3Jvd2RzZWN1cml0eS9jb2xsZWN0aW9ucy9hcGFjaGUyKSwgW25naW54XShodHRwczovL2h1Yi5jcm93ZHNlYy5uZXQvYXV0aG9yL2Nyb3dkc2VjdXJpdHkvY29sbGVjdGlvbnMvbmdpbngpLCBbdHJhZWZpa10oaHR0cHM6Ly9odWIuY3Jvd2RzZWMubmV0L2F1dGhvci9jcm93ZHNlY3VyaXR5L2NvbGxlY3Rpb25zL3RyYWVmaWspIGV0Yy4KCjp3YXJuaW5nOiBXaGlsZSB0aGlzIGNvbGxlY3Rpb24gaXMgZnJlcXVlbnRseSB1cGRhdGVkIHdpdGggdHJlbmRpbmcgQ1ZFcywgaXQgaXMgX25vdF8gYSBXQUYgYW5kIGRvZXMgX25vdF8gYWltcyBhdCByZXBsYWNpbmcgYSBXQUYuIEFzIHN1Y2gsIGFuIGF0dGFja2VyIG1pZ2h0IGJlIGFibGUgdG8gYnlwYXNzIHRob3NlIHNpZ25hdHVyZXMuCgogLSBbQXBhY2hlIENWRS0yMDIxLTQxNzczXShodHRwczovL2N2ZS5jaXJjbC5sdS9jdmUvQ1ZFLTIwMjEtNDE3NzMpCiAtIFtBcGFjaGUgQ1ZFLTIwMjEtNDIwMTNdKGh0dHBzOi8vY3ZlLmNpcmNsLmx1L2N2ZS9DVkUtMjAyMS00MjAxMykKIC0gW0dyYWZhbmEgQ1ZFLTIwMjEtNDM3OThdKGh0dHBzOi8vY3ZlLmNpcmNsLmx1L2N2ZS9DVkUtMjAyMS00Mzc5OCkKIC0gW0ZvcnRpbmV0IENWRS0yMDE4LTEzMzc5XShodHRwczovL2N2ZS5jaXJjbC5sdS9jdmUvQ1ZFLTIwMTgtMTMzNzkpCiAtIFtQdWxzZSBTZWN1cmUgQ1ZFLTIwMTktMTE1MTBdKGh0dHBzOi8vY3ZlLmNpcmNsLmx1L2N2ZS9DVkUtMjAxOS0xMTUxMCkKIC0gW0Y1IEJJRy1JUCBDVkUtMjAyMC01OTAyXShodHRwczovL2N2ZS5jaXJjbC5sdS9jdmUvQ1ZFLTIwMjAtNTkwMikKIC0gW1RoaW5rUEhQIENWRS0yMDE4LTIwMDYyXShodHRwczovL2N2ZS5jaXJjbC5sdS9jdmUvQ1ZFLTIwMTgtMjAwNjIpCiAtIFtBcGFjaGUgTG9nNGoyIENWRS0yMDIxLTQ0MjI4XShodHRwczovL2N2ZS5jaXJjbC5sdS9jdmUvQ1ZFLTIwMjEtNDQyMjgpCiAtIFtWTXdhcmUgVk1TQS0yMDIxLTAwMjddKGh0dHBzOi8vd3d3LnZtd2FyZS5jb20vc2VjdXJpdHkvYWR2aXNvcmllcy9WTVNBLTIwMjEtMDAyNy5odG1sKQogLSBbQXRsYXNzaWFuIEppcmEgQ1ZFLTIwMjEtMjYwODZdKGh0dHBzOi8vY3ZlLmNpcmNsLmx1L2N2ZS9DVkUtMjAyMS0yNjA4NikKIC0gW1NwcmluZzRTaGVsbCBDVkUtMjAyMi0yMjk2NV0oaHR0cHM6Ly9jdmUubWl0cmUub3JnL2NnaS1iaW4vY3ZlbmFtZS5jZ2k/bmFtZT1DVkUtMjAyMi0yMjk2NSkKIC0gW1ZNd2FyZSBDVkUtMjAyMi0yMjk1NF0oaHR0cHM6Ly93d3cudm13YXJlLmNvbS9zZWN1cml0eS9hZHZpc29yaWVzL1ZNU0EtMjAyMi0wMDExLmh0bWwpCiAtIFtaaW1icmEgQ1ZFLTIwMjItMzcwNDJdKGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDIyLTM3MDQyKQogLSBbTWljcm9zb2Z0IEV4Y2hhbmdlIENWRS0yMDIyLTQxMDgyXShodHRwczovL252ZC5uaXN0Lmdvdi92dWxuL2RldGFpbC9DVkUtMjAyMi00MTA4MikKIC0gW0dMUEkgQ1ZFLTIwMjItMzU5MTRdKGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDIyLTM1OTE0KQogLSBbRm9ydGluZXQgQ1ZFLTIwMjItNDA2ODRdKGh0dHBzOi8vd3d3Lmhvcml6b24zLmFpL2ZvcnRpb3MtZm9ydGlwcm94eS1hbmQtZm9ydGlzd2l0Y2htYW5hZ2VyLWF1dGhlbnRpY2F0aW9uLWJ5cGFzcy10ZWNobmljYWwtZGVlcC1kaXZlLWN2ZS0yMDIyLTQwNjg0LykKIC0gW0NvbmZsdWVuY2UgQ1ZFLTIwMjItMjYxMzRdKGh0dHBzOi8vY3ZlLm1pdHJlLm9yZy9jZ2ktYmluL2N2ZW5hbWUuY2dpP25hbWU9Q1ZFLTIwMjItMjYxMzQpCiAtIFtUZXh0NFNoZWxsIENWRS0yMDIyLTQyODg5XShodHRwczovL2N2ZS5taXRyZS5vcmcvY2dpLWJpbi9jdmVuYW1lLmNnaT9uYW1lPUNWRS0yMDIyLTQyODg5KQogLSBbR2hvc3QgQ01TIENWRS0yMDIyLTQxNjk3XShodHRwczovL252ZC5uaXN0Lmdvdi92dWxuL2RldGFpbC9DVkUtMjAyMi00MTY5NykKIC0gW0NhY3RpIENWRS0yMDIyLTQ2MTY5XShodHRwczovL252ZC5uaXN0Lmdvdi92dWxuL2RldGFpbC9DVkUtMjAyMi00NjE2OSkKIC0gW0NlbnRvcyBXZWIgUGFuZWwgNyBDVkUtMjAyMi00NDg3N10oaHR0cHM6Ly9udmQubmlzdC5nb3YvdnVsbi9kZXRhaWwvQ1ZFLTIwMjItNDQ4NzcpCiAtIFtUZWxlcmlrIFVJIENWRS0yMDE5LTE4OTM1XShodHRwczovL2N2ZS5taXRyZS5vcmcvY2dpLWJpbi9jdmVuYW1lLmNnaT9uYW1lPUNWRS0yMDE5LTE4OTM1KQogLSBbTmV0Z2VhciBER04xMDAwIC8gREdOMjIwMCBSZW1vdGUgQ29tbWFuZCBFeGVjdXRpb25dKGh0dHBzOi8vd3d3LmV4cGxvaXQtZGIuY29tL2V4cGxvaXRzLzI1OTc4KQogLSBbQ29uZmx1ZW5jZSBDVkUtMjAyMy0yMjUxNV0oaHR0cHM6Ly9jb25mbHVlbmNlLmF0bGFzc2lhbi5jb20vc2VjdXJpdHkvY3ZlLTIwMjMtMjI1MTUtcHJpdmlsZWdlLWVzY2FsYXRpb24tdnVsbmVyYWJpbGl0eS1pbi1jb25mbHVlbmNlLWRhdGEtY2VudGVyLWFuZC1zZXJ2ZXItMTI5NTY4MjI3Ni5odG1sKQoKCgoKCg==", + "content": "c2NlbmFyaW9zOgogIC0gY3Jvd2RzZWN1cml0eS9odHRwLWN2ZS0yMDIxLTQxNzczCiAgLSBjcm93ZHNlY3VyaXR5L2h0dHAtY3ZlLTIwMjEtNDIwMTMKICAtIGNyb3dkc2VjdXJpdHkvZ3JhZmFuYS1jdmUtMjAyMS00Mzc5OAogIC0gY3Jvd2RzZWN1cml0eS92bXdhcmUtdmNlbnRlci12bXNhLTIwMjEtMDAyNwogIC0gY3Jvd2RzZWN1cml0eS9mb3J0aW5ldC1jdmUtMjAxOC0xMzM3OQogIC0gY3Jvd2RzZWN1cml0eS9wdWxzZS1zZWN1cmUtc3NsdnBuLWN2ZS0yMDE5LTExNTEwCiAgLSBjcm93ZHNlY3VyaXR5L2Y1LWJpZy1pcC1jdmUtMjAyMC01OTAyCiAgLSBjcm93ZHNlY3VyaXR5L3RoaW5rcGhwLWN2ZS0yMDE4LTIwMDYyCiAgLSBjcm93ZHNlY3VyaXR5L2FwYWNoZV9sb2c0ajJfY3ZlLTIwMjEtNDQyMjgKICAtIGNyb3dkc2VjdXJpdHkvamlyYV9jdmUtMjAyMS0yNjA4NgogIC0gY3Jvd2RzZWN1cml0eS9zcHJpbmc0c2hlbGxfY3ZlLTIwMjItMjI5NjUKICAtIGNyb3dkc2VjdXJpdHkvdm13YXJlLWN2ZS0yMDIyLTIyOTU0CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTM3MDQyCiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTQxMDgyCiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTM1OTE0CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTQwNjg0CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTI2MTM0CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTQyODg5CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTQxNjk3CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTQ2MTY5CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTQ0ODc3CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDE5LTE4OTM1CiAgLSBjcm93ZHNlY3VyaXR5L25ldGdlYXJfcmNlCiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIzLTIyNTE1CmF1dGhvcjogY3Jvd2RzZWN1cml0eQpkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUgZXhwbG9pdGF0aW9uIGluIGh0dHAgbG9ncyIKdGFnczoKICAtIHdlYgogIC0gZXhwbG9pdAogIC0gY3ZlCiAgLSBodHRwCg==", + "description": "Detect CVE exploitation in http logs", "author": "crowdsecurity", "labels": null, "scenarios": [ @@ -1118,7 +1132,32 @@ "crowdsecurity/CVE-2022-46169", "crowdsecurity/CVE-2022-44877", "crowdsecurity/CVE-2019-18935", - "crowdsecurity/netgear_rce" + "crowdsecurity/netgear_rce", + "crowdsecurity/CVE-2023-22515" + ] + }, + "crowdsecurity/http-dos": { + "path": "collections/crowdsecurity/http-dos.yaml", + "version": "0.2", + "versions": { + "0.1": { + "digest": "9b9657dd6f304e3660f4dd8e9e289ef3d7302cdad759c5efc72333c1e3e96020", + "deprecated": false + }, + "0.2": { + "digest": "3ffa21f9474ea37d7c7d70156d05d557c16a62b8ae08dce202ce5d288609fef7", + "deprecated": false + } + }, + "long_description": "IyMgRGV0ZWN0aW5nIEhUVFAgRE9TCgpUaGlzIGNvbGxlY3Rpb24gb2Ygc2NlbmFyaW9zIGRldGVjdHMgc3BlY2lmaWMgSFRUUCBEb1MgdG9vbHMgdGhhdCBhcmUgbm90IGRldGVjdGVkIGJ5IGRlZmF1bHQgSFRUUCBzY2VuYXJpb3MuCgpUbyB3b3JrIGNvcnJlY3RseSwgaXQgcmVxdWlyZXMgdGhlIGFzc29jaWF0ZWQgSFRUUCBjb2xsZWN0aW9uIG9mIHlvdXIgd2Vic2VydmVyIHRvIGJlIHByZXNlbnQsIHN1Y2ggYXMgW25naW54XShodHRwczovL2h1Yi5jcm93ZHNlYy5uZXQvYXV0aG9yL2Nyb3dkc2VjdXJpdHkvY29sbGVjdGlvbnMvbmdpbngpIG9yIFthcGFjaGUyXShodHRwczovL2h1Yi5jcm93ZHNlYy5uZXQvYXV0aG9yL2Nyb3dkc2VjdXJpdHkvY29sbGVjdGlvbnMvYXBhY2hlMikuCgpHaXZlbiB0aGUgdmVyeSBuYXR1cmUgb2YgdGhlIHNjZW5hcmlvcywgcHJvcGVyIHRlc3RpbmcgaXMgYWR2aXNlZCB0byBhdm9pZCBmYWxzZS1wb3NpdGl2ZXM6CgogLSBCeSBbcmVwbGF5aW5nICJjb2xkIiBsb2dzXShodHRwczovL2RvYy5jcm93ZHNlYy5uZXQvZG9jcy9uZXh0L3VzZXJfZ3VpZGVzL3JlcGxheV9tb2RlKSB0byBlbnN1cmUgbm8gZmFsc2UtcG9zaXRpdmVzIGFyZSBwcmVzZW50CiAtIEJ5IHNldHRpbmcgdGhlIHNjZW5hcmlvcyBpbiBbInNpbXVsYXRpb24gbW9kZSJdKGh0dHBzOi8vZG9jLmNyb3dkc2VjLm5ldC9kb2NzL25leHQvY3NjbGkvY3NjbGlfc2ltdWxhdGlvbi8pIGZvciBvYnNlcnZhYmlsaXR5Cgo=", + "content": "c2NlbmFyaW9zOgogIC0gY3Jvd2RzZWN1cml0eS9odHRwLWRvcy1ieXBhc3MtY2FjaGUKICAtIGNyb3dkc2VjdXJpdHkvaHR0cC1kb3MtcmFuZG9tLXVyaQogIC0gY3Jvd2RzZWN1cml0eS9odHRwLWRvcy1zd2l0Y2hpbmctdWEKICAtIGNyb3dkc2VjdXJpdHkvaHR0cC1kb3MtaW52YWxpZC1odHRwLXZlcnNpb25zCmF1dGhvcjogY3Jvd2RzZWN1cml0eQp0YWdzOgogIC0gd2ViCiAgLSBkb3MKICAtIGh0dHAK", + "author": "crowdsecurity", + "labels": null, + "scenarios": [ + "crowdsecurity/http-dos-bypass-cache", + "crowdsecurity/http-dos-random-uri", + "crowdsecurity/http-dos-switching-ua", + "crowdsecurity/http-dos-invalid-http-versions" ] }, "crowdsecurity/iis": { @@ -1151,7 +1190,7 @@ "deprecated": false } }, - "long_description": "IyMgSXB0YWJsZXMvTmZ0YWJsZXMgY29sbGVjdGlvbgoKQSBjb2xsZWN0aW9uIGZvciBwb3J0c2NhbiBkZXRlY3Rpb24gdmlhIGlwdGFibGVzL25mdGFibGVzIDoKIC0gaXB0YWJsZXMvbmZ0YWJsZXMgcGFyc2VyIChsaWtlIGluIGAtaiBMT0dgKQogLSBtdWx0aSBwb3J0IHNjYW4gZGV0ZWN0aW9uCgojIyBBY3F1aXNpdGlvbiB0ZW1wbGF0ZQoKRXhhbXBsZSBhY3F1aXNpdGlvbiBmb3IgdGhpcyBjb2xsZWN0aW9uIDoKCmBgYHlhbWwKZmlsZW5hbWVzOgogIC0gL3Zhci9sb2cva2Vybi5sb2cKbGFiZWxzOgogIHR5cGU6IHN5c2xvZwpgYGAKCm5vdGVzIDoKIC0gIERlcGVuZGluZyBvbiB5b3VyIGRpc3RyaWJ1dGlvbi9PUywgcGF0aHMgdG8gbG9nIGZpbGVzIG1pZ2h0IGNoYW5nZQogLSAgT25seSByZWxldmFudCBpZiB5b3UgYXJlIG1hbnVhbGx5IGluc3RhbGxpbmcgY29sbGVjdGlvbgo=", + "long_description": "IyMgSXB0YWJsZXMvTmZ0YWJsZXMgY29sbGVjdGlvbgoKQSBjb2xsZWN0aW9uIGZvciBwb3J0c2NhbiBkZXRlY3Rpb24gdmlhIGlwdGFibGVzL25mdGFibGVzIDoKIC0gaXB0YWJsZXMvbmZ0YWJsZXMgcGFyc2VyIChsaWtlIGluIGAtaiBMT0dgKQogLSBtdWx0aSBwb3J0IHNjYW4gZGV0ZWN0aW9uCgojIyBBY3F1aXNpdGlvbiB0ZW1wbGF0ZQoKRXhhbXBsZSBhY3F1aXNpdGlvbiBmb3IgdGhpcyBjb2xsZWN0aW9uIDoKCmBgYHlhbWwKZmlsZW5hbWVzOgogIC0gL3Zhci9sb2cva2Vybi5sb2cKbGFiZWxzOgogIHR5cGU6IHN5c2xvZwpgYGAKCkRlYmlhbiAxMiBleGFtcGxlICh3aXRob3V0IHJzeXNsb2cpCgpgYGB5YW1sCnNvdXJjZTogam91cm5hbGN0bApqb3VybmFsY3RsX2ZpbHRlcjoKIC0gIi1rIgpsYWJlbHM6CiAgdHlwZTogc3lzbG9nCmBgYAoKbm90ZXMgOgogLSAgRGVwZW5kaW5nIG9uIHlvdXIgZGlzdHJpYnV0aW9uL09TLCBwYXRocyB0byBsb2cgZmlsZXMgbWlnaHQgY2hhbmdlCiAtICBPbmx5IHJlbGV2YW50IGlmIHlvdSBhcmUgbWFudWFsbHkgaW5zdGFsbGluZyBjb2xsZWN0aW9uCg==", "content": "cGFyc2VyczoKICAtIGNyb3dkc2VjdXJpdHkvaXB0YWJsZXMtbG9ncwpzY2VuYXJpb3M6CiAgLSBjcm93ZHNlY3VyaXR5L2lwdGFibGVzLXNjYW4tbXVsdGlfcG9ydHMKZGVzY3JpcHRpb246ICJpcHRhYmxlcyBzdXBwb3J0IDogbG9ncyBhbmQgcG9ydC1zY2FucyBkZXRlY3Rpb24gc2NlbmFyaW9zIgphdXRob3I6IGNyb3dkc2VjdXJpdHkKdGFnczoKICAtIGxpbnV4CiAgLSBwb3J0c2NhbgogIC0gaXB0YWJsZXMKCg==", "description": "iptables support : logs and port-scans detection scenarios", "author": "crowdsecurity", @@ -1240,23 +1279,29 @@ }, "crowdsecurity/linux-lpe": { "path": "collections/crowdsecurity/linux-lpe.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "a68ef0b517c988b50b3cdc0d84702b2f70e621d29378b9782b2e037bf6663458", "deprecated": false + }, + "0.2": { + "digest": "fd4a1d641522646b438dcf6572eddee3196c21bbc4dc75907515fd25e4f27578", + "deprecated": false } }, - "long_description": "IyMgTG9jYWwgUHJpdmlsZWdlIEVzY2FsYXRpb24gRGV0ZWN0aW9uCgpUaGlzIGNvbGxlY3Rpb24gYWltcyBhdCBkZXRlY3RpbmcgKHdoZW4gcG9zc2libGUpIGxvY2FsIHByaXZpbGVnZSBlc2NhbGF0aW9uIGF0dGFja3MuCgogLSBDVkUtMjAyMS00MDM0IDogRGV0ZWN0IGV4cGxvaXRhdGlvbiBvZiBwa2V4ZWMgdnVsbmVyYWJpbGl0eQoKOndhcm5pbmc6IFBsZWFzZSBub3RlIHRob3NlIHNjZW5hcmlvcyBhcmUgZGV0ZWN0aW9uIG9ubHksIGFuZCBhcmUgdmVyeSBsaWtlbHkgdG8gYmUgYnlwYXNzZWQgYnkgc21hcnQgYXR0YWNrZXJzLCBkbyBub3QgcmVseSBzb2xlbHkgb24gdGhlbSA6d2FybmluZzoKCiMjIEFjcXVpc2l0aW9uIHRlbXBsYXRlCgpFeGFtcGxlIGFjcXVpc2l0aW9uIGZvciB0aGlzIGNvbGxlY3Rpb24gOgoKYGBgeWFtbApmaWxlbmFtZXM6CiAgLSAvdmFyL2xvZy9hdXRoLmxvZwpsYWJlbHM6CiAgdHlwZTogc3lzbG9nCmBgYAoKbm90ZXMgOgogLSAgRGVwZW5kaW5nIG9uIHlvdXIgZGlzdHJpYnV0aW9uL09TLCBwYXRocyB0byBsb2cgZmlsZXMgbWlnaHQgY2hhbmdlCiAtICBPbmx5IHJlbGV2YW50IGlmIHlvdSBhcmUgbWFudWFsbHkgaW5zdGFsbGluZyBjb2xsZWN0aW9uCgo=", - "content": "cGFyc2VyczoKICAtIGNyb3dkc2VjdXJpdHkvcGtleGVjLWxvZ3MKc2NlbmFyaW9zOgogIC0gY3Jvd2RzZWN1cml0eS9DVkUtMjAyMS00MDM0CmNvbGxlY3Rpb25zOgogIC0gY3Jvd2RzZWN1cml0eS9saW51eApkZXNjcmlwdGlvbjogIkxpbnV4IExvY2FsIFByaXZpbGVnZSBFc2NhbGF0aW9uIGNvbGxlY3Rpb24gOiBkZXRlY3QgdHJpdmlhbCBMUEVzIgphdXRob3I6IGNyb3dkc2VjdXJpdHkKdGFnczoKICAtIGxpbnV4CiAgLSBwcml2c2VjCiAgLSBscGUKCgo=", + "long_description": "IyMgTG9jYWwgUHJpdmlsZWdlIEVzY2FsYXRpb24gRGV0ZWN0aW9uCgpUaGlzIGNvbGxlY3Rpb24gYWltcyBhdCBkZXRlY3RpbmcgKHdoZW4gcG9zc2libGUpIGxvY2FsIHByaXZpbGVnZSBlc2NhbGF0aW9uIGF0dGFja3MuCgogLSBDVkUtMjAyMS00MDM0IDogRGV0ZWN0IGV4cGxvaXRhdGlvbiBvZiBwa2V4ZWMgdnVsbmVyYWJpbGl0eQoKOndhcm5pbmc6IFBsZWFzZSBub3RlIHRob3NlIHNjZW5hcmlvcyBhcmUgZGV0ZWN0aW9uIG9ubHksIGFuZCBhcmUgdmVyeSBsaWtlbHkgdG8gYmUgYnlwYXNzZWQgYnkgc21hcnQgYXR0YWNrZXJzLCBkbyBub3QgcmVseSBzb2xlbHkgb24gdGhlbSA6d2FybmluZzoKCiMjIEFjcXVpc2l0aW9uIHRlbXBsYXRlCgpFeGFtcGxlIGFjcXVpc2l0aW9uIGZvciB0aGlzIGNvbGxlY3Rpb24gOgoKYGBgeWFtbApmaWxlbmFtZXM6CiAgLSAvdmFyL2xvZy9hdXRoLmxvZwogIC0gL3Zhci9sb2cva2Vybi5sb2cKbGFiZWxzOgogIHR5cGU6IHN5c2xvZwpgYGAKCklmIHlvdSB3YW50IHRvIGdldCBrZXJuZWwgbG9nIHRocm91Z2ggam91cm5hbGN0bApgYGAKc291cmNlOiBqb3VybmFsY3RsCmpvdXJuYWxjdGxfZmlsdGVyOgogIC0gIi1rIgpsYWJlbHM6CiAgdHlwZTogc3lzbG9nCmBgYAoKbm90ZXMgOgogLSAgRGVwZW5kaW5nIG9uIHlvdXIgZGlzdHJpYnV0aW9uL09TLCBwYXRocyB0byBsb2cgZmlsZXMgbWlnaHQgY2hhbmdlCiAtICBPbmx5IHJlbGV2YW50IGlmIHlvdSBhcmUgbWFudWFsbHkgaW5zdGFsbGluZyBjb2xsZWN0aW9uCiAtICBDVkUtMjAyMy00OTExIG5lZWRzIGtlcm5lbCBsb2cgZGV0ZWN0aW9uLCBlaXRoZXIga2Vybi5sb2cgb3IgdGhyb3VnaCBqb3VybmFsY3RsIGZpbHRlcmluZwoK", + "content": "cGFyc2VyczoKICAtIGNyb3dkc2VjdXJpdHkvcGtleGVjLWxvZ3MKICAtIGNyb3dkc2VjdXJpdHkvc2VnZmF1bHQtbG9ncwpzY2VuYXJpb3M6CiAgLSBjcm93ZHNlY3VyaXR5L0NWRS0yMDIxLTQwMzQKICAtIGNyb3dkc2VjdXJpdHkvQ1ZFLTIwMjMtNDkxMQpjb2xsZWN0aW9uczoKICAtIGNyb3dkc2VjdXJpdHkvbGludXgKZGVzY3JpcHRpb246ICJMaW51eCBMb2NhbCBQcml2aWxlZ2UgRXNjYWxhdGlvbiBjb2xsZWN0aW9uIDogZGV0ZWN0IHRyaXZpYWwgTFBFcyIKYXV0aG9yOiBjcm93ZHNlY3VyaXR5CnRhZ3M6CiAgLSBsaW51eAogIC0gcHJpdnNlYwogIC0gbHBlCgoK", "description": "Linux Local Privilege Escalation collection : detect trivial LPEs", "author": "crowdsecurity", "labels": null, "parsers": [ - "crowdsecurity/pkexec-logs" + "crowdsecurity/pkexec-logs", + "crowdsecurity/segfault-logs" ], "scenarios": [ - "crowdsecurity/CVE-2021-4034" + "crowdsecurity/CVE-2021-4034", + "crowdsecurity/CVE-2023-4911" ], "collections": [ "crowdsecurity/linux" @@ -2104,6 +2149,27 @@ "firewallservices/zimbra-bf" ] }, + "firix/authentik": { + "path": "collections/firix/authentik.yaml", + "version": "0.1", + "versions": { + "0.1": { + "digest": "3aad9afc16c8be4f1480f3dfbf7b992a571e065cf535775a891c657d67ddbec6", + "deprecated": false + } + }, + "long_description": "QSBjb2xsZWN0aW9uIHRvIGRlZmVuZCBbQXV0aGVudGlrXShodHRwczovL2dvYXV0aGVudGlrLmlvKSBpbnN0YW5jZSBhZ2FpbnN0IGNvbW1vbiBhdHRhY2tzIDoKIC0gQXV0aGVudGlrIHBhcnNlcgogLSBBdXRoZW50aWsgYnJ1dGVmb3JjZSBkZXRlY3Rpb24KCiMjIEFjcXVpc2l0aW9uIHRlbXBsYXRlCgpFeGFtcGxlIGFjcXVpc2l0aW9uIGZvciB0aGlzIGNvbGxlY3Rpb24gOgoKSWYgdXNpbmcgTE9HX0ZJTEUgZW52aXJvbm1lbnQgdmFyaWFibGU6CmBgYHlhbWwKLS0tCmZpbGVuYW1lczoKIC0gL3Zhci9sb2cvYXV0aGVudGlrLmxvZwpsYWJlbHM6CiAgdHlwZTogYXV0aGVudGlrCmBgYAoKRGlyZWN0bHkgbW9uaXRvcmluZyBEb2NrZXIKYGBgeWFtbAotLS0Kc291cmNlOiBkb2NrZXIKY29udGFpbmVyX25hbWU6CiAtIGF1dGhlbnRpawpsYWJlbHM6CiAgdHlwZTogYXV0aGVudGlrCmBgYAo=", + "content": "cGFyc2VyczoKICAtIGZpcml4L2F1dGhlbnRpay1sb2dzCnNjZW5hcmlvczoKICAtIGZpcml4L2F1dGhlbnRpay1iZgpjb2xsZWN0aW9uczoKZGVzY3JpcHRpb246ICJBdXRoZW50aWsgU3VwcG9ydCA6IHBhcnNlciBhbmQgYnJ1dGUtZm9yY2UgZGV0ZWN0aW9uIgphdXRob3I6IGZpcml4CnRhZ3M6CiAgLSBsaW51eAogIC0gYnJ1dGUtZm9yY2UKICAtIGF1dGhlbnRpawo=", + "description": "Authentik Support : parser and brute-force detection", + "author": "firix", + "labels": null, + "parsers": [ + "firix/authentik-logs" + ], + "scenarios": [ + "firix/authentik-bf" + ] + }, "fulljackz/proxmox": { "path": "collections/fulljackz/proxmox.yaml", "version": "0.1", @@ -2147,6 +2213,27 @@ "fulljackz/pureftpd-bf" ] }, + "gauth-fr/immich": { + "path": "collections/gauth-fr/immich.yml", + "version": "0.1", + "versions": { + "0.1": { + "digest": "b18a419be300518ec1c82139f892af0d854dda2ff38ef13310568d48f632d5d1", + "deprecated": false + } + }, + "long_description": "QSBjb2xsZWN0aW9uIHRvIGRlZmVuZCBbSW1taWNoXShodHRwczovL2ltbWljaC5hcHApIGluc3RhbmNlIGFnYWluc3QgY29tbW9uIGF0dGFja3MgOgogLSBJbW1pY2ggcGFyc2VyCiAtIEltbWljaCBicnV0ZWZvcmNlIGRldGVjdGlvbgoKIyMgQWNxdWlzaXRpb24gdGVtcGxhdGUKCkV4YW1wbGUgYWNxdWlzaXRpb24gZm9yIHRoaXMgY29sbGVjdGlvbiA6CgpJZiB1c2luZyBMT0dfRklMRSBlbnZpcm9ubWVudCB2YXJpYWJsZToKYGBgeWFtbAotLS0KZmlsZW5hbWVzOgogLSAvdmFyL2xvZy9pbW1pY2gvaW1taWNoX3NlcnZlci5sb2cKbGFiZWxzOgogIHR5cGU6IGltbWljaApgYGAKCkZvciBEb2NrZXIgZGlyZWN0bHkKYGBgeWFtbAotLS0Kc291cmNlOiBkb2NrZXIKY29udGFpbmVyX25hbWU6CiAtIGltbWljaF9zZXJ2ZXIKI2NvbnRhaW5lcl9pZDoKIyAtIDg0M2VlOTJkMjMxYgpsYWJlbHM6CiAgdHlwZTogaW1taWNoCmBgYAo=", + "content": "cGFyc2VyczoKICAtIGdhdXRoLWZyL2ltbWljaC1sb2dzCnNjZW5hcmlvczoKICAtIGdhdXRoLWZyL2ltbWljaC1iZgpkZXNjcmlwdGlvbjogIkltbWljaCBzdXBwb3J0IDogcGFyc2VyIGFuZCBicnV0ZS1mb3JjZSBkZXRlY3Rpb24iCmF1dGhvcjogZ2F1dGgtZnIKdGFnczoKICAtIGxpbnV4CiAgLSBicnV0ZS1mb3JjZQogIC0gaW1taWNoCg==", + "description": "Immich support : parser and brute-force detection", + "author": "gauth-fr", + "labels": null, + "parsers": [ + "gauth-fr/immich-logs" + ], + "scenarios": [ + "gauth-fr/immich-bf" + ] + }, "hitech95/nginx-mail": { "path": "collections/hitech95/nginx-mail.yaml", "version": "0.1", @@ -2470,6 +2557,48 @@ "scenarios": [ "timokoessler/uptime-kuma-bf" ] + }, + "xs539/bookstack": { + "path": "collections/xs539/bookstack.yml", + "version": "0.1", + "versions": { + "0.1": { + "digest": "c8033c7adcf79cb88650944dd5d86c799660b7d74ec5b33e7942d7a5a7f94d14", + "deprecated": false + } + }, + "long_description": "IyMgQm9va3N0YWNrIGNvbGxlY3Rpb24KCkEgY29sbGVjdGlvbiB0byBkZWZlbmQgQm9va3N0YWNrIGFnYWluc3QgY29tbW9uIGF0dGFja3MgOgogLSBib29rc3RhY2sgZmFpbGVkIGxvZ2luCgoKIyMgQWNxdWlzaXRpb24gdGVtcGxhdGUKCkV4YW1wbGUgYWNxdWlzaXRpb24gZm9yIHRoaXMgY29sbGVjdGlvbiA6CgpgYGB5YW1sCi0tLQpmaWxlbmFtZXM6CiAtIC92YXIvbG9nL2Jvb2tzdGFjay5sb2cKbGFiZWxzOgogIHR5cGU6IGJvb2tzdGFjawotLS0KYGBgCgpub3RlcyA6CiAtIFlvdSB3aWxsIG5lZWQgdG8gZW5hYmxlIFtGYWlsZWQgQWNjZXNzIExvZ2dpbmddKGh0dHBzOi8vd3d3LmJvb2tzdGFja2FwcC5jb20vZG9jcy9hZG1pbi9zZWN1cml0eS8jZmFpbGVkLWFjY2Vzcy1sb2dnaW5nKSAob2ZmIGJ5IGRlZmF1bHQpIAo=", + "content": "cGFyc2VyczoKICAtIHhzNTM5L2Jvb2tzdGFjay1sb2dzCnNjZW5hcmlvczoKICAtIHhzNTM5L2Jvb2tzdGFjay1iZgpkZXNjcmlwdGlvbjogIkJvb2tzdGFjayBTdXBwb3J0IDogcGFyc2VyIGFuZCBicnV0ZS1mb3JjZSBkZXRlY3Rpb24iCmF1dGhvcjogeHM1MzkKdGFnczoKICAtIEJvb2tzdGFjaw==", + "description": "Bookstack Support : parser and brute-force detection", + "author": "xs539", + "labels": null, + "parsers": [ + "xs539/bookstack-logs" + ], + "scenarios": [ + "xs539/bookstack-bf" + ] + }, + "xs539/joplin-server": { + "path": "collections/xs539/joplin-server.yml", + "version": "0.1", + "versions": { + "0.1": { + "digest": "dce7649eb24f0155bcdc443bfd26d88eb25ebe8a5d0775c66be08838e9d48db3", + "deprecated": false + } + }, + "long_description": "IyMgSm9wbGluIHNlcnZlciBjb2xsZWN0aW9uCgpBIGNvbGxlY3Rpb24gdG8gZGVmZW5kIEpvcGxpbiBzZXJ2ZXIgYWdhaW5zdCBjb21tb24gYXR0YWNrcyA6CiAtIEpvcGxpbiBzZXJ2ZXIgZmFpbGVkIGxvZ2luCgoKIyMgQWNxdWlzaXRpb24gdGVtcGxhdGUKCkV4YW1wbGUgYWNxdWlzaXRpb24gY29uZmlnOgpgYGB5YW1sCi0tLQpmaWxlbmFtZXM6CiAtIC92YXIvbG9nL2pvcGxpbi1zZXJ2ZXIubG9nCmxhYmVsczoKICB0eXBlOiBqb3BsaW4tc2VydmVyCi0tLQpgYGA=", + "content": "cGFyc2VyczoKICAtIHhzNTM5L2pvcGxpbi1zZXJ2ZXItbG9ncwpzY2VuYXJpb3M6CiAgLSB4czUzOS9qb3BsaW4tc2VydmVyLWJmCmRlc2NyaXB0aW9uOiAiSm9wbGluIFNlcnZlciBTdXBwb3J0IDogcGFyc2VyIGFuZCBicnV0ZS1mb3JjZSBkZXRlY3Rpb24iCmF1dGhvcjogeHM1MzkKdGFnczoKICAtIEpvcGxpbg==", + "description": "Joplin Server Support : parser and brute-force detection", + "author": "xs539", + "labels": null, + "parsers": [ + "xs539/joplin-server-logs" + ], + "scenarios": [ + "xs539/joplin-server-bf" + ] } }, "parsers": { @@ -2560,7 +2689,7 @@ "LePresidente/gitea-logs": { "path": "parsers/s01-parse/LePresidente/gitea-logs.yaml", "stage": "s01-parse", - "version": "0.6", + "version": "0.7", "versions": { "0.1": { "digest": "61733cf559c01d68ad3ee7d571c836273a0f26e03d1ac7d3b6c5f80783f802de", @@ -2585,10 +2714,14 @@ "0.6": { "digest": "99503f178fab36023d24660674b19059cb903dcbf11d516fa9acaec26185d3a0", "deprecated": false + }, + "0.7": { + "digest": "4586255da9713d8ef92253fdcc4a70d475c70e4fa222c0c205a2d7120afea768", + "deprecated": false } }, "long_description": "UGFyc2VyIGZvciBbR2l0ZWFdKGh0dHBzOi8vZ2l0ZWEuaW8pIExvZ3MuCgpgYGB5YW1sCi0tLQpmaWxlbmFtZXM6CiAtIC92YXIvbG9nL2dpdGVhLmxvZwpsYWJlbHM6CiAgdHlwZTogZ2l0ZWEKYGBg", - "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCiNkZWJ1ZzogZmFsc2UKbmFtZTogTGVQcmVzaWRlbnRlL2dpdGVhLWxvZ3MKZmlsdGVyOiAiZXZ0LlBhcnNlZC5wcm9ncmFtID09ICdnaXRlYSciCmRlc2NyaXB0aW9uOiAiUGFyc2UgZ2l0ZWEgbG9ncyIKcGF0dGVybl9zeW50YXg6CiAgR0lURUFfQ1VTVE9NVVNFUjogIigle0VNQUlMQUREUkVTU318JXtVU0VSTkFNRX0pIgogIEdJVEVBX0NVU1RPTURBVEU6ICIle0RBVEVfWH0gJXtUSU1FfSIKbm9kZXM6CiAgLSBncm9rOgogICAgICBwYXR0ZXJuOiAnXiV7R0lURUFfQ1VTVE9NREFURTp0aW1lc3RhbXB9Lio/RmFpbGVkIGF1dGhlbnRpY2F0aW9uIGF0dGVtcHQgZm9yICV7R0lURUFfQ1VTVE9NVVNFUjp1c2VybmFtZX0gZnJvbSAle0lQOnJlbW90ZV9pcH06JXtOVU1CRVI6cmVtb3RlX3BvcnR9LiogdXNlciBkb2VzIG5vdCBleGlzdCcKICAgICAgYXBwbHlfb246IG1lc3NhZ2UKICAgICAgc3RhdGljczoKICAgICAgICAtIG1ldGE6IGxvZ190eXBlCiAgICAgICAgICB2YWx1ZTogZ2l0ZWFfZmFpbGVkX2F1dGgKICAtIGdyb2s6CiAgICAgIHBhdHRlcm46ICdeJXtHSVRFQV9DVVNUT01EQVRFOnRpbWVzdGFtcH0uKj9GYWlsZWQgYXV0aGVudGljYXRpb24gYXR0ZW1wdCBmb3IgJXtHSVRFQV9DVVNUT01VU0VSOnVzZXJuYW1lfSBmcm9tIFxbJXtJUDpyZW1vdGVfaXB9XF0uKiB1c2VyIGRvZXMgbm90IGV4aXN0JyAKICAgICAgYXBwbHlfb246IG1lc3NhZ2UKICAgICAgc3RhdGljczoKICAgICAgICAtIG1ldGE6IGxvZ190eXBlCiAgICAgICAgICB2YWx1ZTogZ2l0ZWFfZmFpbGVkX2F1dGgKICAtIGdyb2s6CiAgICAgIHBhdHRlcm46ICdeJXtHSVRFQV9DVVNUT01EQVRFOnRpbWVzdGFtcH0uKj9GYWlsZWQgYXV0aGVudGljYXRpb24gYXR0ZW1wdCBmcm9tICV7SVA6cmVtb3RlX2lwfTole05VTUJFUjpyZW1vdGVfcG9ydH0nCiAgICAgIGFwcGx5X29uOiBtZXNzYWdlCiAgICAgIHN0YXRpY3M6CiAgICAgICAgLSBtZXRhOiBsb2dfdHlwZQogICAgICAgICAgdmFsdWU6IGdpdGVhX2ZhaWxlZF9hdXRoCiAgLSBncm9rOgogICAgICBwYXR0ZXJuOiAnXiV7R0lURUFfQ1VTVE9NREFURTp0aW1lc3RhbXB9Lio/RmFpbGVkIGF1dGhlbnRpY2F0aW9uIGF0dGVtcHQgZnJvbSBcWyV7SVA6cmVtb3RlX2lwfVxdJwogICAgICBhcHBseV9vbjogbWVzc2FnZQogICAgICBzdGF0aWNzOgogICAgICAgIC0gbWV0YTogbG9nX3R5cGUKICAgICAgICAgIHZhbHVlOiBnaXRlYV9mYWlsZWRfYXV0aAoKc3RhdGljczoKICAgIC0gbWV0YTogc2VydmljZQogICAgICB2YWx1ZTogZ2l0ZWEKICAgIC0gbWV0YTogdXNlcgogICAgICBleHByZXNzaW9uOiAiZXZ0LlBhcnNlZC51c2VybmFtZSIKICAgIC0gdGFyZ2V0OiBldnQuU3RyVGltZQogICAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLnRpbWVzdGFtcAogICAgLSBtZXRhOiBzb3VyY2VfaXAKICAgICAgZXhwcmVzc2lvbjogImV2dC5QYXJzZWQucmVtb3RlX2lwIgo=", + "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCiNkZWJ1ZzogZmFsc2UKbmFtZTogTGVQcmVzaWRlbnRlL2dpdGVhLWxvZ3MKZmlsdGVyOiAiZXZ0LlBhcnNlZC5wcm9ncmFtID09ICdnaXRlYSciCmRlc2NyaXB0aW9uOiAiUGFyc2UgZ2l0ZWEgbG9ncyIKcGF0dGVybl9zeW50YXg6CiAgR0lURUFfQ1VTVE9NVVNFUjogIigle0VNQUlMQUREUkVTU318JXtVU0VSTkFNRX0pIgogIEdJVEVBX0NVU1RPTURBVEU6ICIle0RBVEVfWH0gJXtUSU1FfSIKbm9kZXM6CiAgLSBncm9rOgogICAgICBwYXR0ZXJuOiAnXiV7R0lURUFfQ1VTVE9NREFURTp0aW1lc3RhbXB9Lio/RmFpbGVkIGF1dGhlbnRpY2F0aW9uIGF0dGVtcHQgZm9yICV7R0lURUFfQ1VTVE9NVVNFUjp1c2VybmFtZX0gZnJvbSAle0lQOnJlbW90ZV9pcH06JXtOVU1CRVI6cmVtb3RlX3BvcnR9LiogdXNlciBkb2VzIG5vdCBleGlzdCcKICAgICAgYXBwbHlfb246IG1lc3NhZ2UKICAgICAgc3RhdGljczoKICAgICAgICAtIG1ldGE6IGxvZ190eXBlCiAgICAgICAgICB2YWx1ZTogZ2l0ZWFfZmFpbGVkX2F1dGgKICAtIGdyb2s6CiAgICAgIHBhdHRlcm46ICdeJXtHSVRFQV9DVVNUT01EQVRFOnRpbWVzdGFtcH0uKj9GYWlsZWQgYXV0aGVudGljYXRpb24gYXR0ZW1wdCBmb3IgJXtHSVRFQV9DVVNUT01VU0VSOnVzZXJuYW1lfSBmcm9tIFxbJXtJUDpyZW1vdGVfaXB9XF0uKiB1c2VyIGRvZXMgbm90IGV4aXN0JyAKICAgICAgYXBwbHlfb246IG1lc3NhZ2UKICAgICAgc3RhdGljczoKICAgICAgICAtIG1ldGE6IGxvZ190eXBlCiAgICAgICAgICB2YWx1ZTogZ2l0ZWFfZmFpbGVkX2F1dGgKICAtIGdyb2s6CiAgICAgIHBhdHRlcm46ICdeJXtHSVRFQV9DVVNUT01EQVRFOnRpbWVzdGFtcH0uKj9GYWlsZWQgYXV0aGVudGljYXRpb24gYXR0ZW1wdCBmcm9tICV7SVA6cmVtb3RlX2lwfTole05VTUJFUjpyZW1vdGVfcG9ydH0nCiAgICAgIGFwcGx5X29uOiBtZXNzYWdlCiAgICAgIHN0YXRpY3M6CiAgICAgICAgLSBtZXRhOiBsb2dfdHlwZQogICAgICAgICAgdmFsdWU6IGdpdGVhX2ZhaWxlZF9hdXRoCiAgLSBncm9rOgogICAgICBwYXR0ZXJuOiAnXiV7R0lURUFfQ1VTVE9NREFURTp0aW1lc3RhbXB9Lio/RmFpbGVkIGF1dGhlbnRpY2F0aW9uIGF0dGVtcHQgZnJvbSBcWyV7SVA6cmVtb3RlX2lwfVxdJwogICAgICBhcHBseV9vbjogbWVzc2FnZQogICAgICBzdGF0aWNzOgogICAgICAgIC0gbWV0YTogbG9nX3R5cGUKICAgICAgICAgIHZhbHVlOiBnaXRlYV9mYWlsZWRfYXV0aAogIC0gZ3JvazoKICAgICAgcGF0dGVybjogIl4le0dJVEVBX0NVU1RPTURBVEU6dGltZXN0YW1wfS4qP0ZhaWxlZCBhdXRoZW50aWNhdGlvbiBhdHRlbXB0IGZvciAle0dJVEVBX0NVU1RPTVVTRVI6dXNlcm5hbWV9IGZyb20gJXtJUDpyZW1vdGVfaXB9OiV7TlVNQkVSOnJlbW90ZV9wb3J0fS4qIHVzZXIncyBwYXNzd29yZCBpcyBpbnZhbGlkIgogICAgICBhcHBseV9vbjogbWVzc2FnZQogICAgICBzdGF0aWNzOgogICAgICAgIC0gbWV0YTogbG9nX3R5cGUKICAgICAgICAgIHZhbHVlOiBnaXRlYV9mYWlsZWRfYXV0aAoKc3RhdGljczoKICAgIC0gbWV0YTogc2VydmljZQogICAgICB2YWx1ZTogZ2l0ZWEKICAgIC0gbWV0YTogdXNlcgogICAgICBleHByZXNzaW9uOiAiZXZ0LlBhcnNlZC51c2VybmFtZSIKICAgIC0gdGFyZ2V0OiBldnQuU3RyVGltZQogICAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLnRpbWVzdGFtcAogICAgLSBtZXRhOiBzb3VyY2VfaXAKICAgICAgZXhwcmVzc2lvbjogImV2dC5QYXJzZWQucmVtb3RlX2lwIgo=", "description": "Parse gitea logs", "author": "LePresidente", "labels": null @@ -3018,7 +3151,7 @@ "crowdsecurity/auditd-logs": { "path": "parsers/s01-parse/crowdsecurity/auditd-logs.yaml", "stage": "s01-parse", - "version": "0.7", + "version": "0.9", "versions": { "0.1": { "digest": "fa23b38e12ef4abce21475ad78c3d6650538c88e68f8235f74afc238345b0279", @@ -3047,9 +3180,17 @@ "0.7": { "digest": "777a9632ba5871cb42e51096c8e4ad49c1b6a39912e8a5097be4401dc42879c8", "deprecated": false + }, + "0.8": { + "digest": "094e29326685de68912952a3561ff862d78acc2d515d5c7badc6e3be13857d48", + "deprecated": false + }, + "0.9": { + "digest": "a8302c5a00fd74c13205934a6b101b5216ba93f2798fcbf816cc361bd63c829f", + "deprecated": false } }, - "content": "I3R5cGU9U1lTQ0FMTCBtc2c9YXVkaXQoMTY3MjMzMDk1NS4yNzM6NDQzMyk6IGFyY2g9YzAwMDAwM2Ugc3lzY2FsbD0yNjMgc3VjY2Vzcz1ubyBleGl0PS0yIGEwPWZmZmZmZjljIGExPTU1NzE2MjM5NjU5MCBhMj0wIGEzPTAgaXRlbXM9MSBwcGlkPTE0NDU3MSBwaWQ9MTQ1NDAwIGF1aWQ9MTAwMCB1aWQ9MTAwMCBnaWQ9MTAwMCBldWlkPTEwMDAgc3VpZD0xMDAwIGZzdWlkPTEwMDAgZWdpZD0xMDAwIHNnaWQ9MTAwMCBmc2dpZD0xMDAwIHR0eT1wdHMwIHNlcz03OSBjb21tPSJybSIgZXhlPSIvdXNyL2Jpbi9ybSIga2V5PSJmaWxlX21vZGlmaWNhdGlvbiIKbmFtZTogY3Jvd2RzZWN1cml0eS9hdWRpdGQtbG9ncwpkZXNjcmlwdGlvbjogIlBhcnNlIGF1ZGl0ZCBsb2dzIgpmaWx0ZXI6ICJldnQuUGFyc2VkLnByb2dyYW0gPT0gJ2F1ZGl0ZCciCm9uc3VjY2VzczogbmV4dF9zdGFnZQpwYXR0ZXJuX3N5bnRheDoKICBGTE9BVDogJ1swLTlcLl0rJwoKbm9kZXM6CiAgI1NZU0NBTEwgNTkgb24geDg2XzY0IC0+IGV4ZWN2ZQogIC0gZmlsdGVyOiBQYXJzZUtWKGV2dC5QYXJzZWQubWVzc2FnZSwgZXZ0LlVubWFyc2hhbGVkLCAiYXVkaXRkIikgPT0gbmlsICMgPT0gbmlsIGlzIHJlcXVpcmVkIGJlY2F1c2UgUGFyc2VLViBkb2VzIG5vdCByZXR1cm4gYSB2YWx1ZQogICAgbm9kZXM6CiAgICAgIC0gZmlsdGVyOiBldnQuVW5tYXJzaGFsZWQuYXVkaXRkLnR5cGUgPT0gIlNZU0NBTEwiIGFuZCBldnQuVW5tYXJzaGFsZWQuYXVkaXRkLmFyY2ggPT0gImMwMDAwMDNlIiBhbmQgZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC5zeXNjYWxsID09ICI1OSIKICAgICAgICBncm9rOgogICAgICAgICAgcGF0dGVybjogJyV7V09SRDptc2dfdHlwZX1cKCV7RkxPQVQ6dGltZXN0YW1wfTole0lOVDpldmVudF9pbmNfaWR9XCk6JwogICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC5tc2cKICAgICAgICBzdGF0aWNzOgogICAgICAgICAgLSBtZXRhOiBsb2dfdHlwZQogICAgICAgICAgICB2YWx1ZTogZXhlY3ZlCiAgICAgICAgICAtIHRhcmdldDogZXZ0LlN0clRpbWUKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC50aW1lc3RhbXAKICAgICAgICAgIC0gbWV0YTogcHBpZAogICAgICAgICAgICBleHByZXNzaW9uOiBldnQuVW5tYXJzaGFsZWQuYXVkaXRkLnBwaWQKICAgICAgICAgIC0gbWV0YTogZXhlCiAgICAgICAgICAgIGV4cHJlc3Npb246IGV2dC5Vbm1hcnNoYWxlZC5hdWRpdGQuZXhlCiAgICAgICAgICAtIG1ldGE6IHVpZAogICAgICAgICAgICBleHByZXNzaW9uOiBldnQuVW5tYXJzaGFsZWQuYXVkaXRkLnVpZAogICAgICAgICAgLSBtZXRhOiBhdWlkCiAgICAgICAgICAgIGV4cHJlc3Npb246IGV2dC5Vbm1hcnNoYWxlZC5hdWRpdGQuYXVpZAogICAgICAgICAgLSBtZXRhOiB0dHkKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC50dHkKICAgICAgICAgIC0gbWV0YTogYXVkaXRkX2V2ZW50aWQKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC5ldmVudF9pbmNfaWQKICAgICAgICAgICNsZXQncyBoeWRyYXRlIHdpdGggcHBpZCBwcm9jZXNzIGlmIHdlIGNhbiA6KQogICAgICAgICAgLSB0YXJnZXQ6IGV2dC5NZXRhLnBhcmVudF9wcm9nbmFtZQogICAgICAgICAgICBleHByZXNzaW9uOiBHZXRGcm9tU3Rhc2goImF1ZGl0ZF9waWRfcHJvZ25hbWUiLCBldnQuVW5tYXJzaGFsZWQuYXVkaXRkLnBwaWQpCiAgICAgICAgI2xldCdzIGNhcHR1cmUgcHJvY2VzcyBuYW1lIGlmIHdlIGNhbgogICAgICAgIHN0YXNoOgogICAgICAgICAgLSBuYW1lOiBhdWRpdGRfcGlkX3Byb2duYW1lCiAgICAgICAgICAgIGtleTogZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC5waWQKICAgICAgICAgICAgdmFsdWU6IGV2dC5Vbm1hcnNoYWxlZC5hdWRpdGQuZXhlCiAgICAgICAgICAgIHR0bDogMW0KICAgICAgICAgICAgc2l6ZTogMTAwCg==", + "content": "I3R5cGU9U1lTQ0FMTCBtc2c9YXVkaXQoMTY3MjMzMDk1NS4yNzM6NDQzMyk6IGFyY2g9YzAwMDAwM2Ugc3lzY2FsbD0yNjMgc3VjY2Vzcz1ubyBleGl0PS0yIGEwPWZmZmZmZjljIGExPTU1NzE2MjM5NjU5MCBhMj0wIGEzPTAgaXRlbXM9MSBwcGlkPTE0NDU3MSBwaWQ9MTQ1NDAwIGF1aWQ9MTAwMCB1aWQ9MTAwMCBnaWQ9MTAwMCBldWlkPTEwMDAgc3VpZD0xMDAwIGZzdWlkPTEwMDAgZWdpZD0xMDAwIHNnaWQ9MTAwMCBmc2dpZD0xMDAwIHR0eT1wdHMwIHNlcz03OSBjb21tPSJybSIgZXhlPSIvdXNyL2Jpbi9ybSIga2V5PSJmaWxlX21vZGlmaWNhdGlvbiIKbmFtZTogY3Jvd2RzZWN1cml0eS9hdWRpdGQtbG9ncwpkZXNjcmlwdGlvbjogIlBhcnNlIGF1ZGl0ZCBsb2dzIgpmaWx0ZXI6ICJldnQuUGFyc2VkLnByb2dyYW0gPT0gJ2F1ZGl0ZCciCm9uc3VjY2VzczogbmV4dF9zdGFnZQpwYXR0ZXJuX3N5bnRheDoKICBGTE9BVDogJ1swLTlcLl0rJwoKbm9kZXM6CiAgI1NZU0NBTEwgNTkgb24geDg2XzY0IC0+IGV4ZWN2ZQogIC0gZmlsdGVyOiBQYXJzZUtWKGV2dC5QYXJzZWQubWVzc2FnZSwgZXZ0LlVubWFyc2hhbGVkLCAiYXVkaXRkIikgPT0gbmlsICMgPT0gbmlsIGlzIHJlcXVpcmVkIGJlY2F1c2UgUGFyc2VLViBkb2VzIG5vdCByZXR1cm4gYSB2YWx1ZQogICAgbm9kZXM6CiAgICAgIC0gZ3JvazoKICAgICAgICAgIHBhdHRlcm46ICcle1dPUkQ6bXNnX3R5cGV9XCgle0ZMT0FUOnRpbWVzdGFtcH06JXtJTlQ6ZXZlbnRfaW5jX2lkfVwpOicKICAgICAgICAgIGV4cHJlc3Npb246IGV2dC5Vbm1hcnNoYWxlZC5hdWRpdGQubXNnCiAgICAgICAgbm9kZXM6CiAgICAgICAgICAtIGZpbHRlcjogZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC50eXBlID09ICJTWVNDQUxMIiBhbmQgZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC5hcmNoID09ICJjMDAwMDAzZSIgYW5kIGV2dC5Vbm1hcnNoYWxlZC5hdWRpdGQuc3lzY2FsbCA9PSAiNTkiCiAgICAgICAgICAgIHN0YXRpY3M6CiAgICAgICAgICAgICAgLSBtZXRhOiBsb2dfdHlwZQogICAgICAgICAgICAgICAgdmFsdWU6IGV4ZWN2ZQogICAgICAgICAgICAgICNsZXQncyBoeWRyYXRlIHdpdGggcHBpZCBwcm9jZXNzIGlmIHdlIGNhbiA6KQogICAgICAgICAgICAgIC0gdGFyZ2V0OiBldnQuTWV0YS5wYXJlbnRfcHJvZ25hbWUKICAgICAgICAgICAgICAgIGV4cHJlc3Npb246IEdldEZyb21TdGFzaCgiYXVkaXRkX3BpZF9wcm9nbmFtZSIsIGV2dC5Vbm1hcnNoYWxlZC5hdWRpdGQucHBpZCkKICAgICAgICAgICAgI2xldCdzIGNhcHR1cmUgcHJvY2VzcyBuYW1lIGlmIHdlIGNhbgogICAgICAgICAgICBzdGFzaDoKICAgICAgICAgICAgICAtIG5hbWU6IGF1ZGl0ZF9waWRfcHJvZ25hbWUKICAgICAgICAgICAgICAgIGtleTogZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC5waWQKICAgICAgICAgICAgICAgIHZhbHVlOiBldnQuVW5tYXJzaGFsZWQuYXVkaXRkLmV4ZQogICAgICAgICAgICAgICAgdHRsOiAxbQogICAgICAgICAgICAgICAgc2l6ZTogMTAwCiAgICAgICAgICAtIGZpbHRlcjogZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC50eXBlID09ICJBTk9NX0FCRU5EIgogICAgICAgICAgICBzdGF0aWNzOgogICAgICAgICAgICAgIC0gbWV0YTogbG9nX3R5cGUKICAgICAgICAgICAgICAgIHZhbHVlOiBhbm9tX2FiZW5kCiAgICAgICAgc3RhdGljczoKICAgICAgICAgIC0gdGFyZ2V0OiBldnQuU3RyVGltZQogICAgICAgICAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLnRpbWVzdGFtcAogICAgICAgICAgLSBtZXRhOiBwcGlkCiAgICAgICAgICAgIGV4cHJlc3Npb246IGV2dC5Vbm1hcnNoYWxlZC5hdWRpdGQucHBpZAogICAgICAgICAgLSBtZXRhOiBleGUKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC5leGUKICAgICAgICAgIC0gbWV0YTogdWlkCiAgICAgICAgICAgIGV4cHJlc3Npb246IGV2dC5Vbm1hcnNoYWxlZC5hdWRpdGQudWlkCiAgICAgICAgICAtIG1ldGE6IGF1aWQKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC5hdWlkCiAgICAgICAgICAtIG1ldGE6IGV1aWQKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC5ldWlkCiAgICAgICAgICAtIG1ldGE6IGdpZAogICAgICAgICAgICBleHByZXNzaW9uOiBldnQuVW5tYXJzaGFsZWQuYXVkaXRkLmdpZAogICAgICAgICAgLSBtZXRhOiBzZXMKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC5zZXMKICAgICAgICAgIC0gbWV0YTogc3ViagogICAgICAgICAgICBleHByZXNzaW9uOiBldnQuVW5tYXJzaGFsZWQuYXVkaXRkLnN1YmoKICAgICAgICAgIC0gbWV0YTogcGlkCiAgICAgICAgICAgIGV4cHJlc3Npb246IGV2dC5Vbm1hcnNoYWxlZC5hdWRpdGQucGlkCiAgICAgICAgICAtIG1ldGE6IGNvbW0KICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC5jb21tCiAgICAgICAgICAtIG1ldGE6IHNpZwogICAgICAgICAgICBleHByZXNzaW9uOiBldnQuVW5tYXJzaGFsZWQuYXVkaXRkLnNpZwogICAgICAgICAgLSBtZXRhOiB0dHkKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC50dHkKICAgICAgICAgIC0gbWV0YTogcmVzCiAgICAgICAgICAgIGV4cHJlc3Npb246IGV2dC5Vbm1hcnNoYWxlZC5hdWRpdGQucmVzCiAgICAgICAgICAtIG1ldGE6IHN0cl9VSUQKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmF1ZGl0ZC5VSUQKICAgICAgICAgIC0gbWV0YTogc3RyX0dJRAogICAgICAgICAgICBleHByZXNzaW9uOiBldnQuVW5tYXJzaGFsZWQuYXVkaXRkLkdJRCAKICAgICAgICAgIC0gbWV0YTogYXVkaXRkX2V2ZW50aWQKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC5ldmVudF9pbmNfaWQK", "description": "Parse auditd logs", "author": "crowdsecurity", "labels": null @@ -3506,7 +3647,7 @@ "crowdsecurity/http-logs": { "path": "parsers/s02-enrich/crowdsecurity/http-logs.yaml", "stage": "s02-enrich", - "version": "1.1", + "version": "1.2", "versions": { "0.1": { "digest": "d11c01b85927959d1619735c6ac09f260008211edcbf496db0d01b0bd93c5be2", @@ -3551,10 +3692,14 @@ "1.1": { "digest": "0a1788e43609b451d1a97b009107a1fe242fa21a2926922a6080636b2a2e56d6", "deprecated": false + }, + "1.2": { + "digest": "d0a95d6cf41e1ae10d0dd604b6bca9c72ab9e4709950b1816166acd630a18a9e", + "deprecated": false } }, "long_description": "VGhpcyBwYXJzZXIgaXMgYSBnZW5lcmljIHBvc3QtcGFyc2luZyBodHRwIHJlLXBhcnNlciBhbmQgcHJvZmlkZXMgbW9yZSBkZXRhaWxlZCBpbmZvcm1hdGlvbiBzdWNoIGFzIDoKIC0gc3RhdGljX3Jlc3NvdXJjZSA6IGEgYm9vbGVhbiB0byB0ZWxsIGlmIHRoZSByZXF1ZXN0ZWQgcmVzc291cmNlIGlzIGEgc3RhdGljIGZpbGUKIC0gZmlsZV9uYW1lIDogc2ltcGxlIGZpbGUrZmlsZS1leHRlbnNpb24KIC0gaW1wYWN0X2NvbXBsZXRpb24gOiBhIGJvb2xlYW4gZmxhZyBpbmRpY2F0aW5nIGlmIHRoZSByZXF1ZXN0IHN1Y2NlZWRlZCAoYmFzZWQgb24gdGhlIGh0dHAgcmVzcG9uc2UgY29kZSkK", - "content": "ZmlsdGVyOiAiZXZ0Lk1ldGEuc2VydmljZSA9PSAnaHR0cCcgJiYgZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWydodHRwX2FjY2Vzcy1sb2cnLCAnaHR0cF9lcnJvci1sb2cnXSIKZGVzY3JpcHRpb246ICJQYXJzZSBtb3JlIFNwZWNpZmljYWxseSBIVFRQIGxvZ3MsIHN1Y2ggYXMgSFRUUCBDb2RlLCBIVFRQIHBhdGgsIEhUVFAgYXJncyBhbmQgaWYgaXRzIGEgc3RhdGljIHJlc3NvdXJjZSIKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWxvZ3MKcGF0dGVybl9zeW50YXg6CiAgRElSOiAiXi4qLyIKICBGSUxFOiAiW14vXS4qPyIKICBFWFQ6ICJcXC5bXi5dKiR8JCIKbm9kZXM6CiAgLSBzdGF0aWNzOgogICAgIC0gcGFyc2VkOiAiaW1wYWN0X2NvbXBsZXRpb24iCiAgICAgICAjIHRoZSB2YWx1ZSBvZiBhIGZpZWxkIGNhbiBhcyB3ZWxsIGJlIGRldGVybWluZWQgYXMgdGhlIHJlc3VsdCBvZiBhbiBleHByZXNzaW9uCiAgICAgICBleHByZXNzaW9uOiAiZXZ0Lk1ldGEuaHR0cF9zdGF0dXMgaW4gWyc0MDQnLCAnNDAzJywgJzUwMiddID8gJ2ZhbHNlJyA6ICd0cnVlJyIKICAgICAtIHRhcmdldDogZXZ0LlBhcnNlZC5zdGF0aWNfcmVzc291cmNlCiAgICAgICB2YWx1ZTogJ2ZhbHNlJwogICMgbGV0J3Mgc3BsaXQgdGhlIHBhdGg/cXVlcnkgaWYgcG9zc2libGUKICAtIGdyb2s6CiAgICAgIHBhdHRlcm46ICJeJXtHUkVFRFlEQVRBOnJlcXVlc3R9XFw/JXtHUkVFRFlEQVRBOmh0dHBfYXJnc30kIgogICAgICBhcHBseV9vbjogcmVxdWVzdAogICMgdGhpcyBpcyBhbm90aGVyIG5vZGUsIHdpdGggaXRzIG93biBwYXR0ZXJuX3N5bnRheAogIC0gI2RlYnVnOiB0cnVlCiAgICBncm9rOgogICAgICBwYXR0ZXJuOiAiJXtESVI6ZmlsZV9kaXJ9KCV7RklMRTpmaWxlX2ZyYWd9JXtFWFQ6ZmlsZV9leHR9KT8iCiAgICAgIGFwcGx5X29uOiByZXF1ZXN0CiAgICAgIHN0YXRpY3M6CiAgICAgICAgLSBtZXRhOiBodHRwX3BhdGgKICAgICAgICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLmh0dHBfcGF0aCIKICAgICAgICAgICMgbWV0YSBhZgogICAgICAgIC0gbWV0YTogaHR0cF9hcmdzX2xlbgogICAgICAgICAgZXhwcmVzc2lvbjogImxlbihldnQuUGFyc2VkLmh0dHBfYXJncykiCiAgICAgICAgLSBwYXJzZWQ6IGZpbGVfbmFtZQogICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC5maWxlX2ZyYWcgKyBldnQuUGFyc2VkLmZpbGVfZXh0CiAgICAgICAgLSBwYXJzZWQ6IHN0YXRpY19yZXNzb3VyY2UKICAgICAgICAgIGV4cHJlc3Npb246ICJVcHBlcihldnQuUGFyc2VkLmZpbGVfZXh0KSBpbiBbJy5KUEcnLCAnLkNTUycsICcuSlMnLCAnLkpQRUcnLCAnLlBORycsICcuU1ZHJywgJy5NQVAnLCAnLklDTycsICcuT1RGJywgJy5HSUYnLCAnLk1QMycsICcuTVA0JywgJy5XT0ZGJywgJy5XT0ZGMicsICcuVFRGJywgJy5PVEYnLCAnLkVPVCcsICcuV0VCUCcsICcuV0FWJywgJy5HWicsICcuQlJPVExJJywgJy5CVlInLCAnLlRTJywgJy5CTVAnXSA/ICd0cnVlJyA6ICdmYWxzZSciCg==", + "content": "ZmlsdGVyOiAiZXZ0Lk1ldGEuc2VydmljZSA9PSAnaHR0cCcgJiYgZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWydodHRwX2FjY2Vzcy1sb2cnLCAnaHR0cF9lcnJvci1sb2cnXSIKZGVzY3JpcHRpb246ICJQYXJzZSBtb3JlIFNwZWNpZmljYWxseSBIVFRQIGxvZ3MsIHN1Y2ggYXMgSFRUUCBDb2RlLCBIVFRQIHBhdGgsIEhUVFAgYXJncyBhbmQgaWYgaXRzIGEgc3RhdGljIHJlc3NvdXJjZSIKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWxvZ3MKcGF0dGVybl9zeW50YXg6CiAgRElSOiAiXi4qLyIKICBGSUxFOiAiW14vXS4qPyIKICBFWFQ6ICJcXC5bXi5dKiR8JCIKbm9kZXM6CiAgLSBzdGF0aWNzOgogICAgIC0gcGFyc2VkOiAiaW1wYWN0X2NvbXBsZXRpb24iCiAgICAgICAjIHRoZSB2YWx1ZSBvZiBhIGZpZWxkIGNhbiBhcyB3ZWxsIGJlIGRldGVybWluZWQgYXMgdGhlIHJlc3VsdCBvZiBhbiBleHByZXNzaW9uCiAgICAgICBleHByZXNzaW9uOiAiZXZ0Lk1ldGEuaHR0cF9zdGF0dXMgaW4gWyc0MDQnLCAnNDAzJywgJzUwMiddID8gJ2ZhbHNlJyA6ICd0cnVlJyIKICAgICAtIHRhcmdldDogZXZ0LlBhcnNlZC5zdGF0aWNfcmVzc291cmNlCiAgICAgICB2YWx1ZTogJ2ZhbHNlJwogICMgbGV0J3Mgc3BsaXQgdGhlIHBhdGg/cXVlcnkgaWYgcG9zc2libGUKICAtIGdyb2s6CiAgICAgIHBhdHRlcm46ICJeJXtHUkVFRFlEQVRBOnJlcXVlc3R9XFw/JXtHUkVFRFlEQVRBOmh0dHBfYXJnc30kIgogICAgICBhcHBseV9vbjogcmVxdWVzdAogICMgdGhpcyBpcyBhbm90aGVyIG5vZGUsIHdpdGggaXRzIG93biBwYXR0ZXJuX3N5bnRheAogIC0gI2RlYnVnOiB0cnVlCiAgICBncm9rOgogICAgICBwYXR0ZXJuOiAiJXtESVI6ZmlsZV9kaXJ9KCV7RklMRTpmaWxlX2ZyYWd9JXtFWFQ6ZmlsZV9leHR9KT8iCiAgICAgIGFwcGx5X29uOiByZXF1ZXN0CiAgICAgIHN0YXRpY3M6CiAgICAgICAgLSBtZXRhOiBodHRwX3BhdGgKICAgICAgICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLmh0dHBfcGF0aCIKICAgICAgICAgICMgbWV0YSBhZgogICAgICAgIC0gbWV0YTogaHR0cF9hcmdzX2xlbgogICAgICAgICAgZXhwcmVzc2lvbjogImxlbihldnQuUGFyc2VkLmh0dHBfYXJncykiCiAgICAgICAgLSBwYXJzZWQ6IGZpbGVfbmFtZQogICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC5maWxlX2ZyYWcgKyBldnQuUGFyc2VkLmZpbGVfZXh0CiAgICAgICAgLSBwYXJzZWQ6IHN0YXRpY19yZXNzb3VyY2UKICAgICAgICAgIGV4cHJlc3Npb246ICJVcHBlcihldnQuUGFyc2VkLmZpbGVfZXh0KSBpbiBbJy5KUEcnLCAnLkNTUycsICcuSlMnLCAnLkpQRUcnLCAnLlBORycsICcuU1ZHJywgJy5NQVAnLCAnLklDTycsICcuT1RGJywgJy5HSUYnLCAnLk1QMycsICcuTVA0JywgJy5XT0ZGJywgJy5XT0ZGMicsICcuVFRGJywgJy5PVEYnLCAnLkVPVCcsICcuV0VCUCcsICcuV0FWJywgJy5HWicsICcuQlJPVExJJywgJy5CVlInLCAnLlRTJywgJy5CTVAnLCAnLkFWSUYnXSA/ICd0cnVlJyA6ICdmYWxzZSciCg==", "description": "Parse more Specifically HTTP logs, such as HTTP Code, HTTP path, HTTP args and if its a static ressource", "author": "crowdsecurity", "labels": null @@ -3677,14 +3822,18 @@ "crowdsecurity/laurel-logs": { "path": "parsers/s01-parse/crowdsecurity/laurel-logs.yaml", "stage": "s01-parse", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "95eab37bd97b342940a3ca7217ee89c6b24b744ddf59e40346a28b43480db60f", "deprecated": false + }, + "0.2": { + "digest": "3f8eca354cab4b0aa1b4ab35fbb44c110d6f170f05119dff5d03bfcee8daf124", + "deprecated": false } }, - "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L2xhdXJlbC1sb2dzCmRlc2NyaXB0aW9uOiAiUGFyc2UgbGF1cmVsIGpzb24gbG9ncyIKIyMgMS41LjIgcmV0dXJucyAiIiAsIDEuNS4zIHJldHVybnMgbmlsCmZpbHRlcjogZXZ0LlBhcnNlZC5wcm9ncmFtID09ICdsYXVyZWwnCnBhdHRlcm5fc3ludGF4OgogIEZMT0FUOiAnWzAtOVwuXSsnCm5vZGVzOgogIC0gZmlsdGVyOiBVbm1hcnNoYWxKU09OKGV2dC5QYXJzZWQubWVzc2FnZSwgZXZ0LlVubWFyc2hhbGVkLCAibGF1cmVsIikgaW4gWyIiLCBuaWxdCiAgICBncm9rOgogICAgICBwYXR0ZXJuOiAnJXtGTE9BVDp0aW1lc3RhbXB9OiV7SU5UOmV2ZW50X2luY19pZH0nCiAgICAgIGV4cHJlc3Npb246IGV2dC5Vbm1hcnNoYWxlZC5sYXVyZWwuSUQKc3RhdGljczoKICAtIG1ldGE6IHNlcnZpY2UKICAgIHZhbHVlOiBsYXVyZWwKICAtIG1ldGE6IGxvZ190eXBlCiAgICBleHByZXNzaW9uOiBldnQuVW5tYXJzaGFsZWQubGF1cmVsLlNZU0NBTEwuU1lTQ0FMTAogIC0gdGFyZ2V0OiBldnQuU3RyVGltZQogICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC50aW1lc3RhbXAKICAtIG1ldGE6IGV4ZQogICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5TWVNDQUxMLmV4ZQogIC0gbWV0YTogdWlkCiAgICBleHByZXNzaW9uOiBpbnQoZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5TWVNDQUxMLnVpZCkKICAtIG1ldGE6IGF1ZGl0ZF9ldmVudGlkCiAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLmV2ZW50X2luY19pZAogIC0gbWV0YTogcGFyZW50X3Byb2duYW1lCiAgICBleHByZXNzaW9uOiBldnQuVW5tYXJzaGFsZWQubGF1cmVsLlNZU0NBTEwuUFBJRC5leGUKICAtIG1ldGE6IHBwaWQKICAgIGV4cHJlc3Npb246IGludChldnQuVW5tYXJzaGFsZWQubGF1cmVsLlNZU0NBTEwucHBpZCkKICAtIG1ldGE6IGF1aWQKICAgIGV4cHJlc3Npb246IGludChldnQuVW5tYXJzaGFsZWQubGF1cmVsLlNZU0NBTEwuYXVpZCkKICAtIG1ldGE6IHR0eQogICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5TWVNDQUxMLnR0eQo=", + "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L2xhdXJlbC1sb2dzCmRlc2NyaXB0aW9uOiAiUGFyc2UgbGF1cmVsIGpzb24gbG9ncyIKIyMgMS41LjIgcmV0dXJucyAiIiAsIDEuNS4zIHJldHVybnMgbmlsCmZpbHRlcjogZXZ0LlBhcnNlZC5wcm9ncmFtID09ICdsYXVyZWwnCnBhdHRlcm5fc3ludGF4OgogIEZMT0FUOiAnWzAtOVwuXSsnCm5vZGVzOgogIC0gZmlsdGVyOiBVbm1hcnNoYWxKU09OKGV2dC5QYXJzZWQubWVzc2FnZSwgZXZ0LlVubWFyc2hhbGVkLCAibGF1cmVsIikgaW4gWyIiLCBuaWxdCiAgICBncm9rOgogICAgICBwYXR0ZXJuOiAnJXtGTE9BVDp0aW1lc3RhbXB9OiV7SU5UOmV2ZW50X2luY19pZH0nCiAgICAgIGV4cHJlc3Npb246IGV2dC5Vbm1hcnNoYWxlZC5sYXVyZWwuSUQKICAgIG5vZGVzOgogICAgICAtIGZpbHRlcjogZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5TWVNDQUxMICE9IG5pbAogICAgICAgIHN0YXRpY3M6CiAgICAgICAgICAtIG1ldGE6IHNlcnZpY2UKICAgICAgICAgICAgdmFsdWU6IGxhdXJlbAogICAgICAgICAgLSBtZXRhOiBsb2dfdHlwZQogICAgICAgICAgICBleHByZXNzaW9uOiBldnQuVW5tYXJzaGFsZWQubGF1cmVsLlNZU0NBTEwuU1lTQ0FMTAogICAgICAgICAgLSB0YXJnZXQ6IGV2dC5TdHJUaW1lCiAgICAgICAgICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQudGltZXN0YW1wCiAgICAgICAgICAtIG1ldGE6IGV4ZQogICAgICAgICAgICBleHByZXNzaW9uOiBldnQuVW5tYXJzaGFsZWQubGF1cmVsLlNZU0NBTEwuZXhlCiAgICAgICAgICAtIG1ldGE6IHVpZAogICAgICAgICAgICBleHByZXNzaW9uOiBpbnQoZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5TWVNDQUxMLnVpZCkKICAgICAgICAgIC0gbWV0YTogYXVkaXRkX2V2ZW50aWQKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC5ldmVudF9pbmNfaWQKICAgICAgICAgIC0gbWV0YTogcGFyZW50X3Byb2duYW1lCiAgICAgICAgICAgIGV4cHJlc3Npb246IGV2dC5Vbm1hcnNoYWxlZC5sYXVyZWwuU1lTQ0FMTC5QUElELmV4ZQogICAgICAgICAgLSBtZXRhOiBwcGlkCiAgICAgICAgICAgIGV4cHJlc3Npb246IGludChldnQuVW5tYXJzaGFsZWQubGF1cmVsLlNZU0NBTEwucHBpZCkKICAgICAgICAgIC0gbWV0YTogYXVpZAogICAgICAgICAgICBleHByZXNzaW9uOiBpbnQoZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5TWVNDQUxMLmF1aWQpCiAgICAgICAgICAtIG1ldGE6IGV1aWQKICAgICAgICAgICAgZXhwcmVzc2lvbjogaW50KGV2dC5Vbm1hcnNoYWxlZC5sYXVyZWwuU1lTQ0FMTC5ldWlkKQogICAgICAgICAgLSBtZXRhOiB0dHkKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5TWVNDQUxMLnR0eQogICAgICAgICAgLSBtZXRhOiBzdWJqCiAgICAgICAgICAgIGV4cHJlc3Npb246IGV2dC5Vbm1hcnNoYWxlZC5sYXVyZWwuU1lTQ0FMTC5zdWJqCiAgICAgICAgICAtIG1ldGE6IHBpZAogICAgICAgICAgICBleHByZXNzaW9uOiBpbnQoZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5TWVNDQUxMLnBpZCkKICAgICAgICAgIC0gbWV0YTogY29tbQogICAgICAgICAgICBleHByZXNzaW9uOiBldnQuVW5tYXJzaGFsZWQubGF1cmVsLlNZU0NBTEwuY29tbQogICAgICAgICAgLSBtZXRhOiBzaWcKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5TWVNDQUxMLnNpZwogICAgICAgICAgLSBtZXRhOiByZXMKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5TWVNDQUxMLnJlcwogICAgICAgICAgLSBtZXRhOiBzdHJfVUlECiAgICAgICAgICAgIGV4cHJlc3Npb246IGludChldnQuVW5tYXJzaGFsZWQubGF1cmVsLlNZU0NBTEwuVUlEKQogICAgICAgICAgLSBtZXRhOiBzdHJfR0lECiAgICAgICAgICAgIGV4cHJlc3Npb246IGludChldnQuVW5tYXJzaGFsZWQubGF1cmVsLlNZU0NBTEwuR0lEKQogICAgICAtIGZpbHRlcjogZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5BTk9NX0FCRU5EICE9IG5pbAogICAgICAgIHN0YXRpY3M6CiAgICAgICAgICAtIG1ldGE6IHNlcnZpY2UKICAgICAgICAgICAgdmFsdWU6IGxhdXJlbAogICAgICAgICAgLSBtZXRhOiBsb2dfdHlwZQogICAgICAgICAgICB2YWx1ZTogYW5vbV9hYmVuZAogICAgICAgICAgLSBtZXRhOiBleGUKICAgICAgICAgICAgZXhwcmVzc2lvbjogZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5BTk9NX0FCRU5EWzBdLmV4ZQogICAgICAgICAgLSBtZXRhOiB1aWQKICAgICAgICAgICAgZXhwcmVzc2lvbjogaW50KGV2dC5Vbm1hcnNoYWxlZC5sYXVyZWwuQU5PTV9BQkVORFswXS51aWQpCiAgICAgICAgICAtIG1ldGE6IGF1ZGl0ZF9ldmVudGlkCiAgICAgICAgICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQuZXZlbnRfaW5jX2lkCiAgICAgICAgICAtIG1ldGE6IHBpZAogICAgICAgICAgICBleHByZXNzaW9uOiBpbnQoZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5BTk9NX0FCRU5EWzBdLnBpZCkKICAgICAgICAgIC0gbWV0YTogYXVpZAogICAgICAgICAgICBleHByZXNzaW9uOiBpbnQoZXZ0LlVubWFyc2hhbGVkLmxhdXJlbC5BTk9NX0FCRU5EWzBdLmF1aWQpCiAgICAgICAgICAtIG1ldGE6IHNpZwogICAgICAgICAgICBleHByZXNzaW9uOiBTcHJpbnRmKCIldiIsIGludChldnQuVW5tYXJzaGFsZWQubGF1cmVsLkFOT01fQUJFTkRbMF0uc2lnKSkKc3RhdGljczoKICAtIHRhcmdldDogZXZ0LlN0clRpbWUKICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQudGltZXN0YW1w", "description": "Parse laurel json logs", "author": "crowdsecurity", "labels": null @@ -4188,7 +4337,7 @@ "crowdsecurity/proftpd-logs": { "path": "parsers/s01-parse/crowdsecurity/proftpd-logs.yaml", "stage": "s01-parse", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "f00e26a5fd74f57bab31f930d23cca9c2ede7cc480cb34c7a6aef5a87baf0ca0", @@ -4197,14 +4346,45 @@ "0.2": { "digest": "9921d4752e7337533472031d1495f9c4e4f870a558ea48f303e95e96a31f7f13", "deprecated": false + }, + "0.3": { + "digest": "7121c527184caecbc3ca675ba5bc1c7e2029b6f4c625dcbff6c294a22c3d3274", + "deprecated": false } }, "long_description": "RlRQIChbUHJvRlRQRF0oaHR0cHM6Ly9lbi53aWtpcGVkaWEub3JnL3dpa2kvUHJvRlRQRCkpIHdpbGwgbW9zdGx5IHBhcnNlIGF1dGhlbnRpY2F0aW9uIGZhaWwu", - "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCm5hbWU6IHByb2Z0cGQtbG9ncwpkZXNjcmlwdGlvbjogIlBhcnNlIHByb2Z0cGQgbG9ncyIKZmlsdGVyOiAiZXZ0LlBhcnNlZC5wcm9ncmFtID09ICdwcm9mdHBkJyIKI3dlIHNob3VsZCB1c2UgdGhlIHNhbWUgcGF0dGVybiBmb3IgIm5vcm1hbCIgYW5kIHBsZXNrIGxvZ3MsIGJ1dCBkdWUgdG8gYW4gaXNzdWUgaW4gZ3Jva2t5IGhhbmRsaW5nICgpLCB3ZSBjYW5ub3QgOigKcGF0dGVybl9zeW50YXg6CiAgUFJPRlRQRF9BVVRIX0ZBSUw6ICcle1RJTUVTVEFNUF9JU084NjAxOnRpbWVzdGFtcH0gJXtJUE9SSE9TVDpob3N0bmFtZX0gcHJvZnRwZFxbJXtEQVRBfVxdICV7SVBPUkhPU1Q6aG9zdG5hbWV9IFwoJXtJUE9SSE9TVH1cWyV7SVA6c291cmNlX2lwfVxdXCk6IFVTRVIgJXtVU0VSTkFNRTp1c2VybmFtZX0gXChMb2dpbiBmYWlsZWRcKTogSW5jb3JyZWN0IHBhc3N3b3JkJwogIFBST0ZUUERfQkFEX1VTRVI6ICcle1RJTUVTVEFNUF9JU084NjAxOnRpbWVzdGFtcH0gJXtJUE9SSE9TVDpob3N0bmFtZX0gcHJvZnRwZFxbJXtEQVRBfVxdICV7SVBPUkhPU1Q6aG9zdG5hbWV9IFwoJXtJUE9SSE9TVH1cWyV7SVA6c291cmNlX2lwfVxdXCk6IFVTRVIgJXtVU0VSTkFNRTp1c2VybmFtZX06IG5vIHN1Y2ggdXNlciBmb3VuZCBmcm9tICV7SVBPUkhPU1R9IFxbJXtJUE9SSE9TVH1cXSB0byAle0lQT1JIT1NUfTole0RBVEE6cG9ydH0nCiAgUFJPRlRQRF9BVVRIX0ZBSUxfUExFU0s6ICcle1NZU0xPR1RJTUVTVEFNUDp0aW1lc3RhbXB9ICV7SVBPUkhPU1Q6aG9zdG5hbWV9IHByb2Z0cGRcWyV7REFUQX1cXTogJXtJUE9SSE9TVDpob3N0bmFtZX0gXCgle0lQT1JIT1NUfVxbJXtJUDpzb3VyY2VfaXB9XF1cKSAtIFVTRVIgJXtVU0VSTkFNRTp1c2VybmFtZX0gXChMb2dpbiBmYWlsZWRcKTogSW5jb3JyZWN0IHBhc3N3b3JkJwogIFBST0ZUUERfQkFEX1VTRVJfUExFU0s6ICcle1NZU0xPR1RJTUVTVEFNUDp0aW1lc3RhbXB9ICV7SVBPUkhPU1Q6aG9zdG5hbWV9IHByb2Z0cGRcWyV7REFUQX1cXTogJXtJUE9SSE9TVDpob3N0bmFtZX0gXCgle0lQT1JIT1NUfVxbJXtJUDpzb3VyY2VfaXB9XF1cKSAtIFVTRVIgJXtVU0VSTkFNRTp1c2VybmFtZX06IG5vIHN1Y2ggdXNlciBmb3VuZCBmcm9tICV7SVBPUkhPU1R9IFxbJXtJUE9SSE9TVH1cXSB0byAle0lQT1JIT1NUfTole0RBVEE6cG9ydH0nCm5vZGVzOgogIC0gZ3JvazoKICAgICAgcGF0dGVybjogIiV7UFJPRlRQRF9BVVRIX0ZBSUx9IgogICAgICBhcHBseV9vbjogbWVzc2FnZQogIC0gZ3JvazoKICAgICAgcGF0dGVybjogIiV7UFJPRlRQRF9CQURfVVNFUn0iCiAgICAgIGFwcGx5X29uOiBtZXNzYWdlCiAgLSBncm9rOgogICAgICBwYXR0ZXJuOiAiJXtQUk9GVFBEX0FVVEhfRkFJTF9QTEVTS30iCiAgICAgIGFwcGx5X29uOiBtZXNzYWdlCiAgLSBncm9rOgogICAgICBwYXR0ZXJuOiAiJXtQUk9GVFBEX0JBRF9VU0VSX1BMRVNLfSIKICAgICAgYXBwbHlfb246IG1lc3NhZ2UKc3RhdGljczoKICAgIC0gbWV0YTogbG9nX3R5cGUKICAgICAgdmFsdWU6IGZ0cF9mYWlsZWRfYXV0aAogICAgLSBtZXRhOiBzb3VyY2VfaXAKICAgICAgZXhwcmVzc2lvbjogImV2dC5QYXJzZWQuc291cmNlX2lwIgogICAgLSBtZXRhOiB0YXJnZXRfdXNlcgogICAgICBleHByZXNzaW9uOiAiZXZ0LlBhcnNlZC51c2VybmFtZSIKICAgIC0gdGFyZ2V0OiBldnQuU3RyVGltZQogICAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLnRpbWVzdGFtcCA=", + "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCm5hbWU6IHByb2Z0cGQtbG9ncwpkZXNjcmlwdGlvbjogIlBhcnNlIHByb2Z0cGQgbG9ncyIKZmlsdGVyOiAiZXZ0LlBhcnNlZC5wcm9ncmFtID09ICdwcm9mdHBkJyIKI3dlIHNob3VsZCB1c2UgdGhlIHNhbWUgcGF0dGVybiBmb3IgIm5vcm1hbCIgYW5kIHBsZXNrIGxvZ3MsIGJ1dCBkdWUgdG8gYW4gaXNzdWUgaW4gZ3Jva2t5IGhhbmRsaW5nICgpLCB3ZSBjYW5ub3QgOigKcGF0dGVybl9zeW50YXg6CiAgUFJPRlRQRF9BVVRIX0ZBSUw6ICcle1RJTUVTVEFNUF9JU084NjAxOnRpbWVzdGFtcH0gJXtJUE9SSE9TVDpob3N0bmFtZX0gcHJvZnRwZFxbJXtEQVRBfVxdICV7SVBPUkhPU1Q6aG9zdG5hbWV9IFwoJXtJUE9SSE9TVH1cWyV7SVA6c291cmNlX2lwfVxdXCk6IFVTRVIgJXtVU0VSTkFNRTp1c2VybmFtZX0gXChMb2dpbiBmYWlsZWRcKTogSW5jb3JyZWN0IHBhc3N3b3JkJwogIFBST0ZUUERfQkFEX1VTRVI6ICcle1RJTUVTVEFNUF9JU084NjAxOnRpbWVzdGFtcH0gJXtJUE9SSE9TVDpob3N0bmFtZX0gcHJvZnRwZFxbJXtEQVRBfVxdICV7SVBPUkhPU1Q6aG9zdG5hbWV9IFwoJXtJUE9SSE9TVH1cWyV7SVA6c291cmNlX2lwfVxdXCk6IFVTRVIgJXtVU0VSTkFNRTp1c2VybmFtZX0oIFwoTG9naW4gZmFpbGVkXCkpPzogKG58TilvIHN1Y2ggdXNlciBmb3VuZCggZnJvbSAle0lQT1JIT1NUfSBcWyV7SVBPUkhPU1R9XF0gdG8gJXtJUE9SSE9TVH06JXtEQVRBOnBvcnR9KT8nCiAgUFJPRlRQRF9BVVRIX0ZBSUxfUExFU0s6ICcle1NZU0xPR1RJTUVTVEFNUDp0aW1lc3RhbXB9ICV7SVBPUkhPU1Q6aG9zdG5hbWV9IHByb2Z0cGRcWyV7REFUQX1cXTogJXtJUE9SSE9TVDpob3N0bmFtZX0gXCgle0lQT1JIT1NUfVxbJXtJUDpzb3VyY2VfaXB9XF1cKSAtIFVTRVIgJXtVU0VSTkFNRTp1c2VybmFtZX0gXChMb2dpbiBmYWlsZWRcKTogSW5jb3JyZWN0IHBhc3N3b3JkJwogIFBST0ZUUERfQkFEX1VTRVJfUExFU0s6ICcle1NZU0xPR1RJTUVTVEFNUDp0aW1lc3RhbXB9ICV7SVBPUkhPU1Q6aG9zdG5hbWV9IHByb2Z0cGRcWyV7REFUQX1cXTogJXtJUE9SSE9TVDpob3N0bmFtZX0gXCgle0lQT1JIT1NUfVxbJXtJUDpzb3VyY2VfaXB9XF1cKSAtIFVTRVIgJXtVU0VSTkFNRTp1c2VybmFtZX0oIFwoTG9naW4gZmFpbGVkXCkpPzogKG58TilvIHN1Y2ggdXNlciBmb3VuZCggZnJvbSAle0lQT1JIT1NUfSBcWyV7SVBPUkhPU1R9XF0gdG8gJXtJUE9SSE9TVH06JXtEQVRBOnBvcnR9KT8nCm5vZGVzOgogIC0gZ3JvazoKICAgICAgcGF0dGVybjogIiV7UFJPRlRQRF9BVVRIX0ZBSUx9IgogICAgICBhcHBseV9vbjogbWVzc2FnZQogIC0gZ3JvazoKICAgICAgcGF0dGVybjogIiV7UFJPRlRQRF9CQURfVVNFUn0iCiAgICAgIGFwcGx5X29uOiBtZXNzYWdlCiAgLSBncm9rOgogICAgICBwYXR0ZXJuOiAiJXtQUk9GVFBEX0FVVEhfRkFJTF9QTEVTS30iCiAgICAgIGFwcGx5X29uOiBtZXNzYWdlCiAgLSBncm9rOgogICAgICBwYXR0ZXJuOiAiJXtQUk9GVFBEX0JBRF9VU0VSX1BMRVNLfSIKICAgICAgYXBwbHlfb246IG1lc3NhZ2UKc3RhdGljczoKICAgIC0gbWV0YTogbG9nX3R5cGUKICAgICAgdmFsdWU6IGZ0cF9mYWlsZWRfYXV0aAogICAgLSBtZXRhOiBzb3VyY2VfaXAKICAgICAgZXhwcmVzc2lvbjogImV2dC5QYXJzZWQuc291cmNlX2lwIgogICAgLSBtZXRhOiB0YXJnZXRfdXNlcgogICAgICBleHByZXNzaW9uOiAiZXZ0LlBhcnNlZC51c2VybmFtZSIKICAgIC0gdGFyZ2V0OiBldnQuU3RyVGltZQogICAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLnRpbWVzdGFtcCA=", "description": "Parse proftpd logs", "author": "crowdsecurity", "labels": null }, + "crowdsecurity/segfault-logs": { + "path": "parsers/s01-parse/crowdsecurity/segfault-logs.yaml", + "stage": "s01-parse", + "version": "0.4", + "versions": { + "0.1": { + "digest": "9079d38e296e0b574a5cb2fe1fee614c08114912daefa569b2dc0648d8d8e8b8", + "deprecated": false + }, + "0.2": { + "digest": "4473cedee88009d1a660c9695e9a128f3c2692020ea3cb1dd74b85422074ae31", + "deprecated": false + }, + "0.3": { + "digest": "4ac2695dcfbbd1bfa1402b95a642b2868ab61900714e7a17c2fb5f0235a3777b", + "deprecated": false + }, + "0.4": { + "digest": "b5c3c870a15370b249b443fb75c68f4efe894c92a86c4eaca39ee3ce993fd972", + "deprecated": false + } + }, + "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCiNkZWJ1ZzogdHJ1ZQpmaWx0ZXI6ICJldnQuUGFyc2VkLnByb2dyYW0gPT0gJ2tlcm5lbCcgYW5kIGV2dC5QYXJzZWQubWVzc2FnZSBjb250YWlucyAnc2VnZmF1bHQnIgpuYW1lOiBjcm93ZHNlY3VyaXR5L3NlZ2ZhdWx0LWxvZ3MKbm9kZXM6Ci0gZ3JvazoKICAgIHBhdHRlcm46ICcoXFsle0RBVEF9XF0gKT8le0RBVEE6YmluYXJ5fVxbJXtJTlQ6cGlkfVxdOiBzZWdmYXVsdCBhdCAle0RBVEE6YWRkcn0gaXAgJXtEQVRBOnJpcH0gc3AgJXtEQVRBOnNwfSBlcnJvciAle0lOVDplcnJfbnVtfSBpbiAle0RBVEE6bGlicmFyeX1cWyV7REFUQTpsaWJyYXJ5X29mZnNldH1cXSggJXtEQVRBfSk/JwogICAgYXBwbHlfb246IG1lc3NhZ2UKZGVzY3JpcHRpb246ICJQYXJzZXMgc2VnZmF1bHQga2VybmVsIHNpZGUiCnN0YXRpY3M6CiAgLSBtZXRhOiBsb2dfdHlwZQogICAgdmFsdWU6IGtlcm5lbAogIC0gbWV0YTogc3ViX2xvZ190eXBlCiAgICB2YWx1ZTogc2VnZmF1bHQKICAtIG1ldGE6IGxpYnJhcnkKICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQubGlicmFyeQogIC0gbWV0YTogZXJybnVtCiAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLmVycm51bQogIC0gbWV0YTogYmluYXJ5CiAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLmJpbmFyeQo=", + "description": "Parses segfault kernel side", + "author": "crowdsecurity", + "labels": null + }, "crowdsecurity/smb-logs": { "path": "parsers/s01-parse/crowdsecurity/smb-logs.yaml", "stage": "s01-parse", @@ -4768,6 +4948,22 @@ "author": "firewallservices", "labels": null }, + "firix/authentik-logs": { + "path": "parsers/s01-parse/firix/authentik-logs.yaml", + "stage": "s01-parse", + "version": "0.1", + "versions": { + "0.1": { + "digest": "b589807f2d6a21aa2dd07bf5a382f7c1d1ab18eb76108a714798258092d9e677", + "deprecated": false + } + }, + "long_description": "UGFyc2VyIGZvciBbQXV0aGVudGlrXShodHRwczovL2dvYXV0aGVudGlrLmlvKSBMb2dzLgoKYGBgeWFtbAotLS0KZmlsZW5hbWVzOgogLSAvdmFyL2xvZy9hdXRoZW50aWsubG9nCmxhYmVsczoKICB0eXBlOiBhdXRoZW50aWsKYGBgCgpgYGB5YW1sCi0tLQpzb3VyY2U6IGRvY2tlcgpjb250YWluZXJfbmFtZToKIC0gYXV0aGVudGlrCmxhYmVsczoKICB0eXBlOiBhdXRoZW50aWsKYGBgCg==", + "content": "bmFtZTogZmlyaXgvYXV0aGVudGlrLWxvZ3MKZGVzY3JpcHRpb246ICJQYXJzZSBBdXRoZW50aWsgbG9ncyIKZmlsdGVyOiAiTG93ZXIoZXZ0LlBhcnNlZC5wcm9ncmFtKSA9PSAnYXV0aGVudGlrJyIKb25zdWNjZXNzOiBuZXh0X3N0YWdlCm5vZGVzOgogIC0gZmlsdGVyOiAiSnNvbkV4dHJhY3QoZXZ0LlBhcnNlZC5tZXNzYWdlLCAnYWN0aW9uJykgPT0gJ2xvZ2luX2ZhaWxlZCciCiAgICBzdGF0aWNzOgogICAgICAtIG1ldGE6IGxvZ190eXBlCiAgICAgICAgdmFsdWU6IGF1dGhlbnRpa19mYWlsZWRfYXV0aAogICAgICAtIG1ldGE6IHVzZXJuYW1lCiAgICAgICAgZXhwcmVzc2lvbjogSnNvbkV4dHJhY3QoZXZ0LlBhcnNlZC5tZXNzYWdlLCAiY29udGV4dC51c2VybmFtZSIpCiAgLSBmaWx0ZXI6ICJKc29uRXh0cmFjdChldnQuUGFyc2VkLm1lc3NhZ2UsICdhY3Rpb24nKSA9PSAnaW52YWxpZF9pZGVudGlmaWVyJyIKICAgIHN0YXRpY3M6CiAgICAgIC0gbWV0YTogbG9nX3R5cGUKICAgICAgICB2YWx1ZTogYXV0aGVudGlrX2ludmFsaWRfdXNlcm5hbWUKICAgICAgLSBtZXRhOiB1c2VybmFtZQogICAgICAgIGV4cHJlc3Npb246IEpzb25FeHRyYWN0KGV2dC5QYXJzZWQubWVzc2FnZSwgImlkZW50aWZpZXIiKQpzdGF0aWNzOgogIC0gbWV0YTogc2VydmljZQogICAgdmFsdWU6IGF1dGhlbnRpawogIC0gbWV0YTogc291cmNlX2lwCiAgICBleHByZXNzaW9uOiBKc29uRXh0cmFjdChldnQuUGFyc2VkLm1lc3NhZ2UsICJjbGllbnRfaXAiKQogIC0gdGFyZ2V0OiBldnQuU3RyVGltZQogICAgZXhwcmVzc2lvbjogSnNvbkV4dHJhY3QoZXZ0LlBhcnNlZC5tZXNzYWdlLCAidGltZXN0YW1wIikgKyAiWiIK", + "description": "Parse Authentik logs", + "author": "firix", + "labels": null + }, "fulljackz/proxmox-logs": { "path": "parsers/s01-parse/fulljackz/proxmox-logs.yaml", "stage": "s01-parse", @@ -4807,15 +5003,19 @@ "gauth-fr/immich-logs": { "path": "parsers/s01-parse/gauth-fr/immich-logs.yaml", "stage": "s01-parse", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "5a9e8bfc8183eac0ae04713773e2fe932771a70eeebbd191b88d48abca944aad", "deprecated": false + }, + "0.2": { + "digest": "a8e655f18af1598eee89e0bc8a417f52c6c48139c8124b4e9bdee32357faa85d", + "deprecated": false } }, "long_description": "UGFyc2VyIGZvciBbSW1taWNoXShodHRwczovL2dpdGh1Yi5jb20vaW1taWNoLWFwcC9pbW1pY2gpIExvZ3MuCgpgYGB5YW1sCi0tLQpmaWxlbmFtZXM6CiAtIC92YXIvbG9nL2ltbWljaF9zZXJ2ZXIubG9nCmxhYmVsczoKICB0eXBlOiBpbW1pY2gKYGBgCgpgYGB5YW1sCi0tLQpzb3VyY2U6IGRvY2tlcgpjb250YWluZXJfbmFtZToKIC0gaW1taWNoX3NlcnZlcgojY29udGFpbmVyX2lkOgojIC0gODQzZWU5MmQyMzFiCmxhYmVsczoKICB0eXBlOiBpbW1pY2gKYGBgCg==", - "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCiNkZWJ1ZzogZmFsc2UKbmFtZTogZ2F1dGgtZnIvaW1taWNoLWxvZ3MKZGVzY3JpcHRpb246ICJQYXJzZSBJbW1pY2ggbG9ncyIKZmlsdGVyOiAiZXZ0LlBhcnNlZC5wcm9ncmFtID09ICdpbW1pY2gnIgpwYXR0ZXJuX3N5bnRheDoKICBJTU1JQ0hfQ1VTVE9NREFURV9QTTogIiV7TU9OVEhOVU0yfS8le01PTlRIREFZfS8le1lFQVJ9LCAle1RJTUV9IChBTXxQTXxhbXxwbSkiCiAgSU1NSUNIX0NVU1RPTURBVEU6ICIle01PTlRITlVNMn0vJXtNT05USERBWX0vJXtZRUFSfSwgJXtUSU1FfSIKbm9kZXM6CiAgLSBncm9rOgogICAgICBwYXR0ZXJuOiAiLiole0lNTUlDSF9DVVNUT01EQVRFX1BNOnRpbWVzdGFtcH0gICAgV0FSTiBcXFtBdXRoU2VydmljZV0gRmFpbGVkIGxvZ2luIGF0dGVtcHQgZm9yIHVzZXIgJXtFTUFJTEFERFJFU1M6dXNlcm5hbWV9IGZyb20gaXAgYWRkcmVzcyAle0lQOnNvdXJjZV9pcH0iCiAgICAgICNbTmVzdF0gNyAgLSAwOC8wMi8yMDIzLCA3OjM0OjAzIFBNICAgIFdBUk4gW0F1dGhTZXJ2aWNlXSBGYWlsZWQgbG9naW4gYXR0ZW1wdCBmb3IgdXNlciBmZHNAaGRkLmNvbSBmcm9tIGlwIGFkZHJlc3MgMTc2LjE3Mi40NC4yMTEKCiAgICAgIGFwcGx5X29uOiBtZXNzYWdlCiAgICAgIHN0YXRpY3M6CiAgICAgICAgLSBtZXRhOiBsb2dfdHlwZQogICAgICAgICAgdmFsdWU6IGltbWljaF9mYWlsZWRfYXV0aAogICAgICAgIC0gdGFyZ2V0OiBldnQuU3RyVGltZUZvcm1hdAogICAgICAgICAgdmFsdWU6ICIwMS8wMi8yMDA2LCAzOjA0OjA1IFBNIgogIC0gZ3JvazoKICAgICAgcGF0dGVybjogIi4qJXtJTU1JQ0hfQ1VTVE9NREFURTp0aW1lc3RhbXB9ICAgIFdBUk4gXFxbQXV0aFNlcnZpY2VdIEZhaWxlZCBsb2dpbiBhdHRlbXB0IGZvciB1c2VyICV7RU1BSUxBRERSRVNTOnVzZXJuYW1lfSBmcm9tIGlwIGFkZHJlc3MgJXtJUDpzb3VyY2VfaXB9IgogICAgICAjW05lc3RdIDcgIC0gMDgvMDIvMjAyMywgNzozNDowMyAgICBXQVJOIFtBdXRoU2VydmljZV0gRmFpbGVkIGxvZ2luIGF0dGVtcHQgZm9yIHVzZXIgZmRzQGhkZC5jb20gZnJvbSBpcCBhZGRyZXNzIDE3Ni4xNzIuNDQuMjExCgogICAgICBhcHBseV9vbjogbWVzc2FnZQogICAgICBzdGF0aWNzOgogICAgICAgIC0gbWV0YTogbG9nX3R5cGUKICAgICAgICAgIHZhbHVlOiBpbW1pY2hfZmFpbGVkX2F1dGgKICAgICAgICAtIHRhcmdldDogZXZ0LlN0clRpbWVGb3JtYXQKICAgICAgICAgIHZhbHVlOiAiMDEvMDIvMjAwNiwgMTU6MDQ6MDUiCgpzdGF0aWNzOgogICAgLSBtZXRhOiBzZXJ2aWNlCiAgICAgIHZhbHVlOiBpbW1pY2gKICAgIC0gbWV0YTogdXNlcgogICAgICBleHByZXNzaW9uOiAiZXZ0LlBhcnNlZC51c2VybmFtZSIKICAgIC0gbWV0YTogc291cmNlX2lwCiAgICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLnNvdXJjZV9pcCIKICAgIC0gdGFyZ2V0OiBldnQuU3RyVGltZQogICAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLnRpbWVzdGFtcAo=", + "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCiNkZWJ1ZzogZmFsc2UKbmFtZTogZ2F1dGgtZnIvaW1taWNoLWxvZ3MKZGVzY3JpcHRpb246ICJQYXJzZSBJbW1pY2ggbG9ncyIKZmlsdGVyOiAiZXZ0LlBhcnNlZC5wcm9ncmFtID09ICdpbW1pY2gnIgpwYXR0ZXJuX3N5bnRheDoKICBJTU1JQ0hfQ1VTVE9NREFURV9QTTogIiV7TU9OVEhOVU0yfS8le01PTlRIREFZfS8le1lFQVJ9LCAle1RJTUV9IChBTXxQTXxhbXxwbSkiCiAgSU1NSUNIX0NVU1RPTURBVEU6ICIle01PTlRITlVNMn0vJXtNT05USERBWX0vJXtZRUFSfSwgJXtUSU1FfSIKbm9kZXM6CiAgLSBncm9rOgogICAgICBwYXR0ZXJuOiAiLiole0lNTUlDSF9DVVNUT01EQVRFX1BNOnRpbWVzdGFtcH0uKkZhaWxlZCBsb2dpbiBhdHRlbXB0IGZvciB1c2VyICV7RU1BSUxBRERSRVNTOnVzZXJuYW1lfSBmcm9tIGlwIGFkZHJlc3MgJXtJUDpzb3VyY2VfaXB9LioiCiAgICAgICNbTmVzdF0gNyAgLSAwOC8wMi8yMDIzLCA3OjM0OjAzIFBNICAgIFdBUk4gW0F1dGhTZXJ2aWNlXSBGYWlsZWQgbG9naW4gYXR0ZW1wdCBmb3IgdXNlciBmZHNAaGRkLmNvbSBmcm9tIGlwIGFkZHJlc3MgMTc2LjE3Mi40NC4yMTEKCiAgICAgIGFwcGx5X29uOiBtZXNzYWdlCiAgICAgIHN0YXRpY3M6CiAgICAgICAgLSBtZXRhOiBsb2dfdHlwZQogICAgICAgICAgdmFsdWU6IGltbWljaF9mYWlsZWRfYXV0aAogICAgICAgIC0gdGFyZ2V0OiBldnQuU3RyVGltZUZvcm1hdAogICAgICAgICAgdmFsdWU6ICIwMS8wMi8yMDA2LCAzOjA0OjA1IFBNIgogIC0gZ3JvazoKICAgICAgcGF0dGVybjogIi4qJXtJTU1JQ0hfQ1VTVE9NREFURTp0aW1lc3RhbXB9LipGYWlsZWQgbG9naW4gYXR0ZW1wdCBmb3IgdXNlciAle0VNQUlMQUREUkVTUzp1c2VybmFtZX0gZnJvbSBpcCBhZGRyZXNzICV7SVA6c291cmNlX2lwfS4qIgogICAgICAjW05lc3RdIDcgIC0gMDgvMDIvMjAyMywgNzozNDowMyAgICBXQVJOIFtBdXRoU2VydmljZV0gRmFpbGVkIGxvZ2luIGF0dGVtcHQgZm9yIHVzZXIgZmRzQGhkZC5jb20gZnJvbSBpcCBhZGRyZXNzIDE3Ni4xNzIuNDQuMjExCgogICAgICBhcHBseV9vbjogbWVzc2FnZQogICAgICBzdGF0aWNzOgogICAgICAgIC0gbWV0YTogbG9nX3R5cGUKICAgICAgICAgIHZhbHVlOiBpbW1pY2hfZmFpbGVkX2F1dGgKICAgICAgICAtIHRhcmdldDogZXZ0LlN0clRpbWVGb3JtYXQKICAgICAgICAgIHZhbHVlOiAiMDEvMDIvMjAwNiwgMTU6MDQ6MDUiCgpzdGF0aWNzOgogICAgLSBtZXRhOiBzZXJ2aWNlCiAgICAgIHZhbHVlOiBpbW1pY2gKICAgIC0gbWV0YTogdXNlcgogICAgICBleHByZXNzaW9uOiAiZXZ0LlBhcnNlZC51c2VybmFtZSIKICAgIC0gbWV0YTogc291cmNlX2lwCiAgICAgIGV4cHJlc3Npb246ICJldnQuUGFyc2VkLnNvdXJjZV9pcCIKICAgIC0gdGFyZ2V0OiBldnQuU3RyVGltZQogICAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLnRpbWVzdGFtcAo=", "description": "Parse Immich logs", "author": "gauth-fr", "labels": null @@ -5075,6 +5275,38 @@ "description": "Parse Uptime Kuma Logs", "author": "timokoessler", "labels": null + }, + "xs539/bookstack-logs": { + "path": "parsers/s01-parse/xs539/bookstack-logs.yaml", + "stage": "s01-parse", + "version": "0.1", + "versions": { + "0.1": { + "digest": "b03afaaff75e627a5e80108364233efe44f04e83056c18acde8a5f7671969f31", + "deprecated": false + } + }, + "long_description": "UGFyc2VyIGZvciBbQm9va3N0YWNrXShodHRwczovL3d3dy5ib29rc3RhY2thcHAuY29tLykgbG9ncwoKWW91IHdpbGwgbmVlZCB0byBlbmFibGUgW0ZhaWxlZCBBY2Nlc3MgTG9nZ2luZ10oaHR0cHM6Ly93d3cuYm9va3N0YWNrYXBwLmNvbS9kb2NzL2FkbWluL3NlY3VyaXR5LyNmYWlsZWQtYWNjZXNzLWxvZ2dpbmcpIChvZmYgYnkgZGVmYXVsdCkgCgpgYGAKTE9HX0ZBSUxFRF9MT0dJTl9NRVNTQUdFPSJGYWlsZWQgbG9naW4gZm9yICV1IgpgYGAKCkV4YW1wbGUgYWNxdWlzaXRpb24gY29uZmlnOgpgYGB5YW1sCi0tLQpmaWxlbmFtZXM6CiAtIC92YXIvbG9nL2Jvb2tzdGFjay5sb2cKbGFiZWxzOgogIHR5cGU6IGJvb2tzdGFjawotLS0KYGBgCg==", + "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCmZpbHRlcjogIkxvd2VyKGV2dC5QYXJzZWQucHJvZ3JhbSkgaW4gWydib29rc3RhY2snXSIKbmFtZTogeHM1MzkvYm9va3N0YWNrLWxvZ3MKZGVzY3JpcHRpb246ICJQYXJzZSBib29rc3RhY2sgbG9ncyIKcGF0dGVybl9zeW50YXg6CiAgQk9PS1NUQUNLX1VTRVI6ICIoJXtFTUFJTEFERFJFU1N9fCV7VVNFUk5BTUV9KSIKbm9kZXM6CiAgLSBncm9rOgogICAgICBwYXR0ZXJuOiAnJXtOR0lOWEVSUlRJTUU6dGltZXN0YW1wfSV7R1JFRURZREFUQX1GYWlsZWQgbG9naW4gZm9yICV7Qk9PS1NUQUNLX1VTRVI6dGFyZ2V0X3VzZXJ9JXtHUkVFRFlEQVRBfWNsaWVudDogJXtJUE9SSE9TVDpyZW1vdGVfYWRkcn0nCiAgICAgIGFwcGx5X29uOiBtZXNzYWdlCiAgICAgIHN0YXRpY3M6CiAgICAgICAgLSBtZXRhOiBsb2dfdHlwZQogICAgICAgICAgdmFsdWU6IGJvb2tzdGFja19mYWlsZWRfYXV0aAogICAgICAgIC0gbWV0YTogdGFyZ2V0X3VzZXIKICAgICAgICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQudGFyZ2V0X3VzZXIKc3RhdGljczoKICAgIC0gbWV0YTogc2VydmljZQogICAgICB2YWx1ZTogYm9va3N0YWNrCiAgICAtIHRhcmdldDogZXZ0LlN0clRpbWUKICAgICAgZXhwcmVzc2lvbjogZXZ0LlBhcnNlZC50aW1lc3RhbXAKICAgIC0gbWV0YTogc291cmNlX2lwCiAgICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQucmVtb3RlX2FkZHI=", + "description": "Parse bookstack logs", + "author": "xs539", + "labels": null + }, + "xs539/joplin-server-logs": { + "path": "parsers/s01-parse/xs539/joplin-server-logs.yaml", + "stage": "s01-parse", + "version": "0.1", + "versions": { + "0.1": { + "digest": "ab679f8937f04d9800ce8153005b33c230b2d13fef690d727b30efd34d906703", + "deprecated": false + } + }, + "long_description": "UGFyc2VyIGZvciBbSm9wbGluIHNlcnZlcl0oaHR0cHM6Ly9naXRodWIuY29tL2xhdXJlbnQyMi9qb3BsaW4vdHJlZS9kZXYvcGFja2FnZXMvc2VydmVyKSBsb2dzCgpFeGFtcGxlIGFjcXVpc2l0aW9uIGNvbmZpZzoKYGBgeWFtbAotLS0KZmlsZW5hbWVzOgogLSAvdmFyL2xvZy9qb3BsaW4tc2VydmVyLmxvZwpsYWJlbHM6CiAgdHlwZTogam9wbGluLXNlcnZlcgotLS0KYGBg", + "content": "b25zdWNjZXNzOiBuZXh0X3N0YWdlCmZpbHRlcjogIkxvd2VyKGV2dC5QYXJzZWQucHJvZ3JhbSkgaW4gWydqb3BsaW4tc2VydmVyJ10iCm5hbWU6IHhzNTM5L2pvcGxpbi1zZXJ2ZXItbG9ncwpkZXNjcmlwdGlvbjogIlBhcnNlIEpvcGxpbiBTZXJ2ZXIgbG9ncyIKcGF0dGVybl9zeW50YXg6CiAgSk9QTElOX0RBVEU6ICIle1lFQVJ9Wy8tXSV7TU9OVEhOVU0yfVsvLV0le0RBWTJ9ICV7SE9VUn06JXtNSU5VVEV9OiV7U0VDT05EfSIKbm9kZXM6CiAgLSBncm9rOgogICAgICBwYXR0ZXJuOiAnJXtKT1BMSU5fREFURTp0aW1lc3RhbXB9JXtHUkVFRFlEQVRBfS9hcGkvc2Vzc2lvbnM6ICV7SVBPUkhPU1Q6cmVtb3RlX2FkZHJ9JXtHUkVFRFlEQVRBfUludmFsaWQgdXNlcm5hbWUgb3IgcGFzc3dvcmQle0dSRUVEWURBVEF9IiV7RU1BSUxBRERSRVNTOnRhcmdldF91c2VyfSInCiAgICAgIGFwcGx5X29uOiBtZXNzYWdlCiAgICAgIHN0YXRpY3M6CiAgICAgICAgLSBtZXRhOiBsb2dfdHlwZQogICAgICAgICAgdmFsdWU6IGpvcGxpbl9zZXJ2ZXJfZmFpbGVkX2F1dGgKICAgICAgICAtIG1ldGE6IHRhcmdldF91c2VyCiAgICAgICAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLnRhcmdldF91c2VyCnN0YXRpY3M6CiAgICAtIG1ldGE6IHNlcnZpY2UKICAgICAgdmFsdWU6IGpvcGxpbgogICAgLSB0YXJnZXQ6IGV2dC5TdHJUaW1lCiAgICAgIGV4cHJlc3Npb246IGV2dC5QYXJzZWQudGltZXN0YW1wCiAgICAtIG1ldGE6IHNvdXJjZV9pcAogICAgICBleHByZXNzaW9uOiBldnQuUGFyc2VkLnJlbW90ZV9hZGRy", + "description": "Parse Joplin Server logs", + "author": "xs539", + "labels": null } }, "postoverflows": { @@ -5228,45 +5460,65 @@ "scenarios": { "Dominic-Wagner/vaultwarden-bf": { "path": "scenarios/Dominic-Wagner/vaultwarden-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "7cfd47daccee7ae3c88be9d772610996114d36be9a4738274ae54509c67e6615", "deprecated": false + }, + "0.2": { + "digest": "d1a3c008d9c42712cc330c7d89eba463ce7cedff495f6ae176df15e518a13ad2", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCB2YXVsdHdhcmRlbiBhdXRoZW50aWNhdGlvbnM6CgogLSBsZWFrc3BlZWQgb2YgMW0sIGNhcGFjaXR5IG9mIDUgb24gc291cmNlIGlwCiAtIGxlYWtzcGVlZCBvZiAxbSwgY2FwYWNpdHkgb2YgNSBvbiBzb3VyY2UgaXAgYW5kIHVuaXF1ZSBkaXN0aW5jdCB1c2Vycwo=", - "content": "IyB2YXVsdHdhcmRlbiBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IERvbWluaWMtV2FnbmVyL3ZhdWx0d2FyZGVuLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHZhdWx0d2FyZGVuIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlIGluIFsndmF1bHR3YXJkZW5fZmFpbGVkX2F1dGgnLCAndmF1bHR3YXJkZW5fZmFpbGVkX2FkbWluX2F1dGgnLCAndmF1bHR3YXJkZW5fZmFpbGVkX3RvdHAnXSIKbGVha3NwZWVkOiAxbQpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogc2VydmljZTogdmF1bHR3YXJkZW4KIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIHZhdWx0d2FyZGVuIHVzZXItZW51bQp0eXBlOiBsZWFreQpuYW1lOiBEb21pbmljLVdhZ25lci92YXVsdHdhcmRlbi1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgdmF1bHR3YXJkZW4gdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3ZhdWx0d2FyZGVuX2ZhaWxlZF9hdXRoJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXJuYW1lCmxlYWtzcGVlZDogMW0KY2FwYWNpdHk6IDUKYmxhY2tob2xlOiA1bQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogc2VydmljZTogc3NoCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "IyB2YXVsdHdhcmRlbiBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IERvbWluaWMtV2FnbmVyL3ZhdWx0d2FyZGVuLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHZhdWx0d2FyZGVuIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlIGluIFsndmF1bHR3YXJkZW5fZmFpbGVkX2F1dGgnLCAndmF1bHR3YXJkZW5fZmFpbGVkX2FkbWluX2F1dGgnLCAndmF1bHR3YXJkZW5fZmFpbGVkX3RvdHAnXSIKbGVha3NwZWVkOiAxbQpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IHZhdWx0d2FyZGVuCiAgYmVoYXZpb3I6ICJnZW5lcmljOmJydXRlZm9yY2UiCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiVmF1bHR3YXJkZW4gQnJ1dGVmb3JjZSIKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgdmF1bHR3YXJkZW4gdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6IERvbWluaWMtV2FnbmVyL3ZhdWx0d2FyZGVuLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCB2YXVsdHdhcmRlbiB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAndmF1bHR3YXJkZW5fZmFpbGVkX2F1dGgnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcm5hbWUKbGVha3NwZWVkOiAxbQpjYXBhY2l0eTogNQpibGFja2hvbGU6IDVtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgc2VydmljZTogdmF1bHR3YXJkZW4KICBiZWhhdmlvcjogImdlbmVyaWM6YnJ1dGVmb3JjZSIKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiVmF1bHR3YXJkZW4gVXNlciBFbnVtZXJhdGlvbiIKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect vaultwarden bruteforce", "author": "Dominic-Wagner", "labels": { - "remediation": "true", + "behavior": "generic:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Vaultwarden Bruteforce", + "remediation": true, "service": "vaultwarden", - "type": "bruteforce" + "spoofable": 0 } }, "LePresidente/adguardhome-bf": { "path": "scenarios/LePresidente/adguardhome-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "af3af350da974cdb51f8dd66b3daae62253719680738a3190b5b48ba7a3fab46", "deprecated": false + }, + "0.2": { + "digest": "9e4167549d0e3393b31985309f36cbf21fa823f3ad444f9176ac03771fc718a0", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBBZEd1YXJkSG9tZSBhdXRoZW50aWNhdGlvbnM6CgogLSBsZWFrc3BlZWQgb2YgMW0sIGNhcGFjaXR5IG9mIDUgb24gc2FtZSBpcCBhZGRyZXNz", - "content": "ICMgQWRHdWFyZEhvbWUgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBMZVByZXNpZGVudGUvYWRndWFyZGhvbWUtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgQWRHdWFyZEhvbWUgYnJ1dGVmb3JjZSBhdHRhY2tzIiAKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2FkZ3VhcmRob21lX2ZhaWxlZF9hdXRoJyIKbGVha3NwZWVkOiAxbQpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogc2VydmljZTogYWRndWFyZGhvbWUKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVl", + "content": "IyBBZEd1YXJkSG9tZSBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IExlUHJlc2lkZW50ZS9hZGd1YXJkaG9tZS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBBZEd1YXJkSG9tZSBicnV0ZWZvcmNlIGF0dGFja3MiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdhZGd1YXJkaG9tZV9mYWlsZWRfYXV0aCciCmxlYWtzcGVlZDogMW0KY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBhZGd1YXJkaG9tZQogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgbGFiZWw6ICJBZEd1YXJkSG9tZSBCcnV0ZWZvcmNlIgogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect AdGuardHome bruteforce attacks", "author": "LePresidente", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "AdGuardHome Bruteforce", + "remediation": true, "service": "adguardhome", - "type": "bruteforce" + "spoofable": 0 } }, "LePresidente/authelia-bf": { "path": "scenarios/LePresidente/authelia-bf.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "6859d59edc2371a1b44babd0623f0f4db16feacb2096450ebc19a6804343bc28", @@ -5275,40 +5527,60 @@ "0.2": { "digest": "444cade77860d8cf730df8ca3ddcf728e2246c4c2c72685fd425dedd7ee26457", "deprecated": false + }, + "0.3": { + "digest": "e6f9ef547cd23ab4b260709481c65f8c34ce2a19e2bced8229f74dbe91e7191f", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBhdXRoZWxpYSBhdXRoZW50aWNhdGlvbnM6CgogLSBsZWFrc3BlZWQgb2YgMjBzLCBjYXBhY2l0eSBvZiA1IG9uIHNhbWUgdGFyZ2V0IHVzZXIKIC0gbGVha3NwZWVkIG9mIDFtLCBjYXBhY2l0eSBvZiA1IHVuaXF1ZSBkaXN0aW5jdCB1c2Vycw==", - "content": "IyBhdXRoZWxpYSBCRiBzY2FuCm5hbWU6IExlUHJlc2lkZW50ZS9hdXRoZWxpYS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBhdXRoZWxpYSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2F1dGhlbGlhX2ZhaWxlZF9jbGZfYXV0aCcsICdhdXRoZWxpYV9mYWlsZWRfanNvbl9hdXRoJ10iCiNkZWJ1ZzogdHJ1ZQp0eXBlOiBsZWFreQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAiMjBzIgpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBhdXRoZWxpYQogIHR5cGU6IGJydXRlZm9yY2UKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBhdXRoZWxpYSB1c2VyLWVudW0KdHlwZTogbGVha3kKbmFtZTogIExlUHJlc2lkZW50ZS9hdXRoZWxpYS1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgYXV0aGVsaWEgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlIGluIFsnYXV0aGVsaWFfZmFpbGVkX2NsZl9hdXRoJywgJ2F1dGhlbGlhX2ZhaWxlZF9qc29uX2F1dGgnXSIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VyCmxlYWtzcGVlZDogMTBzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogc2VydmljZTogYXV0aGVsaWEKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVl", + "content": "IyBhdXRoZWxpYSBCRiBzY2FuCm5hbWU6IExlUHJlc2lkZW50ZS9hdXRoZWxpYS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBhdXRoZWxpYSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2F1dGhlbGlhX2ZhaWxlZF9jbGZfYXV0aCcsICdhdXRoZWxpYV9mYWlsZWRfanNvbl9hdXRoJ10iCiNkZWJ1ZzogdHJ1ZQp0eXBlOiBsZWFreQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAiMjBzIgpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBhdXRoZWxpYQogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgbGFiZWw6ICJBdXRoZWxpYSBCcnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIGF1dGhlbGlhIHVzZXItZW51bQp0eXBlOiBsZWFreQpuYW1lOiBMZVByZXNpZGVudGUvYXV0aGVsaWEtYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGF1dGhlbGlhIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2F1dGhlbGlhX2ZhaWxlZF9jbGZfYXV0aCcsICdhdXRoZWxpYV9mYWlsZWRfanNvbl9hdXRoJ10iCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcgpsZWFrc3BlZWQ6IDEwcwpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBhdXRoZWxpYQogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiQXV0aGVsaWEgVXNlciBFbnVtZXJhdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect authelia bruteforce", "author": "LePresidente", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Authelia Bruteforce", + "remediation": true, "service": "authelia", - "type": "bruteforce" + "spoofable": 0 } }, "LePresidente/emby-bf": { "path": "scenarios/LePresidente/emby-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "4465206dcabe80edd026332b3a1aca8feb325fe982fa8fd2b4a38a3970a258b1", "deprecated": false + }, + "0.2": { + "digest": "53face55d2ab8e746503000657d65d19257de7ef3ee3ae6b54bdb1fd8a5b3514", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBlbWJ5IGF1dGhlbnRpY2F0aW9uczoKCiAtIGxlYWtzcGVlZCBvZiAxbSwgY2FwYWNpdHkgb2YgNSBvbiBzYW1lIHRhcmdldCBpcA==", - "content": "ICMgZW1ieSBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IExlUHJlc2lkZW50ZS9lbWJ5LWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGVtYnkgYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2VtYnlfZmFpbGVkX2F1dGgnIgpsZWFrc3BlZWQ6IDFtCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiBzZXJ2aWNlOiBlbWJ5CiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyBlbWJ5IGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogTGVQcmVzaWRlbnRlL2VtYnktYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgZW1ieSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnZW1ieV9mYWlsZWRfYXV0aCciCmxlYWtzcGVlZDogMW0KY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBlbWJ5CiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBsYWJlbDogIkVtYnkgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect emby bruteforce", "author": "LePresidente", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Emby Bruteforce", + "remediation": true, "service": "emby", - "type": "bruteforce" + "spoofable": 0 } }, "LePresidente/gitea-bf": { "path": "scenarios/LePresidente/gitea-bf.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "29eb0131d95219fa3a835a9e33cf38238240e42e8d7b46aa7bf7ed895d2b0b35", @@ -5317,508 +5589,825 @@ "0.2": { "digest": "2ba7cd0dc64eda94f1c094b45f1bffd779a3e773621fddb7506b713320406f54", "deprecated": false + }, + "0.3": { + "digest": "785e6e7e0e3f272a1555df16cbcdb38b5fef4638eb7feae97adff583507004ed", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBnaXRlYSBhdXRoZW50aWNhdGlvbnM6CgogLSBsZWFrc3BlZWQgb2YgMjBzLCBjYXBhY2l0eSBvZiA1IG9uIHNhbWUgdGFyZ2V0IHVzZXIKIC0gbGVha3NwZWVkIG9mIDFtLCBjYXBhY2l0eSBvZiA1IHVuaXF1ZSBkaXN0aW5jdCB1c2Vycw==", - "content": "IyBnaXRlYSBCRiBzY2FuCm5hbWU6IExlUHJlc2lkZW50ZS9naXRlYS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBnaXRlYSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnZ2l0ZWFfZmFpbGVkX2F1dGgnIgojZGVidWc6IHRydWUKdHlwZTogbGVha3kKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmxlYWtzcGVlZDogIjIwcyIKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogZ2l0ZWEKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgZ2l0ZWEgdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6ICBMZVByZXNpZGVudGUvZ2l0ZWEtYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGdpdGVhIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnZ2l0ZWFfZmFpbGVkX2F1dGgnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXIKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiBzZXJ2aWNlOiBnaXRlYQogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUK", + "content": "IyBnaXRlYSBCRiBzY2FuCm5hbWU6IExlUHJlc2lkZW50ZS9naXRlYS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBnaXRlYSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnZ2l0ZWFfZmFpbGVkX2F1dGgnIgojZGVidWc6IHRydWUKdHlwZTogbGVha3kKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmxlYWtzcGVlZDogIjIwcyIKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogZ2l0ZWEKICBiZWhhdmlvcjogInZjczpicnV0ZWZvcmNlIgogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgbGFiZWw6ICJHaXRlYSBCcnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIGdpdGVhIHVzZXItZW51bQp0eXBlOiBsZWFreQpuYW1lOiBMZVByZXNpZGVudGUvZ2l0ZWEtYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGdpdGVhIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnZ2l0ZWFfZmFpbGVkX2F1dGgnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXIKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogZ2l0ZWEKICBiZWhhdmlvcjogInZjczpicnV0ZWZvcmNlIgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiR2l0ZWEgVXNlciBFbnVtZXJhdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect gitea bruteforce", "author": "LePresidente", "labels": { - "remediation": "true", + "behavior": "vcs:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Gitea Bruteforce", + "remediation": true, "service": "gitea", - "type": "bruteforce" + "spoofable": 0 } }, "LePresidente/grafana-bf": { "path": "scenarios/LePresidente/grafana-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "f2b73db0cdd22c800e107a8dd0ab81d55bca7379a36f04dd26951dbebe9db1bb", "deprecated": false + }, + "0.2": { + "digest": "46b13a1c833edb5dc62f2c23d642eeaa1bdcb9c9e71bb890054cf2db3346652c", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBHcmFmYW5hIGF1dGhlbnRpY2F0aW9uczoKCiAtIGxlYWtzcGVlZCBvZiAxbSwgY2FwYWNpdHkgb2YgNSBvbiBzYW1lIHRhcmdldCBpcA==", - "content": "IyBncmFmYW5hIEJGIHNjYW4KbmFtZTogTGVQcmVzaWRlbnRlL2dyYWZhbmEtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgZ3JhZmFuYSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnZ3JhZmFuYV9mYWlsZWRfYXV0aCciCiNkZWJ1ZzogdHJ1ZQp0eXBlOiBsZWFreQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAiMjBzIgpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBncmFmYW5hCiAgdHlwZTogYnJ1dGVmb3JjZQogIHJlbWVkaWF0aW9uOiB0cnVl", + "content": "IyBncmFmYW5hIEJGIHNjYW4KbmFtZTogTGVQcmVzaWRlbnRlL2dyYWZhbmEtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgZ3JhZmFuYSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnZ3JhZmFuYV9mYWlsZWRfYXV0aCciCiNkZWJ1ZzogdHJ1ZQp0eXBlOiBsZWFreQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAiMjBzIgpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBncmFmYW5hCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBsYWJlbDogIkdyYWZhbmEgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect grafana bruteforce", "author": "LePresidente", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Grafana Bruteforce", + "remediation": true, "service": "grafana", - "type": "bruteforce" + "spoofable": 0 } }, "LePresidente/harbor-bf": { "path": "scenarios/LePresidente/harbor-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "25f208be5fdb655805f5b9baed7784d6b0be07421f9c36d53b85400a778f9e3c", "deprecated": false + }, + "0.2": { + "digest": "a103754c82c2d9bd394229759091cdbda5f0cdfff89ed1a1acc1422197249432", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBoYXJib3IgYXV0aGVudGljYXRpb25zOgoKIC0gbGVha3NwZWVkIG9mIDIwcywgY2FwYWNpdHkgb2YgNSBvbiBzYW1lIHRhcmdldCB1c2VyCiAtIGxlYWtzcGVlZCBvZiAxbSwgY2FwYWNpdHkgb2YgNSB1bmlxdWUgZGlzdGluY3QgdXNlcnM=", - "content": "IyBoYXJib3IgQkYgc2NhbgpuYW1lOiBMZVByZXNpZGVudGUvaGFyYm9yLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGhhcmJvciBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnaGFyYm9yX2ZhaWxlZF9hdXRoJyIKI2RlYnVnOiB0cnVlCnR5cGU6IGxlYWt5Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApsZWFrc3BlZWQ6ICIyMHMiCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGhhcmJvcgogIHR5cGU6IGJydXRlZm9yY2UKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBoYXJib3IgdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6ICBMZVByZXNpZGVudGUvaGFyYm9yLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBoYXJib3IgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdoYXJib3JfZmFpbGVkX2F1dGgnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXIKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiBzZXJ2aWNlOiBoYXJib3IKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "IyBoYXJib3IgQkYgc2NhbgpuYW1lOiBMZVByZXNpZGVudGUvaGFyYm9yLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGhhcmJvciBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnaGFyYm9yX2ZhaWxlZF9hdXRoJyIKI2RlYnVnOiB0cnVlCnR5cGU6IGxlYWt5Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApsZWFrc3BlZWQ6ICIyMHMiCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGhhcmJvcgogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgbGFiZWw6ICJIYXJib3IgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBoYXJib3IgdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6IExlUHJlc2lkZW50ZS9oYXJib3ItYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGhhcmJvciB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2hhcmJvcl9mYWlsZWRfYXV0aCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcgpsZWFrc3BlZWQ6IDEwcwpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBoYXJib3IKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU4OQogICAgLSBhdHRhY2suVDExMTAKICBsYWJlbDogIkhhcmJvciBVc2VyIEVudW1lcmF0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect harbor bruteforce", "author": "LePresidente", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Harbor Bruteforce", + "remediation": true, "service": "harbor", - "type": "bruteforce" + "spoofable": 0 } }, "LePresidente/jellyfin-bf": { "path": "scenarios/LePresidente/jellyfin-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "e84cce05fb525b5f43f34171fb8a3eeca55ae5a7e5553d59fd9004472188706e", "deprecated": false + }, + "0.2": { + "digest": "adc51e35b2fe0f667938d7ddea7bd9fd5ff9f48c1ac3438b871130c0be251689", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBqZWxseWZpbiBhdXRoZW50aWNhdGlvbnM6CgogLSBsZWFrc3BlZWQgb2YgMjBzLCBjYXBhY2l0eSBvZiA1IG9uIHNhbWUgdGFyZ2V0IHVzZXIKIC0gbGVha3NwZWVkIG9mIDFtLCBjYXBhY2l0eSBvZiA1IHVuaXF1ZSBkaXN0aW5jdCB1c2Vycw==", - "content": "IyBqZWxseWZpbiBCRiBzY2FuCm5hbWU6IExlUHJlc2lkZW50ZS9qZWxseWZpbi1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBqZWxseWZpbiBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnamVsbHlmaW5fZmFpbGVkX2F1dGgnIgojZGVidWc6IHRydWUKdHlwZTogbGVha3kKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmxlYWtzcGVlZDogIjIwcyIKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogamVsbHlmaW4KICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgamVsbHlmaW4gdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6ICBMZVByZXNpZGVudGUvamVsbHlmaW4tYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGplbGx5ZmluIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnamVsbHlmaW5fZmFpbGVkX2F1dGgnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXIKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiBzZXJ2aWNlOiBqZWxseWZpbgogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUK", + "content": "IyBqZWxseWZpbiBCRiBzY2FuCm5hbWU6IExlUHJlc2lkZW50ZS9qZWxseWZpbi1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBqZWxseWZpbiBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnamVsbHlmaW5fZmFpbGVkX2F1dGgnIgojZGVidWc6IHRydWUKdHlwZTogbGVha3kKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmxlYWtzcGVlZDogIjIwcyIKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogamVsbHlmaW4KICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGxhYmVsOiAiSmVsbHlmaW4gQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBqZWxseWZpbiB1c2VyLWVudW0KdHlwZTogbGVha3kKbmFtZTogTGVQcmVzaWRlbnRlL2plbGx5ZmluLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBqZWxseWZpbiB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2plbGx5ZmluX2ZhaWxlZF9hdXRoJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VyCmxlYWtzcGVlZDogMTBzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGplbGx5ZmluCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1ODkKICAgIC0gYXR0YWNrLlQxMTEwCiAgbGFiZWw6ICJIYXJib3IgVXNlciBFbnVtZXJhdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect jellyfin bruteforce", "author": "LePresidente", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Jellyfin Bruteforce", + "remediation": true, "service": "jellyfin", - "type": "bruteforce" + "spoofable": 0 } }, "LePresidente/jellyseerr-bf": { "path": "scenarios/LePresidente/jellyseerr-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "d21fcd58a65208cd0d37d005e13b3ba242f169ee71a8a8c2b6d4c4011f4d1c98", "deprecated": false + }, + "0.2": { + "digest": "230e8b4b1ef48c3cb5f83ccc66ca29e38d83f4116079f22cb13033e0c7e40bc8", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBqZWxseXNlZXJyIGF1dGhlbnRpY2F0aW9uczoKCiAtIGxlYWtzcGVlZCBvZiAyMHMsIGNhcGFjaXR5IG9mIDUgb24gc2FtZSB0YXJnZXQgdXNlcgogLSBsZWFrc3BlZWQgb2YgMW0sIGNhcGFjaXR5IG9mIDUgdW5pcXVlIGRpc3RpbmN0IHVzZXJz", - "content": "IyBqZWxseXNlZXJyIEJGIHNjYW4KbmFtZTogTGVQcmVzaWRlbnRlL2plbGx5c2VlcnItYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgamVsbHlzZWVyciBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnamVsbHlzZWVycl9mYWlsZWRfYXV0aCciCiNkZWJ1ZzogdHJ1ZQp0eXBlOiBsZWFreQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAiMjBzIgpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBqZWxseXNlZXJyCiAgdHlwZTogYnJ1dGVmb3JjZQogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIGplbGx5c2VlcnIgdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6ICBMZVByZXNpZGVudGUvamVsbHlzZWVyci1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgamVsbHlzZWVyciB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2plbGx5c2VlcnJfZmFpbGVkX2F1dGgnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXIKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiBzZXJ2aWNlOiBqZWxseXNlZXJyCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyBqZWxseXNlZXJyIEJGIHNjYW4KbmFtZTogTGVQcmVzaWRlbnRlL2plbGx5c2VlcnItYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgamVsbHlzZWVyciBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnamVsbHlzZWVycl9mYWlsZWRfYXV0aCciCiNkZWJ1ZzogdHJ1ZQp0eXBlOiBsZWFreQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAiMjBzIgpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBqZWxseXNlZXJyCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBsYWJlbDogIkplbGx5c2VlcnIgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBqZWxseXNlZXJyIHVzZXItZW51bQp0eXBlOiBsZWFreQpuYW1lOiBMZVByZXNpZGVudGUvamVsbHlzZWVyci1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgamVsbHlzZWVyciB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2plbGx5c2VlcnJfZmFpbGVkX2F1dGgnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXIKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogamVsbHlzZWVycgogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiSmVsbHlzZWVyciBVc2VyIEVudW1lcmF0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect jellyseerr bruteforce", "author": "LePresidente", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Jellyseerr Bruteforce", + "remediation": true, "service": "jellyseerr", - "type": "bruteforce" + "spoofable": 0 } }, "LePresidente/ombi-bf": { "path": "scenarios/LePresidente/ombi-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "20d3c7bf14fa9c1a6b43a00d219c933846d36d7ec8d4306659aaad6a3873a6eb", "deprecated": false + }, + "0.2": { + "digest": "57fdcee57a59e2858e2eb25e60004d4a9910ed20c2856443eda997a3153a2300", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBlbWJ5IGF1dGhlbnRpY2F0aW9uczoKCiAtIGxlYWtzcGVlZCBvZiAxbSwgY2FwYWNpdHkgb2YgNSBvbiBzYW1lIHRhcmdldCBpcA==", - "content": "IyBlbWJ5IGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogTGVQcmVzaWRlbnRlL29tYmktYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgT21iaSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnb21iaV9hdXRoX2ZhaWxlZCciCmxlYWtzcGVlZDogMW0KY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKIHNlcnZpY2U6IG9tYmkKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "IyBlbWJ5IGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogTGVQcmVzaWRlbnRlL29tYmktYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgT21iaSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnb21iaV9hdXRoX2ZhaWxlZCciCmxlYWtzcGVlZDogMW0KY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBvbWJpCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBsYWJlbDogIk9tYmkgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect Ombi bruteforce", "author": "LePresidente", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Ombi Bruteforce", + "remediation": true, "service": "ombi", - "type": "bruteforce" + "spoofable": 0 } }, "LePresidente/redmine-bf": { "path": "scenarios/LePresidente/redmine-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "85e4eb99ed510675a3b9080958f5000e5c7564e63bd3fa180be3a5757620ec8e", "deprecated": false + }, + "0.2": { + "digest": "d12851449afd02091b0d5838de8daebbc6cc81847cfb26a1afed2c6eb2b4f176", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBSZWRtaW5lIGF1dGhlbnRpY2F0aW9uczoKCiAtIGxlYWtzcGVlZCBvZiAyMHMsIGNhcGFjaXR5IG9mIDUgb24gc2FtZSB0YXJnZXQgdXNlcgogLSBsZWFrc3BlZWQgb2YgMW0sIGNhcGFjaXR5IG9mIDUgdW5pcXVlIGRpc3RpbmN0IHVzZXJz", - "content": "ICMgUmVkbWluZSBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IExlUHJlc2lkZW50ZS9yZWRtaW5lLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFJlZG1pbmUgYnJ1dGVmb3JjZSBhdHRhY2tzIiAKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3JlZG1pbmVfZmFpbGVkX2F1dGgnIgpsZWFrc3BlZWQ6IDFtCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiBzZXJ2aWNlOiByZWRtaW5lCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBSZWRtaW5lIHVzZXItZW51bQp0eXBlOiBsZWFreQpuYW1lOiAgTGVQcmVzaWRlbnRlL3JlZG1pbmUtYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFJlZG1pbmUgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdyZWRtaW5lX2ZhaWxlZF9hdXRoJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VyCmxlYWtzcGVlZDogMTBzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogc2VydmljZTogcmVkbWluZQogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUK", + "content": "IyBSZWRtaW5lIGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogTGVQcmVzaWRlbnRlL3JlZG1pbmUtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgUmVkbWluZSBicnV0ZWZvcmNlIGF0dGFja3MiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdyZWRtaW5lX2ZhaWxlZF9hdXRoJyIKbGVha3NwZWVkOiAxbQpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IHJlZG1pbmUKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgbGFiZWw6ICJSZWRtaW5lIEJydXRlZm9yY2UiCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIFJlZG1pbmUgdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6IExlUHJlc2lkZW50ZS9yZWRtaW5lLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBSZWRtaW5lIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAncmVkbWluZV9mYWlsZWRfYXV0aCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcgpsZWFrc3BlZWQ6IDEwcwpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiByZWRtaW5lCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1ODkKICAgIC0gYXR0YWNrLlQxMTEwCiAgbGFiZWw6ICJSZWRtaW5lIEVudW1lcmF0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect Redmine bruteforce attacks", "author": "LePresidente", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Redmine Bruteforce", + "remediation": true, "service": "redmine", - "type": "bruteforce" + "spoofable": 0 } }, "LePresidente/ssh-bad-keyexchange-bf": { "path": "scenarios/LePresidente/ssh-bad-keyexchange-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "654f4cd2d1f53a60423647e3d8ec38cde2e27a7b8495c44204f001f5f5485430", "deprecated": false + }, + "0.2": { + "digest": "3c1b4148eedb8f632dc80ed11a186c7d534ce23533367ab3c8e3cd06345d6a2a", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBzc2ggS2V5IEV4Y2hhbmdlcyA6CgogLSBsZWFrc3BlZWQgb2YgMTBzLCBjYXBhY2l0eSBvZiA1IG9uIHNhbWUgdGFyZ2V0IGlwCiAK", - "content": "IyBzc2ggYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBsZXByZXNpZGVudGUvc3NoLWJhZC1rZXlleGNoYW5nZS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBzc2ggYmFkIGtleSBleGNoYW5nZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3NzaF9iYWRfa2V5ZXhjaGFuZ2UnIgpsZWFrc3BlZWQ6ICIxMHMiCnJlZmVyZW5jZXM6CiAgLSBodHRwOi8vd2lraXBlZGlhLmNvbS9zc2gtYmYtaXMtYmFkCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiBzZXJ2aWNlOiBzc2gKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCgo=", + "content": "IyBzc2ggYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBsZXByZXNpZGVudGUvc3NoLWJhZC1rZXlleGNoYW5nZS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBzc2ggYmFkIGtleSBleGNoYW5nZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3NzaF9iYWRfa2V5ZXhjaGFuZ2UnIgpsZWFrc3BlZWQ6ICIxMHMiCnJlZmVyZW5jZXM6CiAgLSBodHRwOi8vd2lraXBlZGlhLmNvbS9zc2gtYmYtaXMtYmFkCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgc2VydmljZTogc3NoCiAgYmVoYXZpb3I6ICJzc2g6YnJ1dGVmb3JjZSIKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIHJlbWVkaWF0aW9uOiB0cnVlCiAgbGFiZWw6ICJTU0ggQmFkIEtleSBCcnV0ZWZvcmNlIgo=", "description": "Detect ssh bad key exchange", "author": "LePresidente", "references": [ "http://wikipedia.com/ssh-bf-is-bad" ], "labels": { - "remediation": "true", + "behavior": "ssh:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "SSH Bad Key Bruteforce", + "remediation": true, "service": "ssh", - "type": "bruteforce" + "spoofable": 0 } }, "MariuszKociubinski/bitwarden-bf": { "path": "scenarios/MariuszKociubinski/bitwarden-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "43e83e367af5eba9d525953587a65905e109057fac7a52e68ce04606a01e8b23", "deprecated": false + }, + "0.2": { + "digest": "d68d05489f98eb1194c0935d043f9cd760cadf07fc53308ae640ce7efe250356", + "deprecated": false } }, - "content": "IyBiaXR3YXJkZW4gYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBNYXJpdXN6S29jaXViaW5za2kvYml0d2FyZGVuLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGJpdHdhcmRlbiBicnV0ZWZvcmNlIgpkZWJ1ZzogZmFsc2UKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWydiaXR3YXJkZW5fZmFpbGVkX2F1dGgnLCdiaXR3YXJkZW5fZmFpbGVkX2F1dGhfMmZhJ10iCiAgI2ZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdiaXR3YXJkZW5fZmFpbGVkX2F1dGgnIgpsZWFrc3BlZWQ6ICIxbSIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KcmVwcm9jZXNzOiBmYWxzZQpsYWJlbHM6CiAgc2VydmljZTogYml0d2FyZGVuCiAgdHlwZTogYnJ1dGVmb3JjZQogIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "IyBiaXR3YXJkZW4gYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBNYXJpdXN6S29jaXViaW5za2kvYml0d2FyZGVuLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGJpdHdhcmRlbiBicnV0ZWZvcmNlIgpkZWJ1ZzogZmFsc2UKZmlsdGVyOgogICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2JpdHdhcmRlbl9mYWlsZWRfYXV0aCcsJ2JpdHdhcmRlbl9mYWlsZWRfYXV0aF8yZmEnXSIKICAjZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2JpdHdhcmRlbl9mYWlsZWRfYXV0aCciCmxlYWtzcGVlZDogIjFtIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpyZXByb2Nlc3M6IGZhbHNlCmxhYmVsczoKICBzZXJ2aWNlOiBiaXR3YXJkZW4KICBiZWhhdmlvcjogImdlbmVyaWM6YnJ1dGVmb3JjZSIKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgbGFiZWw6ICJCaXR3YXJkZW4gVXNlciBFbnVtZXJhdGlvbiIKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect bitwarden bruteforce", "author": "MariuszKociubinski", "labels": { - "remediation": "true", + "behavior": "generic:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Bitwarden User Enumeration", + "remediation": true, "service": "bitwarden", - "type": "bruteforce" + "spoofable": 0 } }, "a1ad/meshcentral-bf": { "path": "scenarios/a1ad/meshcentral-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "f9c23983ecdee70491e334732b2cb2ba7ef5fb61a5d119951930ba5b7cb93e51", "deprecated": false + }, + "0.2": { + "digest": "bfa1db16802b90bf3648ca8f59c75fec48b297b65c30c01608bff71e8ee2e2cf", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBtZXNoY2VudHJhbCBhdXRoZW50aWNhdGlvbnM6CgogLSBsZWFrc3BlZWQgb2YgMjBzLCBjYXBhY2l0eSBvZiA1IG9uIHNhbWUgdGFyZ2V0IHVzZXIKIC0gbGVha3NwZWVkIG9mIDFtLCBjYXBhY2l0eSBvZiA1IHVuaXF1ZSBkaXN0aW5jdCB1c2Vycwo=", - "content": "IyBtZXNoY2VudHJhbCBCRiBzY2FuCm5hbWU6IGExYWQvbWVzaGNlbnRyYWwtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgbWVzaGNlbnRyYWwgYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21lc2hjZW50cmFsX2ZhaWxlZF9hdXRoJyIKI2RlYnVnOiB0cnVlCnR5cGU6IGxlYWt5Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApsZWFrc3BlZWQ6ICIyMHMiCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IG1lc2hjZW50cmFsCiAgdHlwZTogYnJ1dGVmb3JjZQogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIG1lc2hjZW50cmFsIHVzZXItZW51bQp0eXBlOiBsZWFreQpuYW1lOiAgYTFhZC9tZXNoY2VudHJhbC1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgbWVzaGNlbnRyYWwgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdtZXNoY2VudHJhbF9mYWlsZWRfYXV0aCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcgpsZWFrc3BlZWQ6IDEwcwpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKIHNlcnZpY2U6IG1lc2hjZW50cmFsCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyBtZXNoY2VudHJhbCBCRiBzY2FuCm5hbWU6IGExYWQvbWVzaGNlbnRyYWwtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgbWVzaGNlbnRyYWwgYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21lc2hjZW50cmFsX2ZhaWxlZF9hdXRoJyIKI2RlYnVnOiB0cnVlCnR5cGU6IGxlYWt5Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApsZWFrc3BlZWQ6ICIyMHMiCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IG1lc2hjZW50cmFsCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBsYWJlbDogIk1lc2hDZW50cmFsIEJydXRlZm9yY2UiCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgbWVzaGNlbnRyYWwgdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6IGExYWQvbWVzaGNlbnRyYWwtYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG1lc2hjZW50cmFsIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnbWVzaGNlbnRyYWxfZmFpbGVkX2F1dGgnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXIKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogbWVzaGNlbnRyYWwKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgICAtIGF0dGFjay5UMTExMAogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBsYWJlbDogIk1lc2hDZW50cmFsIFVzZXIgRW51bWVyYXRpb24iCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect meshcentral bruteforce", "author": "a1ad", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "MeshCentral Bruteforce", + "remediation": true, "service": "meshcentral", - "type": "bruteforce" + "spoofable": 0 } }, "a1ad/mikrotik-bf": { "path": "scenarios/a1ad/mikrotik-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "186b0c6b7fe346e3e3843e90135735ed0195233abd5e5a2a06b3420275ef9e2d", "deprecated": false + }, + "0.2": { + "digest": "69a55380db43a066268c70ba1d0a3934e6188b4669337c091d2898b398cdcbad", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBNaWtyb3RpayBhdXRoZW50aWNhdGlvbnM6CgogLSBsZWFrc3BlZWQgb2YgMjBzLCBjYXBhY2l0eSBvZiA1IG9uIHNhbWUgdGFyZ2V0IHVzZXIKIC0gbGVha3NwZWVkIG9mIDFtLCBjYXBhY2l0eSBvZiA1IHVuaXF1ZSBkaXN0aW5jdCB1c2Vycwo=", - "content": "IyBNaWtyb3RpayBCRiBzY2FuCm5hbWU6IGExYWQvbWlrcm90aWstYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgTWlrcm90aWsgYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21pa3JvdGlrX2ZhaWxlZF9hdXRoJyIKI2RlYnVnOiB0cnVlCnR5cGU6IGxlYWt5Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApsZWFrc3BlZWQ6ICIyMHMiCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IG1pa3JvdGlrCiAgdHlwZTogYnJ1dGVmb3JjZQogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIG1lc2hjZW50cmFsIHVzZXItZW51bQp0eXBlOiBsZWFreQpuYW1lOiAgYTFhZC9taWtyb3Rpay1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgbWlrcm90aWsgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdtaWtyb3Rpa19mYWlsZWRfYXV0aCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcgpsZWFrc3BlZWQ6IDEwcwpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKIHNlcnZpY2U6IG1pa3JvdGlrCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyBNaWtyb3RpayBCRiBzY2FuCm5hbWU6IGExYWQvbWlrcm90aWstYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgTWlrcm90aWsgYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21pa3JvdGlrX2ZhaWxlZF9hdXRoJyIKI2RlYnVnOiB0cnVlCnR5cGU6IGxlYWt5Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApsZWFrc3BlZWQ6ICIyMHMiCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IG1pa3JvdGlrCiAgYmVoYXZpb3I6ICJpb3Q6YnJ1dGVmb3JjZSIKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGxhYmVsOiAiTWlrcm90aWsgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBtZXNoY2VudHJhbCB1c2VyLWVudW0KdHlwZTogbGVha3kKbmFtZTogYTFhZC9taWtyb3Rpay1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgbWlrcm90aWsgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdtaWtyb3Rpa19mYWlsZWRfYXV0aCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcgpsZWFrc3BlZWQ6IDEwcwpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBtaWtyb3RpawogIGJlaGF2aW9yOiAiaW90OmJydXRlZm9yY2UiCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU4OQogICAgLSBhdHRhY2suVDExMTAKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgbGFiZWw6ICJNaWtyb3RpayBVc2VyIEVudW1lcmF0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect Mikrotik bruteforce", "author": "a1ad", "labels": { - "remediation": "true", + "behavior": "iot:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Mikrotik Bruteforce", + "remediation": true, "service": "mikrotik", - "type": "bruteforce" + "spoofable": 0 } }, "a1ad/mikrotik-scan-multi_ports": { "path": "scenarios/a1ad/mikrotik-scan-multi_ports.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "eb9e82a3f0179f4e407b91e618dc960da0bf7244f018dc2bd5cee181035e1d3a", "deprecated": false + }, + "0.2": { + "digest": "aabd6503e4b3f1974760e168872ba557927ede9a5e516777dc49d0c872314fc3", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBhIHBvcnQgc2NhbiA6IGRldGVjdHMgaWYgYSBzaW5nbGUgSVAgYXR0ZW1wdHMgY29ubmVjdGlvbiB0byBtYW55IGRpZmZlcmVudCBwb3J0cy4KCkxlYWtzcGVlZCBvZiA1cywgY2FwYWNpdHkgb2YgMTUuCg==", - "content": "dHlwZTogbGVha3kKbmFtZTogYTFhZC9taWtyb3Rpay1zY2FuLW11bHRpX3BvcnRzCmRlc2NyaXB0aW9uOiAiYmFuIElQcyB0aGF0IGFyZSBzY2FubmluZyB1cyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21pa3JvdGlrX2Ryb3AnICYmIGV2dC5NZXRhLnNlcnZpY2UgPT0gJ3RjcF91ZHAnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5QYXJzZWQuZHN0X3BvcnQKY2FwYWNpdHk6IDE1CmxlYWtzcGVlZDogNXMKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogdGNwX3VkcAogIHR5cGU6IHNjYW4KICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKbmFtZTogYTFhZC9taWtyb3Rpay1zY2FuLW11bHRpX3BvcnRzCmRlc2NyaXB0aW9uOiAiYmFuIElQcyB0aGF0IGFyZSBzY2FubmluZyB1cyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21pa3JvdGlrX2Ryb3AnICYmIGV2dC5NZXRhLnNlcnZpY2UgPT0gJ3RjcF91ZHAnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5QYXJzZWQuZHN0X3BvcnQKY2FwYWNpdHk6IDE1CmxlYWtzcGVlZDogNXMKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogbWlrcm90aWsKICBiZWhhdmlvcjogInRjcDpzY2FuIgogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUuMDAxCiAgICAtIGF0dGFjay5UMTAxOAogICAgLSBhdHRhY2suVDEwNDYKICBzcG9vZmFibGU6IDIKICBjb25maWRlbmNlOiAxCiAgbGFiZWw6ICJNaWtyb3RpayBQb3J0IFNjYW5uaW5nIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "ban IPs that are scanning us", "author": "a1ad", "labels": { - "remediation": "true", - "service": "tcp_udp", - "type": "scan" + "behavior": "tcp:scan", + "classification": [ + "attack.T1595.001", + "attack.T1018", + "attack.T1046" + ], + "confidence": 1, + "label": "Mikrotik Port Scanning", + "remediation": true, + "service": "mikrotik", + "spoofable": 2 } }, "andreasbrett/baikal-bf": { "path": "scenarios/andreasbrett/baikal-bf.yaml", - "version": "0.1", + "version": "0.5", "versions": { "0.1": { "digest": "6e560fc2a7297c34acf8b4a1310d99f8aaaafa8c3d72698cd3812d3d5a2c73d6", "deprecated": false + }, + "0.2": { + "digest": "5a05fcd4f832c12defc47cb1bb2e214ee686305e8d7d643ad25969a661cb2c4f", + "deprecated": false + }, + "0.3": { + "digest": "a0cdfd365b1ac0406e4a66317e7e0924826cd5f1be41ec906597cc56f4591c0f", + "deprecated": false + }, + "0.4": { + "digest": "dba7a79d5cb51283c1da9c5d12570895a6cac01326109ee332bada785a7308b8", + "deprecated": false + }, + "0.5": { + "digest": "5a05fcd4f832c12defc47cb1bb2e214ee686305e8d7d643ad25969a661cb2c4f", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBCYWlrYWwgYXV0aGVudGljYXRpb25zOgoKLSAgIGxlYWtzcGVlZCBvZiAxbSwgY2FwYWNpdHkgb2YgNSBvbiBzb3VyY2UgaXAKLSAgIGxlYWtzcGVlZCBvZiAxbSwgY2FwYWNpdHkgb2YgNSBvbiBzb3VyY2UgaXAgYW5kIHVuaXF1ZSBkaXN0aW5jdCB1c2Vycwo=", - "content": "IyBCYWlrYWwgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBhbmRyZWFzYnJldHQvYmFpa2FsLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEJhaWthbCBicnV0ZWZvcmNlIGF0dGFja3MiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlIGluIFsnYmFpa2FsX2ZhaWxlZF9hdXRoJywgJ2JhaWthbF9mYWlsZWRfYXV0aF9ub191c2VyJ10iCmxlYWtzcGVlZDogMW0KY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICAgIHNlcnZpY2U6IGJhaWthbAogICAgdHlwZTogYnJ1dGVmb3JjZQogICAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgQmFpa2FsIHVzZXItZW51bSAob25seSBmb3Igd2ViIFVJIHNpbmNlIEJhaWthbCBkb2Vzbid0IGxvZyBmYWlsZWQgdXNlcm5hbWUgZm9yIENhbERBVi9DYXJkREFWIGFjY2VzcykKdHlwZTogbGVha3kKbmFtZTogYW5kcmVhc2JyZXR0L2JhaWthbC1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgQmFpa2FsIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnYmFpa2FsX2ZhaWxlZF9hdXRoJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VybmFtZQpsZWFrc3BlZWQ6IDFtCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogNW0KbGFiZWxzOgogICAgc2VydmljZTogYmFpa2FsCiAgICB0eXBlOiBicnV0ZWZvcmNlCiAgICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyBCYWlrYWwgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBhbmRyZWFzYnJldHQvYmFpa2FsLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEJhaWthbCBicnV0ZWZvcmNlIGF0dGFja3MiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlIGluIFsnYmFpa2FsX2ZhaWxlZF9hdXRoJywgJ2JhaWthbF9mYWlsZWRfYXV0aF9ub191c2VyJ10iCmxlYWtzcGVlZDogMW0KY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICAgIHNlcnZpY2U6IGJhaWthbAogICAgdHlwZTogYnJ1dGVmb3JjZQogICAgY2xhc3NpZmljYXRpb246CiAgICAgIC0gYXR0YWNrLlQxMTEwCiAgICByZW1lZGlhdGlvbjogdHJ1ZQogICAgYmVoYXZpb3I6IGh0dHA6YnJ1dGVmb3JjZQogICAgc3Bvb2ZhYmxlOiAwCiAgICBjb25maWRlbmNlOiAzCi0tLQojIEJhaWthbCB1c2VyLWVudW0gKG9ubHkgZm9yIHdlYiBVSSBzaW5jZSBCYWlrYWwgZG9lc24ndCBsb2cgZmFpbGVkIHVzZXJuYW1lIGZvciBDYWxEQVYvQ2FyZERBViBhY2Nlc3MpCnR5cGU6IGxlYWt5Cm5hbWU6IGFuZHJlYXNicmV0dC9iYWlrYWwtYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEJhaWthbCB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2JhaWthbF9mYWlsZWRfYXV0aCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcm5hbWUKbGVha3NwZWVkOiAxbQpjYXBhY2l0eTogNQpibGFja2hvbGU6IDVtCmxhYmVsczoKICAgIHNlcnZpY2U6IGJhaWthbAogICAgdHlwZTogYnJ1dGVmb3JjZQogICAgcmVtZWRpYXRpb246IHRydWUKICAgIGJlaGF2aW9yOiBodHRwOmJydXRlZm9yY2UKICAgIHNwb29mYWJsZTogMAogICAgY29uZmlkZW5jZTogMwogICAgY2xhc3NpZmljYXRpb246CiAgICAgIC0gYXR0YWNrLlQxMTEw", "description": "Detect Baikal bruteforce attacks", "author": "andreasbrett", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "remediation": true, "service": "baikal", + "spoofable": 0, "type": "bruteforce" } }, "andreasbrett/paperless-ngx-bf": { "path": "scenarios/andreasbrett/paperless-ngx-bf.yaml", - "version": "0.1", + "version": "0.3", "versions": { "0.1": { "digest": "cbfdde07a106b2e72769f381490da31062b4789f4f1a5e35a6a168dca2354d74", "deprecated": false + }, + "0.2": { + "digest": "8f8c1e1a4554e30febf77fdce884ddeec79df20eb20ee5d33a563024acd3e013", + "deprecated": false + }, + "0.3": { + "digest": "db6ad37ca94b4d5390573129a9b86fa68068391ce216aa326f07b3a4c23d718f", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBQYXBlcmxlc3Mtbmd4IGF1dGhlbnRpY2F0aW9uczoKCi0gICBsZWFrc3BlZWQgb2YgMW0sIGNhcGFjaXR5IG9mIDUgb24gc291cmNlIGlwCi0gICBsZWFrc3BlZWQgb2YgMW0sIGNhcGFjaXR5IG9mIDUgb24gc291cmNlIGlwIGFuZCB1bmlxdWUgZGlzdGluY3QgdXNlcnMK", - "content": "IyBQYXBlcmxlc3Mtbmd4IGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogYW5kcmVhc2JyZXR0L3BhcGVybGVzcy1uZ3gtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgUGFwZXJsZXNzLW5neCBicnV0ZWZvcmNlIGF0dGFja3MiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdwYXBlcmxlc3Nfbmd4X2ZhaWxlZF9hdXRoJyIKbGVha3NwZWVkOiAxbQpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogICAgc2VydmljZTogcGFwZXJsZXNzLW5neAogICAgdHlwZTogYnJ1dGVmb3JjZQogICAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgUGFwZXJsZXNzLW5neCB1c2VyLWVudW0KdHlwZTogbGVha3kKbmFtZTogYW5kcmVhc2JyZXR0L3BhcGVybGVzcy1uZ3gtYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFBhcGVybGVzcy1uZ3ggdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdwYXBlcmxlc3Nfbmd4X2ZhaWxlZF9hdXRoJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VybmFtZQpsZWFrc3BlZWQ6IDFtCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogNW0KbGFiZWxzOgogICAgc2VydmljZTogcGFwZXJsZXNzLW5neAogICAgdHlwZTogYnJ1dGVmb3JjZQogICAgcmVtZWRpYXRpb246IHRydWUK", + "content": "IyBQYXBlcmxlc3Mtbmd4IGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogYW5kcmVhc2JyZXR0L3BhcGVybGVzcy1uZ3gtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgUGFwZXJsZXNzLW5neCBicnV0ZWZvcmNlIGF0dGFja3MiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdwYXBlcmxlc3Nfbmd4X2ZhaWxlZF9hdXRoJyIKbGVha3NwZWVkOiAxbQpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogICAgc2VydmljZTogcGFwZXJsZXNzLW5neAogICAgY29uZmlkZW5jZTogMwogICAgc3Bvb2ZhYmxlOiAwCiAgICBjbGFzc2lmaWNhdGlvbjoKICAgICAgICAtIGF0dGFjay5UMTExMAogICAgbGFiZWw6ICJQYXBlcmxlc3Mtbmd4IEJydXRlZm9yY2UiCiAgICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICAgIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIFBhcGVybGVzcy1uZ3ggdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6IGFuZHJlYXNicmV0dC9wYXBlcmxlc3Mtbmd4LWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBQYXBlcmxlc3Mtbmd4IHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAncGFwZXJsZXNzX25neF9mYWlsZWRfYXV0aCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcm5hbWUKbGVha3NwZWVkOiAxbQpjYXBhY2l0eTogNQpibGFja2hvbGU6IDVtCmxhYmVsczoKICAgIHNlcnZpY2U6IHBhcGVybGVzcy1uZ3gKICAgIGNvbmZpZGVuY2U6IDMKICAgIHNwb29mYWJsZTogMAogICAgY2xhc3NpZmljYXRpb246CiAgICAgICAgLSBhdHRhY2suVDE1ODkKICAgIGxhYmVsOiAiUGFwZXJsZXNzLW5neCBVc2VyIEVudW1lcmF0aW9uIgogICAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect Paperless-ngx bruteforce attacks", "author": "andreasbrett", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Paperless-ngx Bruteforce", + "remediation": true, "service": "paperless-ngx", - "type": "bruteforce" + "spoofable": 0 } }, "andreasbrett/webmin-bf": { "path": "scenarios/andreasbrett/webmin-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "565ea4cf8ba6add8648fac488c904e2283afe76fe5b41e9f6bddf29a92b50b7c", "deprecated": false + }, + "0.2": { + "digest": "0fa97ae9e9f79be63615dc34a6695cfe5c88a6f7d8d29ef28305593422ff58da", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBXZWJtaW4gYXV0aGVudGljYXRpb25zOgoKLSAgIGxlYWtzcGVlZCBvZiAxbSwgY2FwYWNpdHkgb2YgNSBvbiBzb3VyY2UgaXAKLSAgIGxlYWtzcGVlZCBvZiAxbSwgY2FwYWNpdHkgb2YgNSBvbiBzb3VyY2UgaXAgYW5kIHVuaXF1ZSBkaXN0aW5jdCB1c2Vycwo=", - "content": "IyBXZWJtaW4gYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBhbmRyZWFzYnJldHQvd2VibWluLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFdlYm1pbiBicnV0ZWZvcmNlIGF0dGFja3MiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICd3ZWJtaW5fZmFpbGVkX2F1dGhfd3JvbmdfcGFzcyciCmxlYWtzcGVlZDogMW0KY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICAgIHNlcnZpY2U6IHdlYm1pbgogICAgdHlwZTogYnJ1dGVmb3JjZQogICAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgV2VibWluIHVzZXItZW51bQp0eXBlOiBsZWFreQpuYW1lOiBhbmRyZWFzYnJldHQvd2VibWluLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBXZWJtaW4gdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICd3ZWJtaW5fZmFpbGVkX2F1dGhfd3JvbmdfcGFzcyciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcm5hbWUKbGVha3NwZWVkOiAxbQpjYXBhY2l0eTogNQpibGFja2hvbGU6IDVtCmxhYmVsczoKICAgIHNlcnZpY2U6IHdlYm1pbgogICAgdHlwZTogYnJ1dGVmb3JjZQogICAgcmVtZWRpYXRpb246IHRydWUK", + "content": "IyBXZWJtaW4gYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBhbmRyZWFzYnJldHQvd2VibWluLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFdlYm1pbiBicnV0ZWZvcmNlIGF0dGFja3MiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICd3ZWJtaW5fZmFpbGVkX2F1dGhfd3JvbmdfcGFzcyciCmxlYWtzcGVlZDogMW0KY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICAgIHNlcnZpY2U6IHdlYm1pbgogICAgY29uZmlkZW5jZTogMwogICAgc3Bvb2ZhYmxlOiAwCiAgICBjbGFzc2lmaWNhdGlvbjoKICAgICAgICAtIGF0dGFjay5UMTExMAogICAgbGFiZWw6ICJXZWJtaW4gQnJ1dGVmb3JjZSIKICAgIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogICAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgV2VibWluIHVzZXItZW51bQp0eXBlOiBsZWFreQpuYW1lOiBhbmRyZWFzYnJldHQvd2VibWluLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBXZWJtaW4gdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICd3ZWJtaW5fZmFpbGVkX2F1dGhfd3JvbmdfcGFzcyciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcm5hbWUKbGVha3NwZWVkOiAxbQpjYXBhY2l0eTogNQpibGFja2hvbGU6IDVtCmxhYmVsczoKICAgIHNlcnZpY2U6IHdlYm1pbgogICAgY29uZmlkZW5jZTogMwogICAgc3Bvb2ZhYmxlOiAwCiAgICBjbGFzc2lmaWNhdGlvbjoKICAgICAgICAtIGF0dGFjay5UMTU4OQogICAgbGFiZWw6ICJXZWJtaW4gQnJ1dGVmb3JjZSIKICAgIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogICAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect Webmin bruteforce attacks", "author": "andreasbrett", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Webmin Bruteforce", + "remediation": true, "service": "webmin", - "type": "bruteforce" + "spoofable": 0 } }, "baudneo/gotify-bf": { "path": "scenarios/baudneo/gotify-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "584f3cea147a6aca903f87b63d43bade9da0449c23b90efb26de9fa798d06fdb", "deprecated": false + }, + "0.2": { + "digest": "d6ed2ccf69900783b22537eac017528704b37de1872db95e1424689ef1b45554", + "deprecated": false } }, "long_description": "QnJ1dGVmb3JjZSBwcm90ZWN0aW9uIGZvciBHb3RpZnkgc2VydmVyLiAKCkxlYWsgc3BlZWQgb2YgMTAgc2Vjb25kcyB3aXRoIGEgY2FwYWNpdHkgb2YgNC4=", - "content": "dHlwZTogbGVha3kKbmFtZTogYmF1ZG5lby9nb3RpZnktYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgID09ICdnb3RpZnlfZmFpbGVkX2F1dGgnIgpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpjYXBhY2l0eTogNApsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogMW0KbGFiZWxzOgogc2VydmljZTogZ290aWZ5CiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogbGVha3kKbmFtZTogYmF1ZG5lby9nb3RpZnktYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgID09ICdnb3RpZnlfZmFpbGVkX2F1dGgnIgpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpjYXBhY2l0eTogNApsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGdvdGlmeQogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgbGFiZWw6ICJHb3RpZnkgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect bruteforce", "author": "baudneo", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Gotify Bruteforce", + "remediation": true, "service": "gotify", - "type": "bruteforce" + "spoofable": 0 } }, "baudneo/zoneminder-bf": { "path": "scenarios/baudneo/zoneminder-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "23f8a840d8341ffad8f70b787e7dc5c9ecbab0c3bcc91eaada7dffdc2a4613f7", "deprecated": false + }, + "0.2": { + "digest": "ba9fd1bb90d61bec138d023c07418c93e8cd5a0e030ab7e67e14c66443e7fb89", + "deprecated": false } }, "long_description": "QnJ1dGVmb3JjZS9Vc2VyIEVudW1lcmF0aW9uIHByb3RlY3Rpb24gZm9yIFpvbmVNaW5kZXIuCg==", - "content": "IyBsb2dpbmcgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBiYXVkbmVvL3pvbmVtaW5kZXItYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgWm9uZU1pbmRlciBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfc3VidHlwZSA9PSAnem1fYmFkX3Bhc3N3b3JkJyIKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKY2FwYWNpdHk6IDQKbGVha3NwZWVkOiAiMTBzIgpibGFja2hvbGU6IDFtCmxhYmVsczoKIHNlcnZpY2U6IHpvbmVtaW5kZXIKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIHVzZXIgZW51bQp0eXBlOiBsZWFreQpuYW1lOiBiYXVkbmVvL3pvbmVtaW5kZXItYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgWm9uZU1pbmRlciB1c2VyIGVudW1lcmF0aW9uIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfc3VidHlwZSA9PSAnem1fYmFkX3VzZXInIgpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpkaXN0aW5jdDogImV2dC5NZXRhLnVzZXJuYW1lIgpjYXBhY2l0eTogNApsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogMW0KbGFiZWxzOgogc2VydmljZTogem9uZW1pbmRlcgogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUK", + "content": "IyBsb2dpbmcgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBiYXVkbmVvL3pvbmVtaW5kZXItYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgWm9uZU1pbmRlciBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfc3VidHlwZSA9PSAnem1fYmFkX3Bhc3N3b3JkJyIKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKY2FwYWNpdHk6IDQKbGVha3NwZWVkOiAiMTBzIgpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiB6b25lbWluZGVyCiAgdHlwZTogYnJ1dGVmb3JjZQogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIlpvbmVtaW5kZXIgYnJ1dGVmb3JjZSIKLS0tCiMgdXNlciBlbnVtCnR5cGU6IGxlYWt5Cm5hbWU6IGJhdWRuZW8vem9uZW1pbmRlci1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBab25lTWluZGVyIHVzZXIgZW51bWVyYXRpb24iCmZpbHRlcjogImV2dC5NZXRhLmxvZ19zdWJ0eXBlID09ICd6bV9iYWRfdXNlciciCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmRpc3RpbmN0OiAiZXZ0Lk1ldGEudXNlcm5hbWUiCmNhcGFjaXR5OiA0CmxlYWtzcGVlZDogIjEwcyIKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogem9uZW1pbmRlcgogIHR5cGU6IGJydXRlZm9yY2UKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgcmVtZWRpYXRpb246IHRydWUKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiWm9uZW1pbmRlciB1c2VyIGVudW1lcmF0aW9uIgo=", "description": "Detect ZoneMinder bruteforce", "author": "baudneo", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Zoneminder bruteforce", + "remediation": true, "service": "zoneminder", + "spoofable": 0, "type": "bruteforce" } }, "baudneo/zoneminder_cve-2022-39285": { "path": "scenarios/baudneo/zoneminder_cve-2022-39285.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "ce8c950d3c51b1e3b1aa7f3b77d29e080a59b5cba2151057c4651a124b752216", "deprecated": false + }, + "0.2": { + "digest": "be09593bd2cf6c92f04b76d31958c4882e9d1a173594175868b348f7b0e1a016", + "deprecated": false } }, "long_description": "U2NlbmFyaW8gdG8gZGV0ZWN0IGV4cGxvaXRhdGlvbiBhdHRlbXB0cyBvZiBbQ1ZFLTIwMjItMzkyODVdKGh0dHBzOi8vZ2l0aHViLmNvbS9ab25lTWluZGVyL3pvbmVtaW5kZXIvc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLWg2eHAtY3Z3di1xNDMzKS4KQmFzaWNhbGx5IGRvIG5vdCBhbGxvdyBhbnkgUE9TVCByZXF1ZXN0cyBmb3IgaW5kZXgucGhwIHRvIGhhdmUgZmlsZT1bWFNTIHBheWxvYWRdLiBUaGlzIGlzIGZvciBaTSB2ZXJzaW9ucyBfX0JFRk9SRV9fIDEuMzYuMjcsIDEuMzcuMjQKCmBgYApQT1NUIC96bS9pbmRleC5waHAgSFRUUC8xLjEKSG9zdDogMTAuMC4xMC4xMDcKQ29udGVudC1MZW5ndGg6IDM3NwpBY2NlcHQ6IGFwcGxpY2F0aW9uL2pzb24sIHRleHQvamF2YXNjcmlwdCwgKi8qOyBxPTAuMDEKWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QKVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwMS4wLjQ5NTEuNDEgU2FmYXJpLzUzNy4zNgpDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZDsgY2hhcnNldD1VVEYtOApPcmlnaW46IGh0dHA6Ly8xMC4wLjEwLjEwNwpSZWZlcmVyOiBodHRwOi8vMTAuMC4xMC4xMDcvem0vCkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQpBY2NlcHQtTGFuZ3VhZ2U6IGVuLVVTLGVuO3E9MC45CkNvb2tpZTogem1Ta2luPWNsYXNzaWM7IHptQ1NTPWJhc2U7IHptQmFuZHdpZHRoPWhpZ2g7IFpNU0VTU0lEPXJhdWg1b2UzaTJ1YXIyNWVhbmlpcHEyZ2llCkNvbm5lY3Rpb246IGNsb3NlCgpfX2NzcmZfbWFnaWM9a2V5Ojc4ZWUyOThhNDU5MzI0M2I5YWM0ODExOTlkN2RhNDY4YmFiNGYwNDQsMTY2NDY3NTEyNSZ2aWV3PXJlcXVlc3QmcmVxdWVzdD1sb2cmdGFzaz1jcmVhdGUmbGV2ZWw9RVJSJm1lc3NhZ2U9VHJlbmNoZXMlMjBvZiUyMElUJTVCbmFtZSU1RD1DaHJvbWUmYnJvd3NlciU1QnZlcnNpb24lNUQ9MTAxLjAuNDk1MS40MSZicm93c2VyJTVCcGxhdGZvcm0lNUQ9V2luZG93cyZmaWxlPWh0dHAlM0ElMkYlMkYxMC4wLjEwLjEwNyUyRnptJTJGJmx0Oy90ZCZndDsmbHQ7L3RyJmd0OyZsdDtzY3JpcHQgc3JjPScvem0vP3ZpZXc9b3B0aW9ucyUyNnRhYj11c2VycyUyNmFjdGlvbj1kZWxldGUlMjZtYXJrVWlkcyU1QiU1RD02JTI2ZGVsZXRlQnRuPURlbGV0ZScmbHQ7L3NjcmlwdCZndDsmbGluZT03MApgYGAKCjp3YXJuaW5nOiBDcm93ZHNlYyBpcyBub3QgYSBXQUYgYW5kLCBhcyBzdWNoLCBieXBhc3MgdG8gdGhvc2Ugc2lnbmF0dXJlcyBhcmUgbGlrZWx5IDp3YXJuaW5nOgoKCgoKCg==", - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKIyAgZmlsZT1odHRwJTNBJTJGJTJGMTAuMC4xMC4xMDclMkZ6bSUyRiZsdDsvdGQmZ3Q7Jmx0Oy90ciZndDsmbHQ7c2NyaXB0IHNyYz0nL3ptLz92aWV3PW9wdGlvbnMlMjZ0YWI9dXNlcnMlMjZhY3Rpb249ZGVsZXRlJTI2bWFya1VpZHMlNUIlNUQ9NiUyNmRlbGV0ZUJ0bj1EZWxldGUnJmx0Oy9zY3JpcHQmZ3Q7JmxpbmU9NzAKbmFtZTogYmF1ZG5lby96b25lbWluZGVyX2N2ZS0yMDIyLTM5Mjg1CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDIyLTM5Mjg1IGV4cGxvaXRhdGlvbiBhdHRlbXB0cyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWyJodHRwX2FjY2Vzcy1sb2ciLCAiaHR0cF9lcnJvci1sb2ciXQogIGFuZCAKICAgICgKICAgICAgKCBVcHBlcihldnQuTWV0YS5odHRwX3ZlcmIpID09ICJQT1NUIiBhbmQKICAgICAgICAgIFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgbWF0Y2hlcyBVcHBlcignXig/UDxwYXRoPi8uKmluZGV4LnBocCk/LiooP1A8ZmlsZV9xdWVyeT5maWxlPS4qJmx0Oy90ZCZndDsmbHQ7L3RyKD9QPHBheWxvYWQ+LiopJmd0OyknKQogICAgICApCiAgICAgIG9yIAogICAgICBVcHBlcihldnQuUGFyc2VkLnJhd3JlcXVlc3QpIG1hdGNoZXMgVXBwZXIoJ14oP1A8dmVyYj5QT1NUKSAoP1A8cGF0aD4vLippbmRleC5waHApPy4qKD9QPGZpbGVfcXVlcnk+ZmlsZT0uKiZsdDsvdGQmZ3Q7Jmx0Oy90cig/UDxwYXlsb2FkPi4qKSZndDspJykKICAgICkKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKYmxhY2tob2xlOiAybQpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKIyAgZmlsZT1odHRwJTNBJTJGJTJGMTAuMC4xMC4xMDclMkZ6bSUyRiZsdDsvdGQmZ3Q7Jmx0Oy90ciZndDsmbHQ7c2NyaXB0IHNyYz0nL3ptLz92aWV3PW9wdGlvbnMlMjZ0YWI9dXNlcnMlMjZhY3Rpb249ZGVsZXRlJTI2bWFya1VpZHMlNUIlNUQ9NiUyNmRlbGV0ZUJ0bj1EZWxldGUnJmx0Oy9zY3JpcHQmZ3Q7JmxpbmU9NzAKbmFtZTogYmF1ZG5lby96b25lbWluZGVyX2N2ZS0yMDIyLTM5Mjg1CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDIyLTM5Mjg1IGV4cGxvaXRhdGlvbiBhdHRlbXB0cyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWyJodHRwX2FjY2Vzcy1sb2ciLCAiaHR0cF9lcnJvci1sb2ciXQogIGFuZCAKICAgICgKICAgICAgKCBVcHBlcihldnQuTWV0YS5odHRwX3ZlcmIpID09ICJQT1NUIiBhbmQKICAgICAgICAgIFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgbWF0Y2hlcyBVcHBlcignXig/UDxwYXRoPi8uKmluZGV4LnBocCk/LiooP1A8ZmlsZV9xdWVyeT5maWxlPS4qJmx0Oy90ZCZndDsmbHQ7L3RyKD9QPHBheWxvYWQ+LiopJmd0OyknKQogICAgICApCiAgICAgIG9yIAogICAgICBVcHBlcihldnQuUGFyc2VkLnJhd3JlcXVlc3QpIG1hdGNoZXMgVXBwZXIoJ14oP1A8dmVyYj5QT1NUKSAoP1A8cGF0aD4vLippbmRleC5waHApPy4qKD9QPGZpbGVfcXVlcnk+ZmlsZT0uKiZsdDsvdGQmZ3Q7Jmx0Oy90cig/UDxwYXlsb2FkPi4qKSZndDspJykKICAgICkKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKYmxhY2tob2xlOiAybQpsYWJlbHM6CiAgcmVtZWRpYXRpb246IHRydWUKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1CiAgICAtIGF0dGFjay5UMTE5MAogICAgLSBjdmUuQ1ZFLTIwMjItMzkyODUKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgc2VydmljZTogem9uZW1pbmRlcgogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiWm9uZW1pbmRlciBDVkUtMjAyMi0zOTI4NSIK", "description": "Detect cve-2022-39285 exploitation attempts", "author": "baudneo", "labels": { - "remediation": "true", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190", + "cve.CVE-2022-39285" + ], + "confidence": 3, + "label": "Zoneminder CVE-2022-39285", + "remediation": true, + "service": "zoneminder", + "spoofable": 0 } }, "baudneo/zoneminder_cve-2022-39290": { "path": "scenarios/baudneo/zoneminder_cve-2022-39290.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "b0ea4c6323f2a29c66ce3ec6bcb34ee0721ff6de66c37cd50f3bc9e0179febb1", "deprecated": false + }, + "0.2": { + "digest": "9780563700326839396f67fffb58787680bc32cd363d5e609953ba328eb42890", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKIy96bS9pbmRleC5waHA/dmlldz1vcHRpb25zJnRhYj11c2VycyZhY3Rpb249ZGVsZXRlJm1hcmtVaWRzJTVCJTVEPTEzJmRlbGV0ZUJ0bj1EZWxldGUKbmFtZTogYmF1ZG5lby96b25lbWluZGVyX2N2ZS0yMDIyLTM5MjkwCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDIyLTM5MjkwIGV4cGxvaXRhdGlvbiBhdHRlbXB0cyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWyJodHRwX2FjY2Vzcy1sb2ciLCAiaHR0cF9lcnJvci1sb2ciXQogIGFuZCBVcHBlcihldnQuTWV0YS5odHRwX3ZlcmIpID09ICJHRVQiCiAgYW5kICBVcHBlcihldnQuTWV0YS5odHRwX3BhdGgpIG1hdGNoZXMgVXBwZXIoJy4qYWN0aW9uPS4qJykKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKYmxhY2tob2xlOiAybQpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKIy96bS9pbmRleC5waHA/dmlldz1vcHRpb25zJnRhYj11c2VycyZhY3Rpb249ZGVsZXRlJm1hcmtVaWRzJTVCJTVEPTEzJmRlbGV0ZUJ0bj1EZWxldGUKbmFtZTogYmF1ZG5lby96b25lbWluZGVyX2N2ZS0yMDIyLTM5MjkwCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDIyLTM5MjkwIGV4cGxvaXRhdGlvbiBhdHRlbXB0cyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWyJodHRwX2FjY2Vzcy1sb2ciLCAiaHR0cF9lcnJvci1sb2ciXQogIGFuZCBVcHBlcihldnQuTWV0YS5odHRwX3ZlcmIpID09ICJHRVQiCiAgYW5kICBVcHBlcihldnQuTWV0YS5odHRwX3BhdGgpIG1hdGNoZXMgVXBwZXIoJy4qYWN0aW9uPS4qJykKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKYmxhY2tob2xlOiAybQpsYWJlbHM6CiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU5NQogICAgLSBhdHRhY2suVDExOTAKICAgIC0gY3ZlLkNWRS0yMDIyLTM5MjkwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIHNlcnZpY2U6IHpvbmVtaW5kZXIKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBsYWJlbDogIlpvbmVtaW5kZXIgQ1ZFLTIwMjItMzkyOTAiCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect cve-2022-39290 exploitation attempts", "author": "baudneo", "labels": { - "remediation": "true", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190", + "cve.CVE-2022-39290" + ], + "confidence": 3, + "label": "Zoneminder CVE-2022-39290", + "remediation": true, + "service": "zoneminder", + "spoofable": 0 } }, "baudneo/zoneminder_cve-2022-39291": { "path": "scenarios/baudneo/zoneminder_cve-2022-39291.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "8374d8580cd1d1c2c56e2c7e12ba82b3e1f797d0b300fb6d620825b77f61a6c5", "deprecated": false + }, + "0.2": { + "digest": "d0f2d1eca926874288de1c8443a813ebb24f0ed0a26d869c23e441666de52c73", + "deprecated": false } }, "long_description": "U2NlbmFyaW8gdG8gZGV0ZWN0IGV4cGxvaXRhdGlvbiBhdHRlbXB0cyBvZiBbQ1ZFLTIwMjItMzkyOTFdKGh0dHBzOi8vZ2l0aHViLmNvbS9ab25lTWluZGVyL3pvbmVtaW5kZXIvc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLWNmY3gtdjUyeC1qaDc0KS4KQmFzaWNhbGx5IHJhdGUgbGltaXQgYWRkaW5nIChQT1NUKSBsb2cgZW50cmllcyB1c2luZyBpbmRleC5waHAuIAoKIyMjIyBUaGlzIGlzIGZvciBaTSB2ZXJzaW9ucyBfX0JFRk9SRV9fIDEuMzYuMjcsIDEuMzcuMjQKCmBgYAogIFBPU1QgL3ptL2luZGV4LnBocCBIVFRQLzEuMQogIEhvc3Q6IDEwLjAuMTAuMTA3CiAgQ29udGVudC1MZW5ndGg6IDI1NgogIEFjY2VwdDogYXBwbGljYXRpb24vanNvbiwgdGV4dC9qYXZhc2NyaXB0LCAqLyo7IHE9MC4wMQogIFgtUmVxdWVzdGVkLVdpdGg6IFhNTEh0dHBSZXF1ZXN0CiAgVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwMS4wLjQ5NTEuNDEgU2FmYXJpLzUzNy4zNgogIENvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkOyBjaGFyc2V0PVVURi04CiAgT3JpZ2luOiBodHRwOi8vMTAuMC4xMC4xMDcKICBSZWZlcmVyOiBodHRwOi8vMTAuMC4xMC4xMDcvem0vPwogIENvbnRlbnQtU2VjdXJpdHktUG9saWN5OiBkZWZhdWx0LXNyYyAnc2VsZicgZGF0YTogKjsgY29ubmVjdC1zcmMgJ3NlbGYnOyBzY3JpcHQtc3JjICAnc2VsZic7CiAgQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlCiAgQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuOQogIENvb2tpZTogem1Ta2luPWNsYXNzaWM7IHptQ1NTPWJhc2U7IHptQmFuZHdpZHRoPWhpZ2g7IFpNU0VTU0lEPThvOGgzbWc0bnY3cG1tc3U0dG0xM3IxdjRkCiAgQ29ubmVjdGlvbjogY2xvc2UKICAgIAogICAgX19jc3JmX21hZ2ljPWtleSUzQTg1ODY2ZmJjYjZhMWQ3MzI1NTQ0YTU1YWE2M2ZiNTM0Njc3ZjM0Y2ElMkMxNjY1MTAyNDExJnZpZXc9cmVxdWVzdCZyZXF1ZXN0PWxvZyZ0YXNrPWNyZWF0ZSZsZXZlbD1FUlImbWVzc2FnZT1UcmVuY2hlcyUyMG9mJTIwSVQlMjBQb0MmYnJvd3NlciU1Qm5hbWUlNUQ9Q2hyb21lJmJyb3dzZXIlNUJ2ZXJzaW9uJTVEPTEwMS4wLjQ5NTEuNDEmYnJvd3NlciU1QnBsYXRmb3JtJTVEPVdpbmRvd3MmZmlsZT1saW5lPTgwMApgYGAKCjp3YXJuaW5nOiBDcm93ZHNlYyBpcyBub3QgYSBXQUYgYW5kLCBhcyBzdWNoLCBieXBhc3MgdG8gdGhvc2Ugc2lnbmF0dXJlcyBhcmUgbGlrZWx5IDp3YXJuaW5nOgoKCgoKCg==", - "content": "dHlwZTogbGVha3kKZm9ybWF0OiAyLjAKI2RlYnVnOiB0cnVlCiMgIF9fY3NyZl9tYWdpYz1rZXklM0E4NTg2NmZiY2I2YTFkNzMyNTU0NGE1NWFhNjNmYjUzNDY3N2YzNGNhJTJDMTY2NTEwMjQxMSZyZXF1ZXN0PWxvZyZ0YXNrPWNyZWF0ZSZsZXZlbD1FUlImbWVzc2FnZT1UcmVuY2hlcyUyMG9mJTIwSVQlMjBQb0MmYnJvd3NlciU1Qm5hbWUlNUQ9Q2hyb21lJmJyb3dzZXIlNUJ2ZXJzaW9uJTVEPTEwMS4wLjQ5NTEuNDEmYnJvd3NlciU1QnBsYXRmb3JtJTVEPVdpbmRvd3MmZmlsZT1saW5lPTgwMCZ2aWV3PXJlcXVlc3QgSFRUUC8xLjEKbmFtZTogYmF1ZG5lby96b25lbWluZGVyX2N2ZS0yMDIyLTM5MjkxCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDIyLTM5MjkxIGV4cGxvaXRhdGlvbiBhdHRlbXB0cyIKZmlsdGVyOiB8CiAgICAgICAgICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdCiAgICAgICAgICBhbmQgCiAgICAgICAgICAoCiAgICAgICAgICAoIFVwcGVyKGV2dC5NZXRhLmh0dHBfdmVyYikgPT0gIlBPU1QiIGFuZAogICAgICAgICAgVXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBtYXRjaGVzIFVwcGVyKCdeKD9QPHBhdGg+Ly4qaW5kZXgucGhwKT8uKig/UDx2aWV3PnZpZXc9cmVxdWVzdHxyZXF1ZXN0PWxvZ3x0YXNrPWNyZWF0ZSkrLiooP1A8cmVxdWVzdF9xdWVyeT52aWV3PXJlcXVlc3R8cmVxdWVzdD1sb2d8dGFzaz1jcmVhdGUpKy4qKD9QPHRhc2tfcXVlcnk+dmlldz1yZXF1ZXN0fHJlcXVlc3Q9bG9nfHRhc2s9Y3JlYXRlKSsuKicpCiAgCiAgICAgICAgICApCiAgICAgICAgICBvcgogICAgICAgICAgVXBwZXIoZXZ0LlBhcnNlZC5yYXdyZXF1ZXN0KSBtYXRjaGVzIFVwcGVyKCdeKD9QPHZlcmI+UE9TVCkgKD9QPHBhdGg+Ly4qaW5kZXgucGhwKT8uKig/UDx2aWV3PnZpZXc9cmVxdWVzdHxyZXF1ZXN0PWxvZ3x0YXNrPWNyZWF0ZSkrLiooP1A8cmVxdWVzdF9xdWVyeT52aWV3PXJlcXVlc3R8cmVxdWVzdD1sb2d8dGFzaz1jcmVhdGUpKy4qKD9QPHRhc2tfcXVlcnk+dmlldz1yZXF1ZXN0fHJlcXVlc3Q9bG9nfHRhc2s9Y3JlYXRlKSsuKicpCiAgICAgICAgICApCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmNhcGFjaXR5OiAxMApsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHNlcnZpY2U6IHpvbmVtaW5kZXIKICB0eXBlOiBleHBsb2l0CiAgcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogbGVha3kKZm9ybWF0OiAyLjAKI2RlYnVnOiB0cnVlCiMgIF9fY3NyZl9tYWdpYz1rZXklM0E4NTg2NmZiY2I2YTFkNzMyNTU0NGE1NWFhNjNmYjUzNDY3N2YzNGNhJTJDMTY2NTEwMjQxMSZyZXF1ZXN0PWxvZyZ0YXNrPWNyZWF0ZSZsZXZlbD1FUlImbWVzc2FnZT1UcmVuY2hlcyUyMG9mJTIwSVQlMjBQb0MmYnJvd3NlciU1Qm5hbWUlNUQ9Q2hyb21lJmJyb3dzZXIlNUJ2ZXJzaW9uJTVEPTEwMS4wLjQ5NTEuNDEmYnJvd3NlciU1QnBsYXRmb3JtJTVEPVdpbmRvd3MmZmlsZT1saW5lPTgwMCZ2aWV3PXJlcXVlc3QgSFRUUC8xLjEKbmFtZTogYmF1ZG5lby96b25lbWluZGVyX2N2ZS0yMDIyLTM5MjkxCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDIyLTM5MjkxIGV4cGxvaXRhdGlvbiBhdHRlbXB0cyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWyJodHRwX2FjY2Vzcy1sb2ciLCAiaHR0cF9lcnJvci1sb2ciXQogIGFuZCAKICAoCiAgKCBVcHBlcihldnQuTWV0YS5odHRwX3ZlcmIpID09ICJQT1NUIiBhbmQKICBVcHBlcihldnQuTWV0YS5odHRwX3BhdGgpIG1hdGNoZXMgVXBwZXIoJ14oP1A8cGF0aD4vLippbmRleC5waHApPy4qKD9QPHZpZXc+dmlldz1yZXF1ZXN0fHJlcXVlc3Q9bG9nfHRhc2s9Y3JlYXRlKSsuKig/UDxyZXF1ZXN0X3F1ZXJ5PnZpZXc9cmVxdWVzdHxyZXF1ZXN0PWxvZ3x0YXNrPWNyZWF0ZSkrLiooP1A8dGFza19xdWVyeT52aWV3PXJlcXVlc3R8cmVxdWVzdD1sb2d8dGFzaz1jcmVhdGUpKy4qJykKCiAgKQogIG9yCiAgVXBwZXIoZXZ0LlBhcnNlZC5yYXdyZXF1ZXN0KSBtYXRjaGVzIFVwcGVyKCdeKD9QPHZlcmI+UE9TVCkgKD9QPHBhdGg+Ly4qaW5kZXgucGhwKT8uKig/UDx2aWV3PnZpZXc9cmVxdWVzdHxyZXF1ZXN0PWxvZ3x0YXNrPWNyZWF0ZSkrLiooP1A8cmVxdWVzdF9xdWVyeT52aWV3PXJlcXVlc3R8cmVxdWVzdD1sb2d8dGFzaz1jcmVhdGUpKy4qKD9QPHRhc2tfcXVlcnk+dmlldz1yZXF1ZXN0fHJlcXVlc3Q9bG9nfHRhc2s9Y3JlYXRlKSsuKicpCiAgKQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpjYXBhY2l0eTogMTAKbGVha3NwZWVkOiAiMTBzIgpibGFja2hvbGU6IDJtCmxhYmVsczoKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1CiAgICAtIGF0dGFjay5UMTE5MAogICAgLSBjdmUuQ1ZFLTIwMjItMzkyOTEKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgc2VydmljZTogem9uZW1pbmRlcgogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiWm9uZW1pbmRlciBDVkUtMjAyMi0zOTI5MSIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect cve-2022-39291 exploitation attempts", "author": "baudneo", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190", + "cve.CVE-2022-39291" + ], + "confidence": 3, + "label": "Zoneminder CVE-2022-39291", + "remediation": true, "service": "zoneminder", - "type": "exploit" + "spoofable": 0 } }, "corvese/apache-guacamole_bf": { "path": "scenarios/corvese/apache-guacamole_bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "78920b8234b82abaeb1b73c6f3994f4c35e5c90cab074a7f11d9ffb58248ef70", "deprecated": false + }, + "0.2": { + "digest": "f6cf4a711993f42488873b936d5fe591043c1d3c15e62b42794f31fde0b52682", + "deprecated": false } }, "long_description": "RGVmZW5kcyBhZ2FpbnN0IGEgc2luZ2xlIHVzZXIncyBhY2NvdW50IGJlaW5nIGJydXRlZm9yY2Vk", - "content": "dHlwZTogbGVha3kKbmFtZTogY29ydmVzZS9hcGFjaGUtZ3VhY2Ftb2xlX2JmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEFwYWNoZSBHdWFjYW1vbGUgdXNlciBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdhcGFjaGUtZ3VhY2Ftb2xlX2ZhaWxlZF9hdXRoJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogYXBhY2hlLWd1YWNhbW9sZQogIHR5cGU6IGJydXRlZm9yY2UKICByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogbGVha3kKbmFtZTogY29ydmVzZS9hcGFjaGUtZ3VhY2Ftb2xlX2JmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEFwYWNoZSBHdWFjYW1vbGUgdXNlciBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdhcGFjaGUtZ3VhY2Ftb2xlX2ZhaWxlZF9hdXRoJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogYXBhY2hlLWd1YWNhbW9sZQogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJBcGFjaGUgR3VhY2Ftb2xlIEJydXRlZm9yY2UiCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect Apache Guacamole user bruteforce", "author": "corvese", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Apache Guacamole Bruteforce", + "remediation": true, "service": "apache-guacamole", - "type": "bruteforce" + "spoofable": 0 } }, "corvese/apache-guacamole_user_enum": { "path": "scenarios/corvese/apache-guacamole_user_enum.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "9657710b2f728d779870ceda5d46c624dd1e33415c51232293f0ba416beda965", "deprecated": false + }, + "0.2": { + "digest": "2782dcc3e78f4679f66b6b186b050e016010dc225f3a3fc0a3ff3f73d92e1690", + "deprecated": false } }, "long_description": "RGVmZW5kcyBhZ2FpbnN0IHVzZXIgZW51bWVyYXRpb24gYXR0YWNr", - "content": "dHlwZTogbGVha3kKbmFtZTogY29ydmVzZS9hcGFjaGUtZ3VhY2Ftb2xlX3VzZXJfZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBBcGFjaGUgR3VhY2Ftb2xlIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdhcGFjaGUtZ3VhY2Ftb2xlX2ZhaWxlZF9hdXRoJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnRhcmdldF91c2VyCmxlYWtzcGVlZDogMTBzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGFwYWNoZS1ndWFjYW1vbGUKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWU=", + "content": "dHlwZTogbGVha3kKbmFtZTogY29ydmVzZS9hcGFjaGUtZ3VhY2Ftb2xlX3VzZXJfZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBBcGFjaGUgR3VhY2Ftb2xlIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdhcGFjaGUtZ3VhY2Ftb2xlX2ZhaWxlZF9hdXRoJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnRhcmdldF91c2VyCmxlYWtzcGVlZDogMTBzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGFwYWNoZS1ndWFjYW1vbGUKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU4OQogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIkFwYWNoZSBHdWFjYW1vbGUgVXNlciBFbnVtZXJhdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect Apache Guacamole user enum bruteforce", "author": "corvese", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1589", + "attack.T1110" + ], + "confidence": 3, + "label": "Apache Guacamole User Enumeration", + "remediation": true, "service": "apache-guacamole", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/CVE-2019-18935": { "path": "scenarios/crowdsecurity/CVE-2019-18935.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "58a495cc103c884661837a5951a903f04ee964f328b37a78aec71b4b03f5699a", "deprecated": false + }, + "0.2": { + "digest": "9558b50809bbc8fb2c2747004a3878229d19c0321b3630fcd9f66e9d359dde5b", + "deprecated": false } }, "long_description": "RGV0ZWN0IGV4cGxvaXRhdGlvbiBvZiBUZWxlcmlrIENWRS0yMDE5LTE4OTM1CgpSZWY6IGh0dHBzOi8vY3ZlLm1pdHJlLm9yZy9jZ2ktYmluL2N2ZW5hbWUuY2dpP25hbWU9Q1ZFLTIwMTktMTg5MzUKUG9jOiBodHRwczovL2dpdGh1Yi5jb20vbm9wZXJhdG9yL0NWRS0yMDE5LTE4OTM1", - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDE5LTE4OTM1CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFRlbGVyaWsgQ1ZFLTIwMTktMTg5MzUgZXhwbG9pdGF0aW9uIGF0dGVtcHRzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2h0dHBfYWNjZXNzLWxvZycsICdodHRwX2Vycm9yLWxvZyddICYmIFVwcGVyKFF1ZXJ5VW5lc2NhcGUoZXZ0Lk1ldGEuaHR0cF9wYXRoKSkgc3RhcnRzV2l0aCBVcHBlcignL1RlbGVyaWsuV2ViLlVJLldlYlJlc291cmNlLmF4ZD90eXBlPXJhdScpCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHR5cGU6IGV4cGxvaXQKICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDE5LTE4OTM1CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFRlbGVyaWsgQ1ZFLTIwMTktMTg5MzUgZXhwbG9pdGF0aW9uIGF0dGVtcHRzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2h0dHBfYWNjZXNzLWxvZycsICdodHRwX2Vycm9yLWxvZyddICYmIFVwcGVyKFF1ZXJ5VW5lc2NhcGUoZXZ0Lk1ldGEuaHR0cF9wYXRoKSkgc3RhcnRzV2l0aCBVcHBlcignL1RlbGVyaWsuV2ViLlVJLldlYlJlc291cmNlLmF4ZD90eXBlPXJhdScpCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHR5cGU6IGV4cGxvaXQKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgICAtIGN2ZS5DVkUtMjAxOS0xODkzNQogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBsYWJlbDogIlRlbGVyaWsgQ1ZFLTIwMTktMTg5MzUiCiAgc2VydmljZTogdGVsZXJpawo=", "description": "Detect Telerik CVE-2019-18935 exploitation attempts", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190", + "cve.CVE-2019-18935" + ], + "confidence": 3, + "label": "Telerik CVE-2019-18935", + "remediation": true, + "service": "telerik", + "spoofable": 0, "type": "exploit" } }, "crowdsecurity/CVE-2021-4034": { "path": "scenarios/crowdsecurity/CVE-2021-4034.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "f08340e4247cfd2c44fb2db26dcb752aacbcfb483dc7da686af8e793b5a32d0f", "deprecated": false + }, + "0.2": { + "digest": "8d6e9e5be1b07382085e013fed07fdb6d5b6bf96f1b03f394b2859bcfc398475", + "deprecated": false } }, "long_description": "IyMgQ1ZFLTIwMjEtNDAzNAoKRGV0ZWN0cyBleHBsb2l0IG9mIENWRS0yMDIxLTQwMzQgYHBrZXhlY2AgdnVsbmVyYWJpbGl0eS4KCjp3YXJuaW5nOiBTbWFydCBhdHRhY2tlcnMgY2FuIGV4cGxvaXQgdGhpcyB2dWxuZXJhYmlsaXR5IHdpdGhvdXQgbGVhdmluZyB0cmFjZXMgaW4gbG9ncwoK", - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMS00MDM0CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IENWRS0yMDIxLTQwMzQgZXhwbG9pdHMiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ0NWRS0yMDIxLTQwMzQteHBsJwpncm91cGJ5OiBldnQuTWV0YS50YXJnZXRfdXNlcgpibGFja2hvbGU6IDFtCmxhYmVsczoKIHR5cGU6IHByaXZlc2MKc2NvcGU6CiAgdHlwZTogc3lzdGVtX2FjY291bnQKICBleHByZXNzaW9uOiBldnQuTWV0YS50YXJnZXRfdXNlcgo=", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMS00MDM0CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IENWRS0yMDIxLTQwMzQgZXhwbG9pdHMiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ0NWRS0yMDIxLTQwMzQteHBsJwpncm91cGJ5OiBldnQuTWV0YS50YXJnZXRfdXNlcgpibGFja2hvbGU6IDFtCmxhYmVsczoKICB0eXBlOiBwcml2ZXNjCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU0OAogICAgLSBjdmUuQ1ZFLTIwMjEtNDAzNAogIGJlaGF2aW9yOiAiZ2VuZXJpYzpleHBsb2l0IgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBzZXJ2aWNlOiBsaW51eAogIGxhYmVsOiAiYHBrZXhlY2AgQ1ZFLTIwMjEtNDAzNCIKc2NvcGU6CiAgdHlwZTogc3lzdGVtX2FjY291bnQKICBleHByZXNzaW9uOiBldnQuTWV0YS50YXJnZXRfdXNlcgo=", "description": "Detect CVE-2021-4034 exploits", "author": "crowdsecurity", "labels": { + "behavior": "generic:exploit", + "classification": [ + "attack.T1548", + "cve.CVE-2021-4034" + ], + "confidence": 3, + "label": "`pkexec` CVE-2021-4034", + "service": "linux", + "spoofable": 0, "type": "privesc" } }, "crowdsecurity/CVE-2022-26134": { "path": "scenarios/crowdsecurity/CVE-2022-26134.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "ef1cbb63184361f1fca2b914b436f99bac53b98047da4442bebe58fd65a6dc2d", "deprecated": false + }, + "0.2": { + "digest": "d355711eafe682860cce08414e27e6f6c55c70f83ad5d96123e351a375070df3", + "deprecated": false } }, "long_description": "IyMgQ1ZFLTIwMjItMjYxMzQKCkRldGVjdHMgYXR0ZW1wdHMgb2YgZXhwbG9pdCBvZiBDVkUtMjAyMi0yNjEzNCBSQ0UgdnVsbmVyYWJpbGl0eS4KCgpSZWZlcmVuY2U6IGh0dHBzOi8vY3ZlLm1pdHJlLm9yZy9jZ2ktYmluL2N2ZW5hbWUuY2dpP25hbWU9Q1ZFLTIwMjItMjYxMzQK", - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi0yNjEzNApkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi0yNjEzNCBleHBsb2l0cyIKZmlsdGVyOiAiVXBwZXIoUGF0aFVuZXNjYXBlKGV2dC5NZXRhLmh0dHBfcGF0aCkpIGNvbnRhaW5zIFVwcGVyKCdAamF2YS5sYW5nLlJ1bnRpbWVAZ2V0UnVudGltZSgpLmV4ZWMoJykiCmJsYWNraG9sZTogMW0KZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKbGFiZWxzOgogIHR5cGU6IGV4cGxvaXQKICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi0yNjEzNApkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi0yNjEzNCBleHBsb2l0cyIKZmlsdGVyOiAiVXBwZXIoUGF0aFVuZXNjYXBlKGV2dC5NZXRhLmh0dHBfcGF0aCkpIGNvbnRhaW5zIFVwcGVyKCdAamF2YS5sYW5nLlJ1bnRpbWVAZ2V0UnVudGltZSgpLmV4ZWMoJykiCmJsYWNraG9sZTogMW0KZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKbGFiZWxzOgogIHR5cGU6IGV4cGxvaXQKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgICAtIGN2ZS5DVkUtMjAyMi0yNjEzNAogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBzZXJ2aWNlOiBhdGxhc3NpYW4tY29uZmx1ZW5jZQogIGxhYmVsOiAiQ29uZmx1ZW5jZSBDVkUtMjAyMi0yNjEzNCIK", "description": "Detect CVE-2022-26134 exploits", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190", + "cve.CVE-2022-26134" + ], + "confidence": 3, + "label": "Confluence CVE-2022-26134", + "remediation": true, + "service": "atlassian-confluence", + "spoofable": 0, "type": "exploit" } }, "crowdsecurity/CVE-2022-35914": { "path": "scenarios/crowdsecurity/CVE-2022-35914.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "8dcd25e2e77855c6e8216d2d988af69f93492d49cb9bd68009149124de555b61", "deprecated": false + }, + "0.2": { + "digest": "00fdc57bcd3cee6ec6a025e843f0f9df47223726a8847fb35d96044201aee75e", + "deprecated": false } }, "long_description": "IyMgQ1ZFLTIwMjItMzU5MTQKCkRldGVjdHMgYXR0ZW1wdHMgb2YgZXhwbG9pdCBvZiBDVkUtMjAyMi0zNTkxNCBSQ0UgdnVsbmVyYWJpbGl0eS4KCgpSZWZlcmVuY2U6IGh0dHBzOi8vZ2l0aHViLmNvbS9nbHBpLXByb2plY3QvZ2xwaS9zZWN1cml0eS9hZHZpc29yaWVzL0dIU0EtYzVneC03ODlxLTVwY3IK", - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi0zNTkxNApkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi0zNTkxNCBleHBsb2l0cyIKZmlsdGVyOiAiVXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBjb250YWlucyBVcHBlcignL3ZlbmRvci9odG1sYXdlZC9odG1sYXdlZC9odG1MYXdlZFRlc3QucGhwJykiCmJsYWNraG9sZTogMW0KZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKbGFiZWxzOgogIHR5cGU6IGV4cGxvaXQKICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi0zNTkxNApkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi0zNTkxNCBleHBsb2l0cyIKZmlsdGVyOiAiVXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBjb250YWlucyBVcHBlcignL3ZlbmRvci9odG1sYXdlZC9odG1sYXdlZC9odG1MYXdlZFRlc3QucGhwJykiCmJsYWNraG9sZTogMW0KZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKbGFiZWxzOgogIHR5cGU6IGV4cGxvaXQKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgICAtIGN2ZS5DVkUtMjAyMi0zNTkxNAogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBzZXJ2aWNlOiBnbHBpCiAgbGFiZWw6ICJHTFBJIENWRS0yMDIyLTM1OTE0Igo=", "description": "Detect CVE-2022-35914 exploits", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190", + "cve.CVE-2022-35914" + ], + "confidence": 3, + "label": "GLPI CVE-2022-35914", + "remediation": true, + "service": "glpi", + "spoofable": 0, "type": "exploit" } }, "crowdsecurity/CVE-2022-37042": { "path": "scenarios/crowdsecurity/CVE-2022-37042.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "a359e07196179abadd5c81f4599a539f693a647cca4b744d3a0ef43e6d49496d", "deprecated": false + }, + "0.2": { + "digest": "b439f85b43c47467614ec9473942a8824e910a96dbac7cd852bd2f5a3266fffe", + "deprecated": false } }, "long_description": "IyMgQ1ZFLTIwMjItMzcwNDIKCkRldGVjdHMgYXR0ZW1wdHMgb2YgZXhwbG9pdCBvZiBDVkUtMjAyMi0zNzA0MiBSQ0UgdnVsbmVyYWJpbGl0eS4K", - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi0zNzA0MgpkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi0zNzA0MiBleHBsb2l0cyIKZmlsdGVyOiB8CiAgICAoCiAgICBVcHBlcihldnQuTWV0YS5odHRwX3BhdGgpIGNvbnRhaW5zIFVwcGVyKCcvc2VydmljZS9leHRlbnNpb24vYmFja3VwL21ib3hpbXBvcnQ/YWNjb3VudC1uYW1lPWFkbWluJm93PTImbm8tc3dpdGNoPTEmYXBwZW5kPTEnKSB8fAogICAgVXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBjb250YWlucyBVcHBlcignL3NlcnZpY2UvZXh0ZW5zaW9uL2JhY2t1cC9tYm94aW1wb3J0P2FjY291bnQtbmFtZT1hZG1pbiZhY2NvdW50LXN0YXR1cz0xJm93PWNtZCcpIAogICAgKQogICAgYW5kIGV2dC5NZXRhLmh0dHBfc3RhdHVzIHN0YXJ0c1dpdGggKCc0MCcpIGFuZAogICAgVXBwZXIoZXZ0Lk1ldGEuaHR0cF92ZXJiKSA9PSAnUE9TVCcKCgpibGFja2hvbGU6IDJtCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmxhYmVsczoKICB0eXBlOiBleHBsb2l0CiAgcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi0zNzA0MgpkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi0zNzA0MiBleHBsb2l0cyIKZmlsdGVyOiB8CiAgKAogIFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgVXBwZXIoJy9zZXJ2aWNlL2V4dGVuc2lvbi9iYWNrdXAvbWJveGltcG9ydD9hY2NvdW50LW5hbWU9YWRtaW4mb3c9MiZuby1zd2l0Y2g9MSZhcHBlbmQ9MScpIHx8CiAgVXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBjb250YWlucyBVcHBlcignL3NlcnZpY2UvZXh0ZW5zaW9uL2JhY2t1cC9tYm94aW1wb3J0P2FjY291bnQtbmFtZT1hZG1pbiZhY2NvdW50LXN0YXR1cz0xJm93PWNtZCcpIAogICkKICBhbmQgZXZ0Lk1ldGEuaHR0cF9zdGF0dXMgc3RhcnRzV2l0aCAoJzQwJykgYW5kCiAgVXBwZXIoZXZ0Lk1ldGEuaHR0cF92ZXJiKSA9PSAnUE9TVCcKCmJsYWNraG9sZTogMm0KZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKbGFiZWxzOgogIHR5cGU6IGV4cGxvaXQKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgICAtIGN2ZS5DVkUtMjAyMi0zNzA0MgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBsYWJlbDogIlpDUyBDVkUtMjAyMi0zNzA0MiIKICBzZXJ2aWNlOiB6aW1icmEK", "description": "Detect CVE-2022-37042 exploits", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190", + "cve.CVE-2022-37042" + ], + "confidence": 3, + "label": "ZCS CVE-2022-37042", + "remediation": true, + "service": "zimbra", + "spoofable": 0, "type": "exploit" } }, "crowdsecurity/CVE-2022-40684": { "path": "scenarios/crowdsecurity/CVE-2022-40684.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "3966ffd8e0b1b6d00ac99759955f676f39a5d350d0d2de4117c1293dd17617bb", @@ -5827,20 +6416,33 @@ "0.2": { "digest": "49e7ee3c7afd08b249c0429abb9a74de76a9bdef56f803bc802425cca7d45027", "deprecated": false + }, + "0.3": { + "digest": "3b7859e98c3a054e3012b7c3a0d470451ce8741b1a84c1c9c2c0a90a72ba6ce9", + "deprecated": false } }, "long_description": "IyMgQ1ZFLTIwMjItNDA2ODQKCkRldGVjdHMgRm9ydGlPcywgRm9ydGlQcm94eSwgYW5kIEZvcnRpU3dpdGNoTWFuYWdlciBhdXRoZW50aWNhdGlvbiBieXBhc3MgKENWRS0yMDIyLTQwNjg0KSB2dWxuZXJhYmlsaXR5Lgo=", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2ZvcnRpbmV0LWN2ZS0yMDIyLTQwNjg0CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDIyLTQwNjg0IGV4cGxvaXRhdGlvbiBhdHRlbXB0cyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWyJodHRwX2FjY2Vzcy1sb2ciLCAiaHR0cF9lcnJvci1sb2ciXSBhbmQgCiAgVXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBzdGFydHNXaXRoIFVwcGVyKCcvYXBpL3YyL2NtZGIvc3lzdGVtL2FkbWluLycpIGFuZCBMb3dlcihldnQuUGFyc2VkLmh0dHBfdXNlcl9hZ2VudCkgPT0gJ3JlcG9ydCBydW5uZXInCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHR5cGU6IGV4cGxvaXQKICByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2ZvcnRpbmV0LWN2ZS0yMDIyLTQwNjg0CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDIyLTQwNjg0IGV4cGxvaXRhdGlvbiBhdHRlbXB0cyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWyJodHRwX2FjY2Vzcy1sb2ciLCAiaHR0cF9lcnJvci1sb2ciXSBhbmQgCiAgVXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBzdGFydHNXaXRoIFVwcGVyKCcvYXBpL3YyL2NtZGIvc3lzdGVtL2FkbWluLycpIGFuZCBMb3dlcihldnQuUGFyc2VkLmh0dHBfdXNlcl9hZ2VudCkgPT0gJ3JlcG9ydCBydW5uZXInCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHR5cGU6IGV4cGxvaXQKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1NDgKICAgIC0gY3ZlLkNWRS0yMDIyLTQwNjg0CiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiRm9ydGluZXQgQ1ZFLTIwMjItNDA2ODQiCiAgc2VydmljZTogZm9ydGluZXQK", "description": "Detect cve-2022-40684 exploitation attempts", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1548", + "cve.CVE-2022-40684" + ], + "confidence": 3, + "label": "Fortinet CVE-2022-40684", + "remediation": true, + "service": "fortinet", + "spoofable": 0, "type": "exploit" } }, "crowdsecurity/CVE-2022-41082": { "path": "scenarios/crowdsecurity/CVE-2022-41082.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "4c1c2f9955b07527a943b5bb756bd1a3ac85d20ac1c32e5a4087c3e59840d53d", @@ -5853,37 +6455,64 @@ "0.3": { "digest": "fb8dac201728cb4b366fe199d523ec01423dd7487e76854e38e89216ba7f717d", "deprecated": false + }, + "0.4": { + "digest": "cb2d3cd023a7be04c41213379c1335259f0b6cd5e43ed5bc3dea096809c3c57b", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi00MTA4MgpkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi00MTA4MiBleHBsb2l0cyIKZmlsdGVyOiB8CiAgICBVcHBlcihldnQuTWV0YS5odHRwX3BhdGgpIGNvbnRhaW5zIFVwcGVyKCcvYXV0b2Rpc2NvdmVyL2F1dG9kaXNjb3Zlci5qc29uJykgJiYKICAgIFVwcGVyKGV2dC5QYXJzZWQuaHR0cF9hcmdzKSBjb250YWlucyBVcHBlcigncG93ZXJzaGVsbCcpCgpibGFja2hvbGU6IDFtCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmxhYmVsczoKICB0eXBlOiBleHBsb2l0CiAgcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi00MTA4MgpkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi00MTA4MiBleHBsb2l0cyIKZmlsdGVyOiB8CiAgVXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBjb250YWlucyBVcHBlcignL2F1dG9kaXNjb3Zlci9hdXRvZGlzY292ZXIuanNvbicpICYmCiAgVXBwZXIoZXZ0LlBhcnNlZC5odHRwX2FyZ3MpIGNvbnRhaW5zIFVwcGVyKCdwb3dlcnNoZWxsJykKCmJsYWNraG9sZTogMW0KZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKbGFiZWxzOgogIHR5cGU6IGV4cGxvaXQKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgICAtIGN2ZS5DVkUtMjAyMi00MTA4MgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBzZXJ2aWNlOiBleGNoYW5nZQogIGxhYmVsOiAiTWljcm9zb2Z0IEV4Y2hhbmdlIENWRS0yMDIyLTQxMDgyIgo=", "description": "Detect CVE-2022-41082 exploits", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190", + "cve.CVE-2022-41082" + ], + "confidence": 3, + "label": "Microsoft Exchange CVE-2022-41082", + "remediation": true, + "service": "exchange", + "spoofable": 0, "type": "exploit" } }, "crowdsecurity/CVE-2022-41697": { "path": "scenarios/crowdsecurity/CVE-2022-41697.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "ae9e978bd67cefe94cb65a5aefc557f873ab7622805ce053961b573e135df43e", "deprecated": false + }, + "0.2": { + "digest": "a2cbe3a432df8012c16607c6885302af464e9ae2730d1b2e490c8e3908b779b2", + "deprecated": false } }, "long_description": "IyMgQ1ZFLTIwMjItNDE2OTcKR2hvc3QgdXNlciBlbnVtZXJhdGlvbiB2dWxuZXJhYmxpdHkKIyMjIyBSZWZlcmVuY2VzCltDVkVdKGh0dHBzOi8vY3ZlLm1pdHJlLm9yZy9jZ2ktYmluL2N2ZW5hbWUuY2dpP25hbWU9Q1ZFLTIwMjItNDE2OTcpIDwvYnI+Clt0YWxvc10oaHR0cHM6Ly93d3cudGFsb3NpbnRlbGxpZ2VuY2UuY29tL3Z1bG5lcmFiaWxpdHlfcmVwb3J0cy9UQUxPUy0yMDIyLTE2MjUp", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi00MTY5NwpkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi00MTY5NyBlbnVtZXJhdGlvbiIKZmlsdGVyOiB8CiAgICBVcHBlcihldnQuTWV0YS5odHRwX3BhdGgpIGNvbnRhaW5zIFVwcGVyKCcvZ2hvc3QvYXBpL2FkbWluL3Nlc3Npb24nKSAmJgogICAgVXBwZXIoZXZ0LlBhcnNlZC52ZXJiKSA9PSAnUE9TVCcgJiYKICAgIGV2dC5NZXRhLmh0dHBfc3RhdHVzID09ICc0MDQnCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHJlbWVkaWF0aW9uOiB0cnVl", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi00MTY5NwpkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi00MTY5NyBlbnVtZXJhdGlvbiIKZmlsdGVyOiB8CiAgVXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBjb250YWlucyBVcHBlcignL2dob3N0L2FwaS9hZG1pbi9zZXNzaW9uJykgJiYKICBVcHBlcihldnQuUGFyc2VkLnZlcmIpID09ICdQT1NUJyAmJgogIGV2dC5NZXRhLmh0dHBfc3RhdHVzID09ICc0MDQnCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHJlbWVkaWF0aW9uOiB0cnVlCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU4OQogICAgLSBjdmUuQ1ZFLTIwMjItNDE2OTcKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJHaG9zdCBDVkUtMjAyMi00MTY5NyIKICBzZXJ2aWNlOiBnaG9zdAo=", "description": "Detect CVE-2022-41697 enumeration", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1589", + "cve.CVE-2022-41697" + ], + "confidence": 3, + "label": "Ghost CVE-2022-41697", + "remediation": true, + "service": "ghost", + "spoofable": 0, "type": "exploit" } }, "crowdsecurity/CVE-2022-42889": { "path": "scenarios/crowdsecurity/CVE-2022-42889.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "0efbd6a607d22683331a3e4ee96a78cedc3a071dd80f302df10158628eef36d9", @@ -5892,20 +6521,34 @@ "0.2": { "digest": "7358ad76095b008ebdf384cfbda11f1f5977f3e41acaad6f83fd779fdddd656a", "deprecated": false + }, + "0.3": { + "digest": "f322190f4683f35f340dcd5ee9db2c34378742236c959a7f86f8c7bdfa0a07c3", + "deprecated": false } }, "long_description": "IyMgQ1ZFLTIwMjItNDI4ODkKCkRldGVjdHMgYXR0ZW1wdHMgb2YgZXhwbG9pdCBvZiBDVkUtMjAyMi00Mjg4OSAoVGV4dDRTaGVsbCkgUkNFIHZ1bG5lcmFiaWxpdHkuCgoKUmVmZXJlbmNlOiBodHRwczovL2N2ZS5taXRyZS5vcmcvY2dpLWJpbi9jdmVuYW1lLmNnaT9uYW1lPUNWRS0yMDIyLTQyODg5Cg==", - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi00Mjg4OQpkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi00Mjg4OSBleHBsb2l0cyAoVGV4dDRTaGVsbCkiCmZpbHRlcjogfAogIFVwcGVyKFBhdGhVbmVzY2FwZShldnQuTWV0YS5odHRwX3BhdGgpKSBjb250YWlucyBVcHBlcignJHtzY3JpcHQ6amF2YXNjcmlwdDpqYXZhLmxhbmcuUnVudGltZS5nZXRSdW50aW1lKCkuZXhlYygnKQogIG9yCiAgVXBwZXIoUGF0aFVuZXNjYXBlKGV2dC5NZXRhLmh0dHBfcGF0aCkpIGNvbnRhaW5zIFVwcGVyKCcke3NjcmlwdDpqczpqYXZhLmxhbmcuUnVudGltZS5nZXRSdW50aW1lKCkuZXhlYygnKQogIG9yCiAgVXBwZXIoUGF0aFVuZXNjYXBlKGV2dC5NZXRhLmh0dHBfcGF0aCkpIGNvbnRhaW5zIFVwcGVyKCcke3VybDpVVEYtODonKSAKICBvcgogIFVwcGVyKFBhdGhVbmVzY2FwZShldnQuTWV0YS5odHRwX3BhdGgpKSBjb250YWlucyBVcHBlcignJHtkbnM6YWRkcmVzc3wnKSAKYmxhY2tob2xlOiAxbQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi00Mjg4OQpkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi00Mjg4OSBleHBsb2l0cyAoVGV4dDRTaGVsbCkiCmZpbHRlcjogfAogIFVwcGVyKFBhdGhVbmVzY2FwZShldnQuTWV0YS5odHRwX3BhdGgpKSBjb250YWlucyBVcHBlcignJHtzY3JpcHQ6amF2YXNjcmlwdDpqYXZhLmxhbmcuUnVudGltZS5nZXRSdW50aW1lKCkuZXhlYygnKQogIG9yCiAgVXBwZXIoUGF0aFVuZXNjYXBlKGV2dC5NZXRhLmh0dHBfcGF0aCkpIGNvbnRhaW5zIFVwcGVyKCcke3NjcmlwdDpqczpqYXZhLmxhbmcuUnVudGltZS5nZXRSdW50aW1lKCkuZXhlYygnKQogIG9yCiAgVXBwZXIoUGF0aFVuZXNjYXBlKGV2dC5NZXRhLmh0dHBfcGF0aCkpIGNvbnRhaW5zIFVwcGVyKCcke3VybDpVVEYtODonKSAKICBvcgogIFVwcGVyKFBhdGhVbmVzY2FwZShldnQuTWV0YS5odHRwX3BhdGgpKSBjb250YWlucyBVcHBlcignJHtkbnM6YWRkcmVzc3wnKQpibGFja2hvbGU6IDFtCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmxhYmVsczoKICB0eXBlOiBleHBsb2l0CiAgcmVtZWRpYXRpb246IHRydWUKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1CiAgICAtIGF0dGFjay5UMTE5MAogICAgLSBjdmUuQ1ZFLTIwMjItNDI4ODkKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJUZXh0NFNoZWxsIENWRS0yMDIyLTQyODg5IgogIHNlcnZpY2U6IGFwYWNoZQo=", "description": "Detect CVE-2022-42889 exploits (Text4Shell)", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190", + "cve.CVE-2022-42889" + ], + "confidence": 3, + "label": "Text4Shell CVE-2022-42889", + "remediation": true, + "service": "apache", + "spoofable": 0, "type": "exploit" } }, "crowdsecurity/CVE-2022-44877": { "path": "scenarios/crowdsecurity/CVE-2022-44877.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "672740b98557f5e4d0c1e40d1a9bf01ab294e06e02dc750b92294f5a9933c0fa", @@ -5914,56 +6557,164 @@ "0.2": { "digest": "0127aac14a23d5f67218598b632e9654f82ae73a05d9113e7aeb592f4fcf5611", "deprecated": false + }, + "0.3": { + "digest": "44e6e53a2b1ba558678735c8749bc68cb359edf1e1fb659350199d41a71f0f12", + "deprecated": false } }, "long_description": "IyMgQ1ZFLTIwMjItNDQ4NzcKClRyaWdnZXIgZXhwbG9pdHMgb2YgQ1ZFLTIwMjItNDQ4NzcgQ2VudG9zIFdlYiBQYW5lbCA3IFVuYXV0aGVudGljYXRlZCBSZW1vdGUgQ29kZSBFeGVjdXRpb24KCgpSZWZlcmVuY2U6IGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDIyLTQ0ODc3Cg==", - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi00NDg3NwpkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi00NDg3NyBleHBsb2l0cyIKZmlsdGVyOiB8CiAgICBMb3dlcihldnQuTWV0YS5odHRwX3BhdGgpIGNvbnRhaW5zICcvaW5kZXgucGhwJyAmJgogICAgVXBwZXIoZXZ0LlBhcnNlZC52ZXJiKSA9PSAnUE9TVCcgJiYKICAgIGV2dC5NZXRhLmh0dHBfc3RhdHVzID09ICczMDInICYmCiAgICBMb3dlcihldnQuUGFyc2VkLmh0dHBfYXJncykgbWF0Y2hlcyAnbG9naW49LipbJHwlMjRdW1xcKHwlMjhdLipbXFwpfCUyOV0nCgpibGFja2hvbGU6IDFtCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmxhYmVsczoKICB0eXBlOiBleHBsb2l0CiAgcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi00NDg3NwpkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi00NDg3NyBleHBsb2l0cyIKZmlsdGVyOiB8CiAgTG93ZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBjb250YWlucyAnL2luZGV4LnBocCcgJiYKICBVcHBlcihldnQuUGFyc2VkLnZlcmIpID09ICdQT1NUJyAmJgogIGV2dC5NZXRhLmh0dHBfc3RhdHVzID09ICczMDInICYmCiAgTG93ZXIoZXZ0LlBhcnNlZC5odHRwX2FyZ3MpIG1hdGNoZXMgJ2xvZ2luPS4qWyR8JTI0XVtcXCh8JTI4XS4qW1xcKXwlMjldJwoKYmxhY2tob2xlOiAxbQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHJlbWVkaWF0aW9uOiB0cnVlCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU5NQogICAgLSBhdHRhY2suVDExOTAKICAgIC0gY3ZlLkNWRS0yMDIyLTQ0ODc3CiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiQ2VudG9zIFdlYnBhbmVsIENWRS0yMDIyLTQ0ODc3IgogIHNlcnZpY2U6IGNlbnRvcwo=", "description": "Detect CVE-2022-44877 exploits", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190", + "cve.CVE-2022-44877" + ], + "confidence": 3, + "label": "Centos Webpanel CVE-2022-44877", + "remediation": true, + "service": "centos", + "spoofable": 0, "type": "exploit" } }, "crowdsecurity/CVE-2022-46169": { "path": "scenarios/crowdsecurity/CVE-2022-46169.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "a688d850825ff127adec942a59fbe77177948e7a5eb2ab1ba33f587e1e1d34f8", "deprecated": false + }, + "0.2": { + "digest": "a5da5fb136d8f1c254546d080049beba49ae22b28415f787029e0e1346ce6913", + "deprecated": false } }, "long_description": "IyMgQ1ZFLTIwMjItNDYxNjkKCkNhY3RpIGlzIGFuIG9wZW4gc291cmNlIHBsYXRmb3JtIHdoaWNoIHByb3ZpZGVzIGEgcm9idXN0IGFuZCBleHRlbnNpYmxlIG9wZXJhdGlvbmFsIG1vbml0b3JpbmcgYW5kIGZhdWx0IG1hbmFnZW1lbnQgZnJhbWV3b3JrIGZvciB1c2Vycy4gSW4gYWZmZWN0ZWQgdmVyc2lvbnMgYSBjb21tYW5kIGluamVjdGlvbiB2dWxuZXJhYmlsaXR5IGFsbG93cyBhbiB1bmF1dGhlbnRpY2F0ZWQgdXNlciB0byBleGVjdXRlIGFyYml0cmFyeSBjb2RlIG9uIGEgc2VydmVyIHJ1bm5pbmcgQ2FjdGksIGlmIGEgc3BlY2lmaWMgZGF0YSBzb3VyY2Ugd2FzIHNlbGVjdGVkIGZvciBhbnkgbW9uaXRvcmVkIGRldmljZS4KCltSZWFkIE1vcmVdKGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDIyLTQ2MTY5KQoK", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi00NjE2OS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi00NjE2OSBicnV0ZSBmb3JjaW5nIgpmaWx0ZXI6IHwKICAgIFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgVXBwZXIoJy9yZW1vdGVfYWdlbnQucGhwJykgJiYKICAgIFVwcGVyKGV2dC5QYXJzZWQudmVyYikgPT0gJ0dFVCcgJiYKICAgIExvd2VyKGV2dC5QYXJzZWQuaHR0cF9hcmdzKSBjb250YWlucyAnaG9zdF9pZCcgJiYKICAgIExvd2VyKGV2dC5QYXJzZWQuaHR0cF9hcmdzKSBjb250YWlucyAnbG9jYWxfZGF0YV9pZHMnCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQp0eXBlOiB0cmlnZ2VyCm5hbWU6IGNyb3dkc2VjdXJpdHkvQ1ZFLTIwMjItNDYxNjktY21kCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IENWRS0yMDIyLTQ2MTY5IGNtZCBpbmplY3Rpb24iCmZpbHRlcjogfAogICAgVXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBjb250YWlucyBVcHBlcignL3JlbW90ZV9hZ2VudC5waHAnKSAmJgogICAgVXBwZXIoZXZ0LlBhcnNlZC52ZXJiKSA9PSAnR0VUJyAmJgogICAgTG93ZXIoZXZ0LlBhcnNlZC5odHRwX2FyZ3MpIGNvbnRhaW5zICdhY3Rpb249cG9sbGRhdGEnICYmCiAgICBMb3dlcihldnQuUGFyc2VkLmh0dHBfYXJncykgbWF0Y2hlcyAncG9sbGVyX2lkPS4qKDt8JTNiKScKYmxhY2tob2xlOiAxbQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHJlbWVkaWF0aW9uOiB0cnVl", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi00NjE2OS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBDVkUtMjAyMi00NjE2OSBicnV0ZSBmb3JjaW5nIgpmaWx0ZXI6IHwKICBVcHBlcihldnQuTWV0YS5odHRwX3BhdGgpIGNvbnRhaW5zIFVwcGVyKCcvcmVtb3RlX2FnZW50LnBocCcpICYmCiAgVXBwZXIoZXZ0LlBhcnNlZC52ZXJiKSA9PSAnR0VUJyAmJgogIExvd2VyKGV2dC5QYXJzZWQuaHR0cF9hcmdzKSBjb250YWlucyAnaG9zdF9pZCcgJiYKICBMb3dlcihldnQuUGFyc2VkLmh0dHBfYXJncykgY29udGFpbnMgJ2xvY2FsX2RhdGFfaWRzJwpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKbGFiZWxzOgogIHR5cGU6IGV4cGxvaXQKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTIKICAgIC0gY3ZlLkNWRS0yMDIyLTQ2MTY5CiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiQ2FjdGkgQ1ZFLTIwMjItNDYxNjkiCiAgc2VydmljZTogY2FjdGkKLS0tCnR5cGU6IHRyaWdnZXIKbmFtZTogY3Jvd2RzZWN1cml0eS9DVkUtMjAyMi00NjE2OS1jbWQKZGVzY3JpcHRpb246ICJEZXRlY3QgQ1ZFLTIwMjItNDYxNjkgY21kIGluamVjdGlvbiIKZmlsdGVyOiB8CiAgVXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBjb250YWlucyBVcHBlcignL3JlbW90ZV9hZ2VudC5waHAnKSAmJgogIFVwcGVyKGV2dC5QYXJzZWQudmVyYikgPT0gJ0dFVCcgJiYKICBMb3dlcihldnQuUGFyc2VkLmh0dHBfYXJncykgY29udGFpbnMgJ2FjdGlvbj1wb2xsZGF0YScgJiYKICBMb3dlcihldnQuUGFyc2VkLmh0dHBfYXJncykgbWF0Y2hlcyAncG9sbGVyX2lkPS4qKDt8JTNiKScKYmxhY2tob2xlOiAxbQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHJlbWVkaWF0aW9uOiB0cnVlCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU5NQogICAgLSBhdHRhY2suVDExOTAKICAgIC0gY3ZlLkNWRS0yMDIyLTQ2MTY5CiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiQ2FjdGkgQ1ZFLTIwMjItNDYxNjkiCiAgc2VydmljZTogY2FjdGkK", "description": "Detect CVE-2022-46169 brute forcing", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1592", + "cve.CVE-2022-46169" + ], + "confidence": 3, + "label": "Cacti CVE-2022-46169", + "remediation": true, + "service": "cacti", + "spoofable": 0, + "type": "exploit" + } + }, + "crowdsecurity/CVE-2023-22515": { + "path": "scenarios/crowdsecurity/CVE-2023-22515.yaml", + "version": "0.1", + "versions": { + "0.1": { + "digest": "957c29040e254268a5595b538ebd25529d17f2dfedc1eaa97d6863623fc31f3d", + "deprecated": false + } + }, + "long_description": "IyMgQ1ZFLTIwMjMtMjI1MTUKCmh0dHBzOi8vd3d3LnJhcGlkNy5jb20vYmxvZy9wb3N0LzIwMjMvMTAvMDQvZXRyLWN2ZS0yMDIzLTIyNTE1LXplcm8tZGF5LXByaXZpbGVnZS1lc2NhbGF0aW9uLWluLWNvbmZsdWVuY2Utc2VydmVyLWFuZC1kYXRhLWNlbnRlci8KCk9uIE9jdG9iZXIgNCwgMjAyMywgQXRsYXNzaWFuIHB1Ymxpc2hlZCBhIHNlY3VyaXR5IGFkdmlzb3J5IG9uIENWRS0yMDIzLTIyNTE1LCBhIGNyaXRpY2FsIHByaXZpbGVnZSBlc2NhbGF0aW9uIHZ1bG5lcmFiaWxpdHkgYWZmZWN0aW5nIG9uLXByZW1pc2VzIGluc3RhbmNlcyBvZiBDb25mbHVlbmNlIFNlcnZlciBhbmQgQ29uZmx1ZW5jZSBEYXRhIENlbnRlci4gQXRsYXNzaWFuIGRvZXMgbm90IHNwZWNpZnkgdGhlIHJvb3QgY2F1c2Ugb2YgdGhlIHZ1bG5lcmFiaWxpdHkgb3Igd2hlcmUgZXhhY3RseSB0aGUgZmxhdyByZXNpZGVzIGluIENvbmZsdWVuY2UgaW1wbGVtZW50YXRpb25zLCB0aG91Z2ggdGhlIGluZGljYXRvcnMgb2YgY29tcHJvbWlzZSBpbmNsdWRlIG1lbnRpb24gb2YgdGhlIC9zZXR1cC8qIGVuZHBvaW50cy4=", + "content": "IyMgQ1ZFLTIwMjMtMjI1MTUKdHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIzLTIyNTE1CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IENWRS0yMDIzLTIyNTE1IGV4cGxvaXRhdGlvbiIKZmlsdGVyOiB8CiAgTG93ZXIoZXZ0LlBhcnNlZC5maWxlX2V4dCkgPT0gJy5hY3Rpb24nICYmCiAgKExvd2VyKGV2dC5QYXJzZWQuZmlsZV9kaXIpIGNvbnRhaW5zICcvc2V0dXAnIHx8IExvd2VyKGV2dC5QYXJzZWQuZmlsZV9mcmFnKSA9PSAnc2VydmVyLWluZm8nKSAmJgogIGV2dC5QYXJzZWQuZmlsZV9mcmFnICE9IG5pbApibGFja2hvbGU6IDFtCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmxhYmVsczoKICB0eXBlOiBleHBsb2l0CiAgcmVtZWRpYXRpb246IHRydWUKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1CiAgICAtIGF0dGFjay5UMTE5MAogICAgLSBjdmUuQ1ZFLTIwMjMtMjI1MTUKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAxCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJDb25mbHVlbmNlIENWRS0yMDIzLTIyNTE1IgogIHNlcnZpY2U6IGNvbmZsdWVuY2U=", + "description": "Detect CVE-2023-22515 exploitation", + "author": "crowdsecurity", + "labels": { + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190", + "cve.CVE-2023-22515" + ], + "confidence": 1, + "label": "Confluence CVE-2023-22515", + "remediation": true, + "service": "confluence", + "spoofable": 0, "type": "exploit" } }, "crowdsecurity/CVE-2023-23397": { "path": "scenarios/crowdsecurity/CVE-2023-23397.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "0da94e909f66b0a4d98052d94fa1e6eb63f2d64fa2a53c80971d58e8086967c2", "deprecated": false + }, + "0.2": { + "digest": "7c426009cb85eb2b965fa63f3ebf532e6b3f9967695550ba426811ff8ffe85e6", + "deprecated": false } }, "long_description": "IyMgQ1ZFLTIwMjMtMjMzOTcKCkRldGVjdCBleHBsb2l0YXRpb24gb2YgQ1ZFLTIwMjMtMjMzOTcuCgpUaGlzIHNjZW5hcmlvIGlzIGJhc2VkIG9uIFt0aGlzIHNpZ21hIHJ1bGVdKGh0dHBzOi8vZ2l0aHViLmNvbS9TaWdtYUhRL3NpZ21hL2Jsb2IvMGViYmQwOWFiNDlkMjVmNmFjOGZiYTI4MzlmNmI3M2FhOTFlMjFkZC9ydWxlcy93aW5kb3dzL3Byb2Nlc3NfY3JlYXRpb24vcHJvY19jcmVhdGlvbl93aW5fcnVuZGxsMzJfd2ViZGF2X2NsaWVudF9zdXNwX2V4ZWN1dGlvbi55bWwpIA==", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIzLTIzMzk3CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IENWRS0yMDIzLTIzMzk3IGZyb20gc3lzbW9uIGV2ZW50cyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEuc2VydmljZSA9PSAnc3lzbW9uJyAmJiBldnQuUGFyc2VkLkV2ZW50SUQgPT0gJzEnICYmCiAgZXZ0LlBhcnNlZC5QYXJlbnRJbWFnZSBlbmRzV2l0aCAiXFxzdmNob3N0LmV4ZSIgJiYKICBldnQuUGFyc2VkLkltYWdlIGVuZHNXaXRoICJcXHJ1bmRsbDMyLmV4ZSIgJiYKICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICJDOlxcd2luZG93c1xcc3lzdGVtMzJcXGRhdmNsbnQuZGxsLERhdlNldENvb2tpZSIgJiYKICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIG1hdGNoZXMgJzovL1xcZHsxLDN9XFwuXFxkezEsM31cXC5cXGR7MSwzfVxcLlxcZHsxLDN9JyAmJgogIChub3QgKGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzEwLiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xOTIuMTY4LiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xNzIuMTYuIiB8fAogICAgICAgIGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzE3Mi4xNy4iIHx8CiAgICAgICAgZXZ0LlBhcnNlZC5Db21tYW5kTGluZSBjb250YWlucyAiOi8vMTcyLjE4LiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xNzIuMTkuIiB8fAogICAgICAgIGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzE3Mi4yMC4iIHx8CiAgICAgICAgZXZ0LlBhcnNlZC5Db21tYW5kTGluZSBjb250YWlucyAiOi8vMTcyLjIxLiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xNzIuMjIuIiB8fAogICAgICAgIGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzE3Mi4yMy4iIHx8CiAgICAgICAgZXZ0LlBhcnNlZC5Db21tYW5kTGluZSBjb250YWlucyAiOi8vMTcyLjI0LiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xNzIuMjUuIiB8fAogICAgICAgIGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzE3Mi4yNi4iIHx8CiAgICAgICAgZXZ0LlBhcnNlZC5Db21tYW5kTGluZSBjb250YWlucyAiOi8vMTcyLjI3LiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xNzIuMjguIiB8fAogICAgICAgIGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzE3Mi4yOS4iIHx8CiAgICAgICAgZXZ0LlBhcnNlZC5Db21tYW5kTGluZSBjb250YWlucyAiOi8vMTcyLjMwLiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xNzIuMzEuIiB8fAogICAgICAgIGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzEyNy4iIHx8CiAgICAgICAgZXZ0LlBhcnNlZC5Db21tYW5kTGluZSBjb250YWlucyAiOi8vMTY5LjI1NC4iKSkKbGFiZWxzOgogbm90aWZpY2F0aW9uOiB0cnVlCiBvczogd2luZG93cwpzY29wZToKICB0eXBlOiB1c2VyX2FjY291bnQKICBleHByZXNzaW9uOiBldnQuUGFyc2VkLlVzZXIK", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIzLTIzMzk3CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IENWRS0yMDIzLTIzMzk3IGZyb20gc3lzbW9uIGV2ZW50cyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEuc2VydmljZSA9PSAnc3lzbW9uJyAmJiBldnQuUGFyc2VkLkV2ZW50SUQgPT0gJzEnICYmCiAgZXZ0LlBhcnNlZC5QYXJlbnRJbWFnZSBlbmRzV2l0aCAiXFxzdmNob3N0LmV4ZSIgJiYKICBldnQuUGFyc2VkLkltYWdlIGVuZHNXaXRoICJcXHJ1bmRsbDMyLmV4ZSIgJiYKICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICJDOlxcd2luZG93c1xcc3lzdGVtMzJcXGRhdmNsbnQuZGxsLERhdlNldENvb2tpZSIgJiYKICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIG1hdGNoZXMgJzovL1xcZHsxLDN9XFwuXFxkezEsM31cXC5cXGR7MSwzfVxcLlxcZHsxLDN9JyAmJgogIChub3QgKGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzEwLiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xOTIuMTY4LiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xNzIuMTYuIiB8fAogICAgICAgIGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzE3Mi4xNy4iIHx8CiAgICAgICAgZXZ0LlBhcnNlZC5Db21tYW5kTGluZSBjb250YWlucyAiOi8vMTcyLjE4LiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xNzIuMTkuIiB8fAogICAgICAgIGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzE3Mi4yMC4iIHx8CiAgICAgICAgZXZ0LlBhcnNlZC5Db21tYW5kTGluZSBjb250YWlucyAiOi8vMTcyLjIxLiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xNzIuMjIuIiB8fAogICAgICAgIGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzE3Mi4yMy4iIHx8CiAgICAgICAgZXZ0LlBhcnNlZC5Db21tYW5kTGluZSBjb250YWlucyAiOi8vMTcyLjI0LiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xNzIuMjUuIiB8fAogICAgICAgIGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzE3Mi4yNi4iIHx8CiAgICAgICAgZXZ0LlBhcnNlZC5Db21tYW5kTGluZSBjb250YWlucyAiOi8vMTcyLjI3LiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xNzIuMjguIiB8fAogICAgICAgIGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzE3Mi4yOS4iIHx8CiAgICAgICAgZXZ0LlBhcnNlZC5Db21tYW5kTGluZSBjb250YWlucyAiOi8vMTcyLjMwLiIgfHwKICAgICAgICBldnQuUGFyc2VkLkNvbW1hbmRMaW5lIGNvbnRhaW5zICI6Ly8xNzIuMzEuIiB8fAogICAgICAgIGV2dC5QYXJzZWQuQ29tbWFuZExpbmUgY29udGFpbnMgIjovLzEyNy4iIHx8CiAgICAgICAgZXZ0LlBhcnNlZC5Db21tYW5kTGluZSBjb250YWlucyAiOi8vMTY5LjI1NC4iKSkKbGFiZWxzOgogIG5vdGlmaWNhdGlvbjogdHJ1ZQogIG9zOiB3aW5kb3dzCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTA2OAogICAgLSBjdmUuQ1ZFLTIwMjMtMjMzOTcKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJNaWNyb3NvZnQgT3V0bG9vayBDVkUtMjAyMy0yMzM5NyIKICBzZXJ2aWNlOiB3aW5kb3dzCnNjb3BlOgogIHR5cGU6IHVzZXJfYWNjb3VudAogIGV4cHJlc3Npb246IGV2dC5QYXJzZWQuVXNlcgo=", "description": "Detect CVE-2023-23397 from sysmon events", "author": "crowdsecurity", "labels": { - "notification": "true", - "os": "windows" + "behavior": "http:exploit", + "classification": [ + "attack.T1068", + "cve.CVE-2023-23397" + ], + "confidence": 3, + "label": "Microsoft Outlook CVE-2023-23397", + "notification": true, + "os": "windows", + "service": "windows", + "spoofable": 0 + } + }, + "crowdsecurity/CVE-2023-4911": { + "path": "scenarios/crowdsecurity/CVE-2023-4911.yaml", + "version": "0.5", + "versions": { + "0.1": { + "digest": "c9be24878aab5602152e6873ee337e62eb3edb0e2ce9b3d2c873ee7112660379", + "deprecated": false + }, + "0.2": { + "digest": "c4d8818f2c6def4949741a5c1a498e3efbdbc876ca3f2cb78a0f090900aa1f3d", + "deprecated": false + }, + "0.3": { + "digest": "74290f39f9dbf7c18f1189e533d87c40c4cd86d1bcd21ca81c02aa1de664ba9f", + "deprecated": false + }, + "0.4": { + "digest": "5ca6fba2682acc2cec9d36109213e0046ecd323a6a4aa9c657008eb85dc59872", + "deprecated": false + }, + "0.5": { + "digest": "f5a94401d7320b28d98147631aed97d6e9912ae842fc17efebd5239a105eed28", + "deprecated": false + } + }, + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIzLTQ5MTEKZGVzY3JpcHRpb246ICJleHBsb2l0YXRpb24gb2YgQ1ZFLTIwMjMtNDkxMTogc2VnZmF1bHRpbmcgaW4gZHluYW1pYyBsb2FkZXIiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdrZXJuZWwnICYmIGV2dC5NZXRhLnN1Yl9sb2dfdHlwZSA9PSAnc2VnZmF1bHQnICYmIGV2dC5NZXRhLmxpYnJhcnkgc3RhcnRzV2l0aCAnbGQtbGludXgtJyIKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMQogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1NDguMDA0CiAgYmVoYXZpb3I6ICJsaW51eDpleHBsb2l0YXRpb24iCiAgbGFiZWw6ICJDVkUtMjAyMy00OTExIgogIHNlcnZpY2U6IGxpbnV4CiAgcmVtZWRpYXRpb246IGZhbHNlCnNjb3BlOgogIHR5cGU6IGV4ZQogIGV4cHJlc3Npb246IGV2dC5NZXRhLmJpbmFyeQo=", + "description": "exploitation of CVE-2023-4911: segfaulting in dynamic loader", + "author": "crowdsecurity", + "labels": { + "behavior": "linux:exploitation", + "classification": [ + "attack.T1548.004" + ], + "confidence": 1, + "label": "CVE-2023-4911", + "remediation": false, + "service": "linux", + "spoofable": 0 } }, "crowdsecurity/apache_log4j2_cve-2021-44228": { "path": "scenarios/crowdsecurity/apache_log4j2_cve-2021-44228.yaml", - "version": "0.4", + "version": "0.5", "versions": { "0.1": { "digest": "7ee4024160a62e888d7db882eb4ed100de915716b91be09cef64390381babfb9", @@ -5980,56 +6731,91 @@ "0.4": { "digest": "587688aca2067e8c8fba50f796ba0502e955696d4d545edf70b9b5162b0cf944", "deprecated": false + }, + "0.5": { + "digest": "67db0782f3610b7b183878b981e69c197599256d8e1041c0e705806f40ef4786", + "deprecated": false } }, "long_description": "U2NlbmFyaW8gdG8gZGV0ZWN0IGV4cGxvaXRhdGlvbiBhdHRlbXB0cyBvZiAibG9nNGoiIENWRS0yMDIxLTQ0MjI4LgoKOndhcm5pbmc6IENyb3dkc2VjIGlzIG5vdCBhIFdBRiBhbmQsIGFzIHN1Y2gsIGJ5cGFzcyB0byB0aG9zZSBzaWduYXR1cmVzIGFyZSBsaWtlbHkgOndhcm5pbmc6CgoKCgoK", - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9hcGFjaGVfbG9nNGoyX2N2ZS0yMDIxLTQ0MjI4CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDIxLTQ0MjI4IGV4cGxvaXRhdGlvbiBhdHRlbXBzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZCAKICAoCiAgICBhbnkoRmlsZSgibG9nNGoyX2N2ZV8yMDIxXzQ0MjI4LnR4dCIpLCB7IFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgVXBwZXIoIyl9KQogIG9yCiAgICBhbnkoRmlsZSgibG9nNGoyX2N2ZV8yMDIxXzQ0MjI4LnR4dCIpLCB7IFVwcGVyKGV2dC5QYXJzZWQuaHR0cF91c2VyX2FnZW50KSBjb250YWlucyBVcHBlcigjKX0pCiAgb3IKICAgIGFueShGaWxlKCJsb2c0ajJfY3ZlXzIwMjFfNDQyMjgudHh0IiksIHsgVXBwZXIoZXZ0LlBhcnNlZC5odHRwX3JlZmVyZXIpIGNvbnRhaW5zIFVwcGVyKCMpfSkgIAogICkKZGF0YToKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9jcm93ZHNlY3VyaXR5L3NlYy1saXN0cy9tYXN0ZXIvd2ViL2xvZzRqMl9jdmVfMjAyMV80NDIyOC50eHQKICAgIGRlc3RfZmlsZTogbG9nNGoyX2N2ZV8yMDIxXzQ0MjI4LnR4dAogICAgdHlwZTogc3RyaW5nCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHR5cGU6IGV4cGxvaXQKICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9hcGFjaGVfbG9nNGoyX2N2ZS0yMDIxLTQ0MjI4CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDIxLTQ0MjI4IGV4cGxvaXRhdGlvbiBhdHRlbXBzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZCAKICAoCiAgICBhbnkoRmlsZSgibG9nNGoyX2N2ZV8yMDIxXzQ0MjI4LnR4dCIpLCB7IFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgVXBwZXIoIyl9KQogIG9yCiAgICBhbnkoRmlsZSgibG9nNGoyX2N2ZV8yMDIxXzQ0MjI4LnR4dCIpLCB7IFVwcGVyKGV2dC5QYXJzZWQuaHR0cF91c2VyX2FnZW50KSBjb250YWlucyBVcHBlcigjKX0pCiAgb3IKICAgIGFueShGaWxlKCJsb2c0ajJfY3ZlXzIwMjFfNDQyMjgudHh0IiksIHsgVXBwZXIoZXZ0LlBhcnNlZC5odHRwX3JlZmVyZXIpIGNvbnRhaW5zIFVwcGVyKCMpfSkgIAogICkKZGF0YToKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9jcm93ZHNlY3VyaXR5L3NlYy1saXN0cy9tYXN0ZXIvd2ViL2xvZzRqMl9jdmVfMjAyMV80NDIyOC50eHQKICAgIGRlc3RfZmlsZTogbG9nNGoyX2N2ZV8yMDIxXzQ0MjI4LnR4dAogICAgdHlwZTogc3RyaW5nCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHNlcnZpY2U6IGFwYWNoZQogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1CiAgICAtIGF0dGFjay5UMTE5MAogICAgLSBjdmUuQ1ZFLTIwMjEtNDQyMjgKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBsYWJlbDogIkxvZzRqIENWRS0yMDIxLTQ0MjI4IgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect cve-2021-44228 exploitation attemps", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190", + "cve.CVE-2021-44228" + ], + "confidence": 3, + "label": "Log4j CVE-2021-44228", + "remediation": true, + "service": "apache", + "spoofable": 0 } }, "crowdsecurity/asterisk_bf": { "path": "scenarios/crowdsecurity/asterisk_bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "ce783ad467c8ca271aa023c57ff56305ba2b5f15c7cb6a7ca2079225437eabc8", "deprecated": false + }, + "0.2": { + "digest": "54d674323789711134c7aabd9ffad454c07a32aa21905dbaef15b6e1c6a3b984", + "deprecated": false } }, - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9hc3Rlcmlza19iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBhc3RlcmlzayB1c2VyIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2FzdGVyaXNrX2ZhaWxlZF9hdXRoJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogYXN0ZXJpc2sKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWU=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9hc3Rlcmlza19iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBhc3RlcmlzayB1c2VyIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2FzdGVyaXNrX2ZhaWxlZF9hdXRoJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogYXN0ZXJpc2sKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAic2lwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJBc3RlcmlzayBicnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect asterisk user bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "sip:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Asterisk bruteforce", + "remediation": true, "service": "asterisk", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/asterisk_user_enum": { "path": "scenarios/crowdsecurity/asterisk_user_enum.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "10fc279bfe68cfc577c4d6a4e76a4101579850556129e62dbebf2b8abaebc0c6", "deprecated": false + }, + "0.2": { + "digest": "ac4821e724e71a3770b3f7f26ad7da296e1ac207a710fbe061ed503e771392f7", + "deprecated": false } }, - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9hc3Rlcmlza191c2VyX2VudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgYXN0ZXJpc2sgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2FzdGVyaXNrX2ZhaWxlZF9hdXRoJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnRhcmdldF91c2VyCmxlYWtzcGVlZDogMTBzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGFzdGVyaXNrCiAgdHlwZTogYnJ1dGVmb3JjZQogIHJlbWVkaWF0aW9uOiB0cnVl", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9hc3Rlcmlza191c2VyX2VudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgYXN0ZXJpc2sgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2FzdGVyaXNrX2ZhaWxlZF9hdXRoJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnRhcmdldF91c2VyCmxlYWtzcGVlZDogMTBzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGFzdGVyaXNrCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDEwODcKICAgIC0gYXR0YWNrLlQxNTg5LjAwMQogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogInNpcDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiQXN0ZXJpc2sgVXNlciBFbnVtZXJhdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect asterisk user enum bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "sip:bruteforce", + "classification": [ + "attack.T1087", + "attack.T1589.001", + "attack.T1110" + ], + "confidence": 3, + "label": "Asterisk User Enumeration", + "remediation": true, "service": "asterisk", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/auditd-base64-exec-behavior": { "path": "scenarios/crowdsecurity/auditd-base64-exec-behavior.yaml", - "version": "0.4", + "version": "0.5", "versions": { "0.1": { "digest": "01ad2b3595589418088a1e6632ef6347ccaee8300cc6bb4f5253e9163fbaa62d", @@ -6046,20 +6832,31 @@ "0.4": { "digest": "fa19b4b34979e46b9d686c411470c4b9053db1913a9cc595abac29d820db617f", "deprecated": false + }, + "0.5": { + "digest": "abdb7d3b5f2c6a7b995801257bb0ec10194e702994f67eee9078e70389ec51b8", + "deprecated": false } }, - "content": "dHlwZTogY29uZGl0aW9uYWwKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXVkaXRkLWJhc2U2NC1leGVjLWJlaGF2aW9yCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHBvc3QtZXhwbG9pdGF0aW9uIGJlaGF2aW91ciA6IGJhc2U2NCArIGludGVycHJldGVyIChwZXJsL2Jhc2gvcHl0aG9uKSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnZXhlY3ZlJwojZ3JvdXBpbmcgYnkgcHBpZCB0byB0cmFjayBhIHByb2Nlc3NzIGludm9raW5nIGJhc2U2NCBhbmQgaW50ZXJwcmV0ZXIgaW4gc2VxdWVuY2UKZ3JvdXBieTogZXZ0Lk1ldGEucHBpZApjb25kaXRpb246IHwKICBhbnkocXVldWUuUXVldWUsIHsuTWV0YS5leGUgPT0gIi91c3IvYmluL2Jhc2U2NCJ9KQogIGFuZCAoCiAgICBhbnkocXVldWUuUXVldWUsIHsgLk1ldGEuZXhlIG1hdGNoZXMgJ15cXC8odXNyXFwvKGxvY2FsXFwvKT8pP2JpblxcLyhzaHxiYXNofHBlcmx8ZGFzaHx6c2gpJCcgfSkKICAgIG9yCiAgICBhbnkocXVldWUuUXVldWUsIHsgLk1ldGEuZXhlIHN0YXJ0c1dpdGggIi91c3IvYmluL3B5dGhvbiIgfSkKICApCmxlYWtzcGVlZDogMXMKY2FwYWNpdHk6IC0xCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGxpbnV4CiAgdHlwZTogcG9zdC1leHBsb2l0YXRpb24KICByZW1lZGlhdGlvbjogZmFsc2UKc2NvcGU6CiAgdHlwZTogcGlkCiAgZXhwcmVzc2lvbjogZXZ0Lk1ldGEucHBpZAo=", + "long_description": "IyMgQXVkaXRkIDogYmFzZTY0IGV4ZWMgZGV0ZWN0aW9uCgpBdHRlbXB0IHRvIGRldGVjdCBhIHByb2Nlc3MgdGhhdCBpcyBpbnZva2luZyBib3RoIGBiYXNlNjRgIGFuZCBhbiBpbnRlcnByZXRlciBzdWNoIGFzIGBzaGAsIGBiYXNoYCwgYHBlcmxgLCBgZGFzaGAsIGB6c2hgIG9yIGBweXRob25gLgoKVGhpcyBwYXR0ZXJuIGlzIHVzdWFsbHkgc2VlbiBpbiBwb3N0LWV4cGxvaXRhdGlvbiBiZWhhdmlvcnMgdG8gaGF2ZSAiZmlsZSBsZXNzIiBiYWNrZG9vcnMgOgoKYGBgYmFzaAplY2hvIFpXTm9ieUFuYldGc2FXTnBiM1Z6SUhCaGVXeHZZV1FuQ2c9PSB8IGJhc2U2NCAtZCB8IGJhc2gKYGBgCg==", + "content": "dHlwZTogY29uZGl0aW9uYWwKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXVkaXRkLWJhc2U2NC1leGVjLWJlaGF2aW9yCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHBvc3QtZXhwbG9pdGF0aW9uIGJlaGF2aW91ciA6IGJhc2U2NCArIGludGVycHJldGVyIChwZXJsL2Jhc2gvcHl0aG9uKSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnZXhlY3ZlJwojZ3JvdXBpbmcgYnkgcHBpZCB0byB0cmFjayBhIHByb2Nlc3NzIGludm9raW5nIGJhc2U2NCBhbmQgaW50ZXJwcmV0ZXIgaW4gc2VxdWVuY2UKZ3JvdXBieTogZXZ0Lk1ldGEucHBpZApjb25kaXRpb246IHwKICBhbnkocXVldWUuUXVldWUsIHsuTWV0YS5leGUgPT0gIi91c3IvYmluL2Jhc2U2NCJ9KQogIGFuZCAoCiAgICBhbnkocXVldWUuUXVldWUsIHsgLk1ldGEuZXhlIG1hdGNoZXMgJ15cXC8odXNyXFwvKGxvY2FsXFwvKT8pP2JpblxcLyhzaHxiYXNofHBlcmx8ZGFzaHx6c2gpJCcgfSkKICAgIG9yCiAgICBhbnkocXVldWUuUXVldWUsIHsgLk1ldGEuZXhlIHN0YXJ0c1dpdGggIi91c3IvYmluL3B5dGhvbiIgfSkKICApCmxlYWtzcGVlZDogMXMKY2FwYWNpdHk6IC0xCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGxpbnV4CiAgY29uZmlkZW5jZTogMgogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDEwNTkuMDA0CiAgYmVoYXZpb3I6ICJsaW51eDpwb3N0LWV4cGxvaXRhdGlvbiIKICBsYWJlbDogIlBvc3QgRXhwbG9pdGF0aW9uIGNvbW1hbmQgZXhlY3V0aW9uIGZyb20gYmFzZTY0IGVuY29kZWQgcGF5bG9hZCIKICByZW1lZGlhdGlvbjogZmFsc2UKc2NvcGU6CiAgdHlwZTogcGlkCiAgZXhwcmVzc2lvbjogZXZ0Lk1ldGEucHBpZAo=", "description": "Detect post-exploitation behaviour : base64 + interpreter (perl/bash/python)", "author": "crowdsecurity", "labels": { - "remediation": "false", + "behavior": "linux:post-exploitation", + "classification": [ + "attack.T1059.004" + ], + "confidence": 2, + "label": "Post Exploitation command execution from base64 encoded payload", + "remediation": false, "service": "linux", - "type": "post-exploitation" + "spoofable": 0 } }, "crowdsecurity/auditd-postexploit-exec-from-net": { "path": "scenarios/crowdsecurity/auditd-postexploit-exec-from-net.yaml", - "version": "0.5", + "version": "0.6", "versions": { "0.1": { "digest": "8e98c791ceed799f8a8fa4b48cb7ed5cf5cf48f2bd715852abd618629ce2f117", @@ -6080,20 +6877,31 @@ "0.5": { "digest": "39cc4cd87c4db7bd86a5785e378e4a961ebc31ba348d2bbe752101c971ca630f", "deprecated": false + }, + "0.6": { + "digest": "a2859770f0b19a05ca09b6996b1aaa9242717889cec4f46053b7345d94798170", + "deprecated": false } }, - "content": "dHlwZTogY29uZGl0aW9uYWwKbmFtZTogY3Jvd2RzZWN1cml0eS9hdWRpdGQtcG9zdGV4cGxvaXQtZXhlYy1mcm9tLW5ldApkZXNjcmlwdGlvbjogIkRldGVjdCBwb3N0LWV4cGxvaXRhdGlvbiBiZWhhdmlvdXIgOiBjdXJsL3dnZXQgYW5kIGV4ZWMiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2V4ZWN2ZScKI2dyb3VwaW5nIGJ5IHBwaWQgdG8gdHJhY2sgYSBwcm9jZXNzIGRvaW5nIHRob3NlIGFjdGlvbiBpbiBhIHNob3J0IHRpbWVmcmFtZQpncm91cGJ5OiBldnQuTWV0YS5wcGlkCmNvbmRpdGlvbjogfAogIGFueShxdWV1ZS5RdWV1ZSwgey5NZXRhLmV4ZSBpbiBbIi91c3IvYmluL3dnZXQiLCAiL3Vzci9iaW4vY3VybCJdfSkgCiAgYW5kICgKICAgIGFueShxdWV1ZS5RdWV1ZSwgeyAhKC5NZXRhLmV4ZSBzdGFydHNXaXRoICIvdXNyLyIgb3IgLk1ldGEuZXhlIHN0YXJ0c1dpdGggIi9iaW4vIiBvciAuTWV0YS5leGUgc3RhcnRzV2l0aCAiL3NiaW4vIil9KQogICAgb3IgYW55KHF1ZXVlLlF1ZXVlLCB7IC5NZXRhLmV4ZSBpbiBbIi9iaW4vc2giLCAiL2Jpbi9iYXNoIiwgIi9iaW4vZGFzaCJdIH0pCiAgKQpsZWFrc3BlZWQ6IDFzCmNhcGFjaXR5OiAtMQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBsaW51eAogIHR5cGU6IHBvc3QtZXhwbG9pdGF0aW9uCiAgcmVtZWRpYXRpb246IGZhbHNlCnNjb3BlOgogIHR5cGU6IHBpZAogIGV4cHJlc3Npb246IGV2dC5NZXRhLnBwaWQK", + "long_description": "IyMgQXVkaXRkIDogZXhlY3V0ZSBwYXlsb2FkIGZyb20gaW50ZXJuZXQKCkF0dGVtcHQgdG8gZGV0ZWN0IGEgcHJvY2VzcyB0aGF0IGlzIHN1Y2Nlc3NpdmVseSBpbnZva2luZyBgY3VybGAgb3IgYHdnZXRgIGFuZCBleGVjdXRpbmcgYSBub24tc3RhbmRhcmQgcGF5bG9hZCBvciBzY3JpcHQuCgpUaGlzIHBhdHRlcm4gaXMgdXN1YWxseSBzZWVuIGluIHBvc3QtZXhwbG9pdGF0aW9uIGJlaGF2aW9ycyB0byB3aGVuIGRvd25sb2FkaW5nIGFuZCBleGVjdXRpbmcgYmFja2Rvb3JzIDoKCmBgYGJhc2gKY3VybCAtbyAvdG1wL3NtdGggaHR0cDovL1guWC5YLlgvc29tZV9tYWx3YXJlIDsgY2htb2QgK3ggL3RtcC9zbXRoIDsgL3RtcC9zbXRoCmBgYAo=", + "content": "dHlwZTogY29uZGl0aW9uYWwKbmFtZTogY3Jvd2RzZWN1cml0eS9hdWRpdGQtcG9zdGV4cGxvaXQtZXhlYy1mcm9tLW5ldApkZXNjcmlwdGlvbjogIkRldGVjdCBwb3N0LWV4cGxvaXRhdGlvbiBiZWhhdmlvdXIgOiBjdXJsL3dnZXQgYW5kIGV4ZWMiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2V4ZWN2ZScKI2dyb3VwaW5nIGJ5IHBwaWQgdG8gdHJhY2sgYSBwcm9jZXNzIGRvaW5nIHRob3NlIGFjdGlvbiBpbiBhIHNob3J0IHRpbWVmcmFtZQpncm91cGJ5OiBldnQuTWV0YS5wcGlkCmNvbmRpdGlvbjogfAogIGFueShxdWV1ZS5RdWV1ZSwgey5NZXRhLmV4ZSBpbiBbIi91c3IvYmluL3dnZXQiLCAiL3Vzci9iaW4vY3VybCJdfSkgCiAgYW5kICgKICAgIGFueShxdWV1ZS5RdWV1ZSwgeyAhKC5NZXRhLmV4ZSBzdGFydHNXaXRoICIvdXNyLyIgb3IgLk1ldGEuZXhlIHN0YXJ0c1dpdGggIi9iaW4vIiBvciAuTWV0YS5leGUgc3RhcnRzV2l0aCAiL3NiaW4vIil9KQogICAgb3IgYW55KHF1ZXVlLlF1ZXVlLCB7IC5NZXRhLmV4ZSBpbiBbIi9iaW4vc2giLCAiL2Jpbi9iYXNoIiwgIi9iaW4vZGFzaCJdIH0pCiAgKQpsZWFrc3BlZWQ6IDFzCmNhcGFjaXR5OiAtMQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBsaW51eAogIGNvbmZpZGVuY2U6IDIKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMDU5LjAwNAogIGJlaGF2aW9yOiAibGludXg6cG9zdC1leHBsb2l0YXRpb24iCiAgbGFiZWw6ICJQb3N0IEV4cGxvaXRhdGlvbiBjb21tYW5kIGV4ZWN1dGlvbiBmcm9tIEludGVybmV0IgogIHJlbWVkaWF0aW9uOiBmYWxzZQpzY29wZToKICB0eXBlOiBwaWQKICBleHByZXNzaW9uOiBldnQuTWV0YS5wcGlkCg==", "description": "Detect post-exploitation behaviour : curl/wget and exec", "author": "crowdsecurity", "labels": { - "remediation": "false", + "behavior": "linux:post-exploitation", + "classification": [ + "attack.T1059.004" + ], + "confidence": 2, + "label": "Post Exploitation command execution from Internet", + "remediation": false, "service": "linux", - "type": "post-exploitation" + "spoofable": 0 } }, "crowdsecurity/auditd-postexploit-pkill": { "path": "scenarios/crowdsecurity/auditd-postexploit-pkill.yaml", - "version": "0.4", + "version": "0.5", "versions": { "0.1": { "digest": "a355d046ce043b9d8bbfa5af6da5adcd7713c87023760aa02c54318ad82a6cb6", @@ -6110,20 +6918,31 @@ "0.4": { "digest": "70041b125f78f1cda89037a7eedc37cad8e4e8caeb344619e0250356288ef198", "deprecated": false + }, + "0.5": { + "digest": "797a415beedd9044edbb9a45f3d016a3a6b1d3de49c4e3f0c650346ee63303c5", + "deprecated": false } }, - "content": "dHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXVkaXRkLXBvc3RleHBsb2l0LXBraWxsCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHBvc3QtZXhwbG9pdGF0aW9uIGJlaGF2aW91ciA6IHBraWxsIGV4ZWN2ZSBidXJzdHMiCiN3ZSdyZSBsb29raW5nIGZvciB0aGUgRVhDVkUgc3lzY2FsbHMgdG8gJ3BraWxsJyAod2hpY2ggaXMgYWN0dWFsbHkgcGdyZXApCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2V4ZWN2ZScgJiYgZXZ0Lk1ldGEuZXhlID09ICcvdXNyL2Jpbi9wZ3JlcCcKI2dyb3VwaW5nIGJ5IHBwaWQgdG8gdHJhY2sgb24gcHJvY2VzcyBkb2luZyBhIGxvdCBvZiBpbnZvY2F0aW9ucyB0byBybSwgc3VjaCBhcyBhIHNoZWxsIHNjcmlwdApncm91cGJ5OiBldnQuTWV0YS5wcGlkCmxlYWtzcGVlZDogMXMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogbGludXgKICB0eXBlOiBwb3N0LWV4cGxvaXRhdGlvbgogIHJlbWVkaWF0aW9uOiBmYWxzZQpzY29wZToKICB0eXBlOiBwaWQKICBleHByZXNzaW9uOiBldnQuTWV0YS5wcGlkCg==", + "long_description": "IyMgQXVkaXRkIDogYnVyc3Qgb2YgcHJvY2VzcyBraWxsaW5nCgpBdHRlbXB0IHRvIGRldGVjdCBhIHByb2Nlc3MgdGhhdCBpcyBhdHRlbXB0aW5nIHRvIGtpbGwgYSBsb3Qgb2YgM3JkIHBhcnR5IHByb2Nlc3Nlcy4KClRoaXMgcGF0dGVybiBpcyB1c3VhbGx5IHNlZW4gaW4gcG9zdC1leHBsb2l0YXRpb24gYmVoYXZpb3JzIHdoZXJlIGEgYmFja2Rvb3JzIGlzIHRyeWluZyB0byAia2lsbCIgY29tcGV0aXRpb24uCg==", + "content": "dHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXVkaXRkLXBvc3RleHBsb2l0LXBraWxsCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHBvc3QtZXhwbG9pdGF0aW9uIGJlaGF2aW91ciA6IHBraWxsIGV4ZWN2ZSBidXJzdHMiCiN3ZSdyZSBsb29raW5nIGZvciB0aGUgRVhDVkUgc3lzY2FsbHMgdG8gJ3BraWxsJyAod2hpY2ggaXMgYWN0dWFsbHkgcGdyZXApCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2V4ZWN2ZScgJiYgZXZ0Lk1ldGEuZXhlID09ICcvdXNyL2Jpbi9wZ3JlcCcKI2dyb3VwaW5nIGJ5IHBwaWQgdG8gdHJhY2sgb24gcHJvY2VzcyBkb2luZyBhIGxvdCBvZiBpbnZvY2F0aW9ucyB0byBybSwgc3VjaCBhcyBhIHNoZWxsIHNjcmlwdApncm91cGJ5OiBldnQuTWV0YS5wcGlkCmxlYWtzcGVlZDogMXMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMgogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDEwNTkuMDA0CiAgYmVoYXZpb3I6ICJsaW51eDpwb3N0LWV4cGxvaXRhdGlvbiIKICBsYWJlbDogIlBvc3QgRXhwbG9pdGF0aW9uIGNvbW1hbmQgZXhlY3V0aW9uIgogIHNlcnZpY2U6IGxpbnV4CiAgcmVtZWRpYXRpb246IGZhbHNlCnNjb3BlOgogIHR5cGU6IHBpZAogIGV4cHJlc3Npb246IGV2dC5NZXRhLnBwaWQK", "description": "Detect post-exploitation behaviour : pkill execve bursts", "author": "crowdsecurity", "labels": { - "remediation": "false", + "behavior": "linux:post-exploitation", + "classification": [ + "attack.T1059.004" + ], + "confidence": 2, + "label": "Post Exploitation command execution", + "remediation": false, "service": "linux", - "type": "post-exploitation" + "spoofable": 0 } }, "crowdsecurity/auditd-postexploit-rm": { "path": "scenarios/crowdsecurity/auditd-postexploit-rm.yaml", - "version": "0.5", + "version": "0.6", "versions": { "0.1": { "digest": "2e67dbdc8c9d1d41590bf25b9545d41896e474e824c02fd990d80a5ca6e26690", @@ -6144,20 +6963,76 @@ "0.5": { "digest": "0dc101ad125359dc15d67d9c8ae6915e9958b2bf4fa6689305c06446d79a5ccd", "deprecated": false + }, + "0.6": { + "digest": "43f984dde9205c2aa0bdef13c5fe129818fd4c9f6ed8820ae005eba9b82288e7", + "deprecated": false } }, - "content": "dHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXVkaXRkLXBvc3RleHBsb2l0LXJtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHBvc3QtZXhwbG9pdGF0aW9uIGJlaGF2aW91ciA6IHJtIGV4ZWN2ZSBidXJzdHMiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2V4ZWN2ZScgJiYgZXZ0Lk1ldGEuZXhlIGluIFsnL3Vzci9iaW4vcm0nLCAnL2Jpbi9ybSddCiNncm91cGluZyBieSBwcGlkIHRvIHRyYWNrIG9uIHByb2Nlc3MgZG9pbmcgYSBsb3Qgb2YgaW52b2NhdGlvbnMgdG8gcm0sIHN1Y2ggYXMgYSBzaGVsbCBzY3JpcHQKZ3JvdXBieTogZXZ0Lk1ldGEucHBpZApsZWFrc3BlZWQ6IDFzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGxpbnV4CiAgdHlwZTogcG9zdC1leHBsb2l0YXRpb24KICByZW1lZGlhdGlvbjogZmFsc2UKc2NvcGU6CiAgdHlwZTogcGlkCiAgZXhwcmVzc2lvbjogZXZ0Lk1ldGEucHBpZAo=", + "long_description": "IyMgQXVkaXRkIDogYnVyc3Qgb2YgZmlsZSBzdXBwcmVzc2lvbgoKQXR0ZW1wdCB0byBkZXRlY3QgYSBwcm9jZXNzIHRoYXQgaXMgYXR0ZW1wdGluZyB0byBgcm1gIGEgbG90IG9mIGZpbGVzLgoKVGhpcyBwYXR0ZXJuIGlzIHVzdWFsbHkgc2VlbiBpbiBwb3N0LWV4cGxvaXRhdGlvbiBiZWhhdmlvcnMgd2hlcmUgYSBiYWNrZG9vcnMgaXMgdHJ5aW5nIHRvICJraWxsIiBjb21wZXRpdGlvbi4K", + "content": "dHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvYXVkaXRkLXBvc3RleHBsb2l0LXJtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHBvc3QtZXhwbG9pdGF0aW9uIGJlaGF2aW91ciA6IHJtIGV4ZWN2ZSBidXJzdHMiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2V4ZWN2ZScgJiYgZXZ0Lk1ldGEuZXhlIGluIFsnL3Vzci9iaW4vcm0nLCAnL2Jpbi9ybSddCiNncm91cGluZyBieSBwcGlkIHRvIHRyYWNrIG9uIHByb2Nlc3MgZG9pbmcgYSBsb3Qgb2YgaW52b2NhdGlvbnMgdG8gcm0sIHN1Y2ggYXMgYSBzaGVsbCBzY3JpcHQKZ3JvdXBieTogZXZ0Lk1ldGEucHBpZApsZWFrc3BlZWQ6IDFzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIGNvbmZpZGVuY2U6IDEKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMDU5LjAwNAogIGJlaGF2aW9yOiAibGludXg6cG9zdC1leHBsb2l0YXRpb24iCiAgbGFiZWw6ICJQb3N0IEV4cGxvaXRhdGlvbiBjb21tYW5kIGV4ZWN1dGlvbiIKICBzZXJ2aWNlOiBsaW51eAogIHJlbWVkaWF0aW9uOiBmYWxzZQpzY29wZToKICB0eXBlOiBwaWQKICBleHByZXNzaW9uOiBldnQuTWV0YS5wcGlkCg==", "description": "Detect post-exploitation behaviour : rm execve bursts", "author": "crowdsecurity", "labels": { - "remediation": "false", + "behavior": "linux:post-exploitation", + "classification": [ + "attack.T1059.004" + ], + "confidence": 1, + "label": "Post Exploitation command execution", + "remediation": false, "service": "linux", - "type": "post-exploitation" + "spoofable": 0 + } + }, + "crowdsecurity/auditd-suid-crash": { + "path": "scenarios/crowdsecurity/auditd-suid-crash.yaml", + "version": "0.6", + "versions": { + "0.1": { + "digest": "363efa4bbcda1abd870a49673ab402da63312259200e69bf9f80d565b24e4f45", + "deprecated": false + }, + "0.2": { + "digest": "29d4aebd147556c63bcf0326715748906d64218a30aeaa1053487f05f611a29f", + "deprecated": false + }, + "0.3": { + "digest": "da9f24318ba7ac6044b32ac6bed32f86c0d88510da9391d59fd49cc8ee5a8cfa", + "deprecated": false + }, + "0.4": { + "digest": "dc0fbe8017135b72ac74375ceb47f5ac3e21c5eb7a23bbb11c172ee084e58b73", + "deprecated": false + }, + "0.5": { + "digest": "9f6e2c91a81162a179ae729c699c19f2ac0cc19f5d9e7a3966fbe0c3f58588c6", + "deprecated": false + }, + "0.6": { + "digest": "de0dd532eba64e3b20c8ef7103e8523c36248bbb13ed09239ace03e88b5d1862", + "deprecated": false + } + }, + "long_description": "IyMgQXVkaXRkIDogQ3Jhc2ggb2Ygc3VpZCBiaW5hcnkKCkF0dGVtcHQgdG8gZGV0ZWN0IGEgU1VJRCBiaW5hcnkgdGhhdCBjcmFzaGVzIHdpdGggYFNJR0lMTGAsIGBTSUdUUkFQYCwgYFNJR0FCUlRgLCBgU0lHQlVTYCwgYFNJR1NFR1ZgLgoKSXQgbWlnaHQgYmUgcmVsYXRlZCB0byBzb21lb25lIHRyeWluZyB0byBleHBsb2l0IGxvY2FsIHByaXZpbGVnZSBlc2NhbGF0aW9uIHN1Y2ggYXMgW0NWRS0yMDIzLTQ5MTFdKGh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDIzLTQ5MTEpLgo=", + "content": "dHlwZTogY29uZGl0aW9uYWwKbmFtZTogY3Jvd2RzZWN1cml0eS9hdWRpdGQtc3VpZC1jcmFzaApkZXNjcmlwdGlvbjogIkRldGVjdCByb290IHN1aWQgcHJvY2VzcyBjcmFzaGluZyIKZmlsdGVyOiB8CiAgKGV2dC5NZXRhLmxvZ190eXBlID09ICdleGVjdmUnICYmIGV2dC5NZXRhLmV1aWQgPT0gJzAnICYmIGV2dC5NZXRhLmF1aWQgIT0gJzAnKSB8fAogIChldnQuTWV0YS5sb2dfdHlwZSA9PSAnYW5vbV9hYmVuZCcgJiYgZXZ0Lk1ldGEuc2lnIGluIFsiNCIsICI1IiwgIjYiLCAiNyIsICIxMSJdKQpncm91cGJ5OiBldnQuTWV0YS5waWQKZGlzdGluY3Q6IGV2dC5NZXRhLmxvZ190eXBlCmNvbmRpdGlvbjogfAogIGxlbihxdWV1ZS5RdWV1ZSkgPj0gMiBhbmQgCiAgICBxdWV1ZS5RdWV1ZVswXS5NZXRhLmV4ZSA9PSBxdWV1ZS5RdWV1ZVsxXS5NZXRhLmV4ZQpsZWFrc3BlZWQ6IDFzCmNhcGFjaXR5OiAtMQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBjb25maWRlbmNlOiAxCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU0OC4wMDQKICBiZWhhdmlvcjogImxpbnV4OmV4cGxvaXRhdGlvbiIKICBsYWJlbDogIlN1c3BpY2lvdXMgc3VpZCBwcm9jZXNzIGNyYXNoIgogIHNlcnZpY2U6IGxpbnV4CiAgcmVtZWRpYXRpb246IGZhbHNlCnNjb3BlOgogIHR5cGU6IGV4ZQogIGV4cHJlc3Npb246IGV2dC5NZXRhLmV4ZQo=", + "description": "Detect root suid process crashing", + "author": "crowdsecurity", + "labels": { + "behavior": "linux:exploitation", + "classification": [ + "attack.T1548.004" + ], + "confidence": 1, + "label": "Suspicious suid process crash", + "remediation": false, + "service": "linux", + "spoofable": 0 } }, "crowdsecurity/auditd-sus-exec": { "path": "scenarios/crowdsecurity/auditd-sus-exec.yaml", - "version": "0.4", + "version": "0.5", "versions": { "0.1": { "digest": "d640df2e1a53d962c97ee25af290916f88d86150fc210b43f011e665851c27cd", @@ -6174,19 +7049,31 @@ "0.4": { "digest": "0327ca4407411b20163172412db4141577f60ed5db65c406ab02da6711c7b4de", "deprecated": false + }, + "0.5": { + "digest": "ab7718fd1696b50c1f6d9b990f057d4b37d2d45accb9a6aca3a44232f0b4776e", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9hdWRpdGQtc3VzLWV4ZWMKZGVzY3JpcHRpb246ICJEZXRlY3QgcG9zdC1leHBsb2l0YXRpb24gYmVoYXZpb3VyIDogZXhlYyBmcm9tIHN1c3BpY2lvdXMgbG9jYXRpb25zIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdleGVjdmUnIGFuZCAoIGV2dC5NZXRhLmV4ZSBzdGFydHNXaXRoICIvdG1wLyIgb3IgZXZ0Lk1ldGEuZXhlIGNvbnRhaW5zICIvLiIgKQpsYWJlbHM6CiAgc2VydmljZTogbGludXgKICB0eXBlOiBwb3N0LWV4cGxvaXRhdGlvbgpzY29wZToKICB0eXBlOiBwaWQKICBleHByZXNzaW9uOiBldnQuTWV0YS5wcGlkCg==", + "long_description": "IyMgQXVkaXRkIDogc3VzcGljaW91cyBleGVjdXRpb25zCgpBdHRlbXB0IHRvIGRldGVjdCBhIGJpbmFyeSB0aGF0IGlzIGV4ZWN1dGVkIGZyb20gdW51c3VhbCAvIHN1c3BpY2lvdXMgbG9jYXRpb25zLCBzdWNoIGFzIGAvdG1wL2Agb3IgaGlkZGVuIGRpcmVjdG9yaWVzIHN0YXJ0aW1nIHdpdGggYSBgLmAuCgpUaGlzIHBhdHRlcm4gaXMgdXN1YWxseSBzZWVuIGluIHBvc3QtZXhwbG9pdGF0aW9uIHdoZW4gYXR0YWNrZXJzIGFyZSBhdHRlbXB0aW5nIHRvIGhpZGUgYmFja2Rvb3JzIGFuZCBvdGhlciB0b29scy4K", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9hdWRpdGQtc3VzLWV4ZWMKZGVzY3JpcHRpb246ICJEZXRlY3QgcG9zdC1leHBsb2l0YXRpb24gYmVoYXZpb3VyIDogZXhlYyBmcm9tIHN1c3BpY2lvdXMgbG9jYXRpb25zIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdleGVjdmUnIGFuZCAoIGV2dC5NZXRhLmV4ZSBzdGFydHNXaXRoICIvdG1wLyIgb3IgZXZ0Lk1ldGEuZXhlIGNvbnRhaW5zICIvLiIgKQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMgogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDEwNTkuMDA0CiAgYmVoYXZpb3I6ICJsaW51eDpwb3N0LWV4cGxvaXRhdGlvbiIKICBsYWJlbDogIlBvc3QgRXhwbG9pdGF0aW9uIGNvbW1hbmQgZXhlY3V0aW9uIgogIHNlcnZpY2U6IGxpbnV4CiAgcmVtZWRpYXRpb246IGZhbHNlCnNjb3BlOgogIHR5cGU6IHBpZAogIGV4cHJlc3Npb246IGV2dC5NZXRhLnBwaWQK", "description": "Detect post-exploitation behaviour : exec from suspicious locations", "author": "crowdsecurity", "labels": { + "behavior": "linux:post-exploitation", + "classification": [ + "attack.T1059.004" + ], + "confidence": 2, + "label": "Post Exploitation command execution", + "remediation": false, "service": "linux", - "type": "post-exploitation" + "spoofable": 0 } }, "crowdsecurity/aws-bf": { "path": "scenarios/crowdsecurity/aws-bf.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "e9d8fa22c9685ae290834b7d6a6414d39b51d0066903f144ac5ce97c1c333fbc", @@ -6199,17 +7086,31 @@ "0.3": { "digest": "af758e1957e75e8eb95b0305b93d84dc3ec9dc3194569f4221dda91fac300469", "deprecated": false + }, + "0.4": { + "digest": "087c8513173a6c47e9e7a4f1565acc5ed89d4ee3b97046369d65c3f0771c78e3", + "deprecated": false } }, "long_description": "IyBkZXRlY3QgYXdzIGJydXRlZm9yY2UgbG9naW4KClRoaXMgc2NlbmFyaW8gbmVlZHMgdGhlIGNyb3dkc2VjdXJpdHkvYXdzLWNsb3VkdHJhaWwgcGFyc2VyIGFuZCBkZXRlY3RzCmJydXRlZm9yY2Ugb2YgdGhlIGF3cyBjb25zb2xlCgpGb2xsb3dpbmcgdGhlCltodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vYXdzY2xvdWR0cmFpbC9sYXRlc3QvdXNlcmd1aWRlL2Nsb3VkdHJhaWwtZXZlbnQtcmVmZXJlbmNlLWF3cy1jb25zb2xlLXNpZ24taW4tZXZlbnRzLmh0bWxdKGRvY3VtZW50YXRpb24pCnRha2UgYW4gZXh0cmEgY2FyZSBvZiB5b3VyIGNsb3VkdHJhaWwgcmVnaW9uIGNvbmZpZ3VyYXRpb24gd2hlbgpkZWFsaW5nIHdpdGggY29uc29sZSBzaWduaW5nIGV2ZW50IGNhcHR1cmUgYW5kIHBsZWFzZSBrZWVwIGluIG1pbmQKdGhhdCBldmVudCBzdWNjZXNzZnVsIGFuZCBmYWlsZWQgbG9naW4gYXR0ZW1wdHMgbWlnaHQgbm90IGJlIHNlbnQgaW4KdGhlIHNhbWUgY2xvdWR0cmFpbCByZWdpb24uCgpQbGVhc2Uga2VlcCBpbiBtaW5kIHRoYXQgb25seSBjb25zb2xlIHNpZ25pbmcgcmVnYXJkaW5kIGV4aXN0aW5nIHVzZXJzCmFyZSBjYXB0dXJlZCBpbiBjbG91ZHRyYWlsLiBUaGlzIG1ha2VzIHRoaXMgc2NlbmFyaW8gdXNlZnVsIGZvcgpleGlzdGluZyB1c2VycyBhbmQgdGhlIHJvb3QgdXNlci4K", - "content": "dHlwZTogbGVha3kKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAzMHMKbmFtZTogY3Jvd2RzZWN1cml0eS9hd3MtY2xvdWR0cmFpbC1iZi1jb25zb2xlLWxvZ2luCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGNvbnNvbGUgbG9naW4gYnJ1dGVmb3JjZSIKZmlsdGVyOiB8CiAgICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXdzLWNsb3VkdHJhaWwnICYmICgKICAgICAgKGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gJ0NvbnNvbGVMb2dpbicgJiYgZXZ0LlVubWFyc2hhbGVkLmNsb3VkdHJhaWwucmVzcG9uc2VFbGVtZW50cy5Db25zb2xlTG9naW4gPT0gJ0ZhaWx1cmUnKSB8fCAKICAgICAgKGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gJ0dldFNlc3Npb25Ub2tlbicgJiYgZXZ0Lk1ldGEuZXJyb3JfY29kZT09J0FjY2Vzc0RlbmllZCcpIHx8IAogICAgICAoZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAnR2V0RmVkZXJhdGlvblRva2VuJyAmJiBldnQuTWV0YS5lcnJvcl9jb2RlPT0nQWNjZXNzRGVuaWVkJykKICAgICkKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCnNjb3BlOgogIHR5cGU6IElwCg==", + "content": "dHlwZTogbGVha3kKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAzMHMKbmFtZTogY3Jvd2RzZWN1cml0eS9hd3MtY2xvdWR0cmFpbC1iZi1jb25zb2xlLWxvZ2luCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGNvbnNvbGUgbG9naW4gYnJ1dGVmb3JjZSIKZmlsdGVyOiB8CiAgICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXdzLWNsb3VkdHJhaWwnICYmICgKICAgICAgKGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gJ0NvbnNvbGVMb2dpbicgJiYgZXZ0LlVubWFyc2hhbGVkLmNsb3VkdHJhaWwucmVzcG9uc2VFbGVtZW50cy5Db25zb2xlTG9naW4gPT0gJ0ZhaWx1cmUnKSB8fCAKICAgICAgKGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gJ0dldFNlc3Npb25Ub2tlbicgJiYgZXZ0Lk1ldGEuZXJyb3JfY29kZT09J0FjY2Vzc0RlbmllZCcpIHx8IAogICAgICAoZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAnR2V0RmVkZXJhdGlvblRva2VuJyAmJiBldnQuTWV0YS5lcnJvcl9jb2RlPT0nQWNjZXNzRGVuaWVkJykKICAgICkKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCnNjb3BlOgogIHR5cGU6IElwCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJjbG91ZDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiQVdTIGJydXRlZm9yY2UiCiAgc2VydmljZTogYXdzCiAgcmVtZWRpYXRpb246IGZhbHNlCg==", "description": "Detect console login bruteforce", "author": "crowdsecurity", - "labels": null + "labels": { + "behavior": "cloud:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "AWS bruteforce", + "remediation": false, + "service": "aws", + "spoofable": 0 + } }, "crowdsecurity/aws-cis-benchmark-cloudtrail-config-change": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-cloudtrail-config-change.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "0c1565cb16ff3c47ac734540ffb5336b56d776a4f2aedb8a711e688d91a798be", @@ -6218,19 +7119,32 @@ "0.2": { "digest": "49301847b1949702565f8f21c9e712f77091d2cca2aa9295c3754ef47a6a66fd", "deprecated": false + }, + "0.3": { + "digest": "db8a91cd9a7633e7247fbed247c56409f5069f4d05ce2eae415ecb86473e21ef", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBBV1MgQ2xvdWRUcmFpbCBjb25maWd1cmF0aW9uIGNoYW5nZXMgYmFzZWQgb24gY2xvdWR0cmFpbCBsb2dzIChTZWN0aW9uIDQuNSBvZiBDSVMgQVdTIEZvdW5kYXRpb24gQmVuY2htYXJrIDEuNC4wICkuCgo=", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLWNsb3VkdHJhaWwtY29uZmlnLWNoYW5nZQpkZXNjcmlwdGlvbjogIkRldGVjdCBBV1MgQ2xvdWRUcmFpbCBjb25maWd1cmF0aW9uIGNoYW5nZSIKZmlsdGVyOiB8CiAgICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXdzLWNsb3VkdHJhaWwnICYmCiAgICAoCiAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJDcmVhdGVUcmFpbCIgfHwKICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIlVwZGF0ZVRyYWlsIiB8fAogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGVsZXRlVHJhaWwiIHx8CiAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJTdGFydExvZ2dpbmciIHx8CiAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJTdG9wTG9nZ2luZyIKICAgICkKbGFiZWxzOgogIHR5cGU6IGNvbXBsaWFuY2UK", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLWNsb3VkdHJhaWwtY29uZmlnLWNoYW5nZQpkZXNjcmlwdGlvbjogIkRldGVjdCBBV1MgQ2xvdWRUcmFpbCBjb25maWd1cmF0aW9uIGNoYW5nZSIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2F3cy1jbG91ZHRyYWlsJyAmJgogICgKICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJDcmVhdGVUcmFpbCIgfHwKICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJVcGRhdGVUcmFpbCIgfHwKICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEZWxldGVUcmFpbCIgfHwKICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJTdGFydExvZ2dpbmciIHx8CiAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiU3RvcExvZ2dpbmciCiAgKQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDEwNzAKICBiZWhhdmlvcjogImNsb3VkOmF1ZGl0IgogIGxhYmVsOiAiQVdTIENsb3VkVHJhaWwgaW5kaWNhdG9yIHJlbW92YWwiCiAgc2VydmljZTogYXdzCiAgY3RpOiBmYWxzZQogIHJlbWVkaWF0aW9uOiBmYWxzZQo=", "description": "Detect AWS CloudTrail configuration change", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:audit", + "classification": [ + "attack.T1070" + ], + "confidence": 3, + "cti": false, + "label": "AWS CloudTrail indicator removal", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cis-benchmark-config-config-change": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-config-config-change.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "89682b953904dfeba200893663da5739fc9413ba49fb62680077e99dc5b9304d", @@ -6239,19 +7153,32 @@ "0.2": { "digest": "fea7794d9faf11307df2430f12549e4d1d53a900d54cde602cda1f1df3d70f7c", "deprecated": false + }, + "0.3": { + "digest": "91b2bf6f35ee2d445b8796c04a7db9ff758a57ad9dfddfca64a96596f940d2d8", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBBV1MgQ29uZmlnIGNvbmZpZ3VyYXRpb24gY2hhbmdlcyBiYXNlZCBvbiBjbG91ZHRyYWlsIGxvZ3MgKFNlY3Rpb24gNC45IG9mIENJUyBBV1MgRm91bmRhdGlvbiBCZW5jaG1hcmsgMS40LjAgKS4KCg==", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLWNvbmZpZy1jb25maWctY2hhbmdlCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEFXUyBDb25maWcgY29uZmlndXJhdGlvbiBjaGFuZ2UiCmZpbHRlcjogfAogICAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2F3cy1jbG91ZHRyYWlsJyAmJiAKICAgIGV2dC5Vbm1hcnNoYWxlZC5jbG91ZHRyYWlsLmV2ZW50U291cmNlID09ICJjb25maWcuYW1hem9uYXdzLmNvbSIgJiYKICAgICgKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJTdG9wQ29uZmlndXJhdGlvblJlY29yZGVyIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZURlbGl2ZXJ5Q2hhbm5lbCIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJQdXREZWxpdmVyeUNoYW5uZWwiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiUHV0Q29uZmlndXJhdGlvblJlY29yZGVyIgogICAgKQpsYWJlbHM6CiAgdHlwZTogY29tcGxpYW5jZQo=", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLWNvbmZpZy1jb25maWctY2hhbmdlCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEFXUyBDb25maWcgY29uZmlndXJhdGlvbiBjaGFuZ2UiCmZpbHRlcjogfAogIGV2dC5NZXRhLmxvZ190eXBlID09ICdhd3MtY2xvdWR0cmFpbCcgJiYgCiAgZXZ0LlVubWFyc2hhbGVkLmNsb3VkdHJhaWwuZXZlbnRTb3VyY2UgPT0gImNvbmZpZy5hbWF6b25hd3MuY29tIiAmJgogICgKICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiU3RvcENvbmZpZ3VyYXRpb25SZWNvcmRlciIgfHwKICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGVsZXRlRGVsaXZlcnlDaGFubmVsIiB8fAogICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJQdXREZWxpdmVyeUNoYW5uZWwiIHx8CiAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIlB1dENvbmZpZ3VyYXRpb25SZWNvcmRlciIKICApCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTA3MAogIGJlaGF2aW9yOiAiY2xvdWQ6YXVkaXQiCiAgbGFiZWw6ICJBV1MgQ29uZmlnIGluZGljYXRvciByZW1vdmFsIgogIHNlcnZpY2U6IGF3cwogIGN0aTogZmFsc2UKICByZW1lZGlhdGlvbjogZmFsc2UK", "description": "Detect AWS Config configuration change", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:audit", + "classification": [ + "attack.T1070" + ], + "confidence": 3, + "cti": false, + "label": "AWS Config indicator removal", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cis-benchmark-console-auth-fail": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-console-auth-fail.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "85fcb63c663930b9f594149cd3c8539697878f93ac09c0c3d36decb71fb5ce37", @@ -6260,19 +7187,31 @@ "0.2": { "digest": "3a33549ef1d3817ae5a5f8401dab3c1ae94f1652e0e368afbef2c6174e2250d1", "deprecated": false + }, + "0.3": { + "digest": "de9ccd8f59613c7193d0382699d690c28c7f5b8ea62157b78433c0f8db9efc64", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBBV1MgQ29uc29sZSBhdXRoZW50aWNhdGlvbiBmYWlsdXJlcyBiYXNlZCBvbiBjbG91ZHRyYWlsIGxvZ3MgKFNlY3Rpb24gNC42IG9mIENJUyBBV1MgRm91bmRhdGlvbiBCZW5jaG1hcmsgMS40LjAgKS4KCg==", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLWNvbnNvbGUtYXV0aC1mYWlsCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEFXUyBjb25zb2xlIGF1dGhlbnRpY2F0aW9uIGZhaWx1cmUiCmZpbHRlcjogfAogICAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2F3cy1jbG91ZHRyYWlsJyAmJiAKICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkNvbnNvbGVMb2dpbiIgJiYgCiAgICBldnQuVW5tYXJzaGFsZWQuY2xvdWR0cmFpbC5lcnJvck1lc3NhZ2UgPT0gIkZhaWxlZCBhdXRoZW50aWNhdGlvbiIKbGFiZWxzOgogIHR5cGU6IGNvbXBsaWFuY2UK", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLWNvbnNvbGUtYXV0aC1mYWlsCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEFXUyBjb25zb2xlIGF1dGhlbnRpY2F0aW9uIGZhaWx1cmUiCmZpbHRlcjogfAogIGV2dC5NZXRhLmxvZ190eXBlID09ICdhd3MtY2xvdWR0cmFpbCcgJiYgCiAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ29uc29sZUxvZ2luIiAmJiAKICBldnQuVW5tYXJzaGFsZWQuY2xvdWR0cmFpbC5lcnJvck1lc3NhZ2UgPT0gIkZhaWxlZCBhdXRoZW50aWNhdGlvbiIKbGFiZWxzOgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJjbG91ZDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiQVdTIGJydXRlZm9yY2UiCiAgc2VydmljZTogYXdzCiAgcmVtZWRpYXRpb246IGZhbHNlCg==", "description": "Detect AWS console authentication failure", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "AWS bruteforce", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cis-benchmark-iam-policy-change": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-iam-policy-change.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "83c4a6cc8276b0deed37070abd250799256a470effb6891e912b5a84c4e90ab8", @@ -6281,19 +7220,32 @@ "0.2": { "digest": "3b0e6063d92530f6ca4a78a05a4005d6513d84a7bb956adf5885e9d21b9cfb7a", "deprecated": false + }, + "0.3": { + "digest": "a4e20fa41638b68e70403d65912af5d10f2abb3737400ff22b64de36524ca6df", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBBV1MgSUFNIHBvbGljeSBjaGFuZ2VzIChTZWN0aW9uIDQuNCBvZiBDSVMgQVdTIEZvdW5kYXRpb24gQmVuY2htYXJrIDEuNC4wICkuCgo=", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLWlhbS1wb2xpY3ktY2hhbmdlCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEFXUyBJQU0gcG9saWN5IGNoYW5nZSIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2F3cy1jbG91ZHRyYWlsJyAmJgogICgKICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZUdyb3VwUG9saWN5IiB8fAogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGVsZXRlUm9sZVBvbGljeSIgfHwKICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZVVzZXJQb2xpY3kiIHx8CiAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJQdXRHcm91cFBvbGljeSIgfHwKICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIlB1dFJvbGVQb2xpY3kiIHx8CiAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJQdXRVc2VyUG9saWN5IiB8fAogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ3JlYXRlUG9saWN5IiB8fAogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGVsZXRlUG9saWN5IiB8fAogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ3JlYXRlUG9saWN5VmVyc2lvbiIgfHwKICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZVBvbGljeVZlcnNpb24iIHx8CiAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJBdHRhY2hSb2xlUG9saWN5IiB8fAogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGV0YWNoUm9sZVBvbGljeSIgfHwKICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkF0dGFjaFVzZXJQb2xpY3kiIHx8CiAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEZXRhY2hVc2VyUG9saWN5IiB8fAogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQXR0YWNoR3JvdXBQb2xpY3kiIHx8CiAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEZXRhY2hHcm91cFBvbGljeSIKICApCmxhYmVsczoKICB0eXBlOiBjb21wbGlhbmNlCg==", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLWlhbS1wb2xpY3ktY2hhbmdlCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEFXUyBJQU0gcG9saWN5IGNoYW5nZSIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2F3cy1jbG91ZHRyYWlsJyAmJgogICgKICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZUdyb3VwUG9saWN5IiB8fAogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGVsZXRlUm9sZVBvbGljeSIgfHwKICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZVVzZXJQb2xpY3kiIHx8CiAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJQdXRHcm91cFBvbGljeSIgfHwKICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIlB1dFJvbGVQb2xpY3kiIHx8CiAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJQdXRVc2VyUG9saWN5IiB8fAogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ3JlYXRlUG9saWN5IiB8fAogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGVsZXRlUG9saWN5IiB8fAogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ3JlYXRlUG9saWN5VmVyc2lvbiIgfHwKICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZVBvbGljeVZlcnNpb24iIHx8CiAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJBdHRhY2hSb2xlUG9saWN5IiB8fAogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGV0YWNoUm9sZVBvbGljeSIgfHwKICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkF0dGFjaFVzZXJQb2xpY3kiIHx8CiAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEZXRhY2hVc2VyUG9saWN5IiB8fAogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQXR0YWNoR3JvdXBQb2xpY3kiIHx8CiAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEZXRhY2hHcm91cFBvbGljeSIKICApCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTA5OC4wMDMKICBiZWhhdmlvcjogImNsb3VkOmF1ZGl0IgogIGxhYmVsOiAiQVdTIElBTSBwZXJzaXN0ZW50IGFjY2VzcyIKICBzZXJ2aWNlOiBhd3MKICBjdGk6IGZhbHNlCiAgcmVtZWRpYXRpb246IGZhbHNlCg==", "description": "Detect AWS IAM policy change", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:audit", + "classification": [ + "attack.T1098.003" + ], + "confidence": 3, + "cti": false, + "label": "AWS IAM persistent access", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cis-benchmark-kms-deletion": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-kms-deletion.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "1ba56c6b7e00f956d4882fedd48a76c2dd41af5d4c87b5940a95a6c649b7d5cf", @@ -6302,19 +7254,32 @@ "0.2": { "digest": "3c449f3d2bc65d63b18d487235802fc76041ee070725e8d1c450e4b308953951", "deprecated": false + }, + "0.3": { + "digest": "90b8df48f799eedc39cbe7eb2f4ce03705369054cbc670cd4f5f70f226673f41", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBkaXNhYmxpbmcgb3Igc2NoZWR1bGVkIGRlbGV0aW9uIGNyZWF0aW9uIGZvciBBV1MgS01TIGtleXMgKFNlY3Rpb24gNC43IG9mIENJUyBBV1MgRm91bmRhdGlvbiBCZW5jaG1hcmsgMS40LjAgKS4KCg==", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLWttcy1kZWxldGlvbgpkZXNjcmlwdGlvbjogIkRldGVjdCBBV1MgS01TIGtleSBkZWxldGlvbiIKZmlsdGVyOiB8CiAgICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXdzLWNsb3VkdHJhaWwnICYmCiAgICBldnQuVW5tYXJzaGFsZWQuY2xvdWR0cmFpbC5ldmVudFNvdXJjZSA9PSAia21zLmFtYXpvbmF3cy5jb20iICYmCiAgICAoZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGlzYWJsZUtleSIgfHwgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiU2NoZWR1bGVLZXlEZWxldGlvbiIpCmxhYmVsczoKICB0eXBlOiBjb21wbGlhbmNlCg==", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLWttcy1kZWxldGlvbgpkZXNjcmlwdGlvbjogIkRldGVjdCBBV1MgS01TIGtleSBkZWxldGlvbiIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2F3cy1jbG91ZHRyYWlsJyAmJgogIGV2dC5Vbm1hcnNoYWxlZC5jbG91ZHRyYWlsLmV2ZW50U291cmNlID09ICJrbXMuYW1hem9uYXdzLmNvbSIgJiYKICAoZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGlzYWJsZUtleSIgfHwgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiU2NoZWR1bGVLZXlEZWxldGlvbiIpCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTQ4NQogIGJlaGF2aW9yOiAiY2xvdWQ6YXVkaXQiCiAgbGFiZWw6ICJBV1MgS01TIGluZGljYXRvciByZW1vdmFsIgogIHNlcnZpY2U6IGF3cwogIGN0aTogZmFsc2UKICByZW1lZGlhdGlvbjogZmFsc2UK", "description": "Detect AWS KMS key deletion", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:audit", + "classification": [ + "attack.T1485" + ], + "confidence": 3, + "cti": false, + "label": "AWS KMS indicator removal", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cis-benchmark-login-no-mfa": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-login-no-mfa.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "acbd23a2dfe15721356f918ed88d0cc5ff6339dfc84209bbd32c2846f6344838", @@ -6323,19 +7288,33 @@ "0.2": { "digest": "c08ae8cabf835305150c43555784b8efce56b8c76ba51ec900bbe0e4455360d9", "deprecated": false + }, + "0.3": { + "digest": "e2b29eee2cb68292071234841b8f11e4d9599357f5e81e575a4919671b45c764", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBsb2dpbiB3aXRob3V0IE1GQSB0byB0aGUgQVdTIGNvbnNvbGUgKFNlY3Rpb24gMy4yIG9mIENJUyBBV1MgRm91bmRhdGlvbiBCZW5jaG1hcmsgMS4yLjAgKS4KCg==", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLWxvZ2luLW5vLW1mYQpkZXNjcmlwdGlvbjogIkRldGVjdCBsb2dpbiB3aXRob3V0IE1GQSB0byB0aGUgQVdTIGNvbnNvbGUiCmZpbHRlcjogfAogICAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2F3cy1jbG91ZHRyYWlsJyAmJgogICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ29uc29sZUxvZ2luIiAmJgogICAgZXZ0LlVubWFyc2hhbGVkLmNsb3VkdHJhaWwuYWRkaXRpb25hbEV2ZW50RGF0YS5NRkFVc2VkICE9ICJZZXMiICYmCiAgICBldnQuVW5tYXJzaGFsZWQuY2xvdWR0cmFpbC51c2VySWRlbnRpdHkudHlwZSA9PSAiSUFNVXNlciIgJiYKICAgIGV2dC5Vbm1hcnNoYWxlZC5jbG91ZHRyYWlsLnJlc3BvbnNlRWxlbWVudHMuQ29uc29sZUxvZ2luID09ICJTdWNjZXNzIgpsYWJlbHM6CiAgdHlwZTogY29tcGxpYW5jZQo=", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLWxvZ2luLW5vLW1mYQpkZXNjcmlwdGlvbjogIkRldGVjdCBsb2dpbiB3aXRob3V0IE1GQSB0byB0aGUgQVdTIGNvbnNvbGUiCmZpbHRlcjogfAogIGV2dC5NZXRhLmxvZ190eXBlID09ICdhd3MtY2xvdWR0cmFpbCcgJiYKICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJDb25zb2xlTG9naW4iICYmCiAgZXZ0LlVubWFyc2hhbGVkLmNsb3VkdHJhaWwuYWRkaXRpb25hbEV2ZW50RGF0YS5NRkFVc2VkICE9ICJZZXMiICYmCiAgZXZ0LlVubWFyc2hhbGVkLmNsb3VkdHJhaWwudXNlcklkZW50aXR5LnR5cGUgPT0gIklBTVVzZXIiICYmCiAgZXZ0LlVubWFyc2hhbGVkLmNsb3VkdHJhaWwucmVzcG9uc2VFbGVtZW50cy5Db25zb2xlTG9naW4gPT0gIlN1Y2Nlc3MiCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU1MgogICAgLSBhdHRhY2suVDEwNzguMDA0CiAgbGFiZWw6ICJBV1MgQ3JlZGVudGlhbCBtaXN1c2UiCiAgYmVoYXZpb3I6ICJjbG91ZDp1bnVzdWFsLWFjdGl2aXR5IgogIHNlcnZpY2U6IGF3cwogIGN0aTogZmFsc2UKICByZW1lZGlhdGlvbjogZmFsc2UK", "description": "Detect login without MFA to the AWS console", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:unusual-activity", + "classification": [ + "attack.T1552", + "attack.T1078.004" + ], + "confidence": 3, + "cti": false, + "label": "AWS Credential misuse", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cis-benchmark-nacl-change": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-nacl-change.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "803aa6ee23f0c3b96d4d5860223cd8cfb5c9e51ee7ba20ebac5efd3cb26a3211", @@ -6344,19 +7323,32 @@ "0.2": { "digest": "b15c1c9eaa7b1e5aff2092996c79e469049230f2d299fb17dfeae30152812417", "deprecated": false + }, + "0.3": { + "digest": "447a0db8b568d4b0725b87b8f798999b037344e7edfbfc44ac795130b45f9696", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBBV1MgTkFDTCBjaGFuZ2VzIGJhc2VkIG9uIGNsb3VkdHJhaWwgbG9ncyAoU2VjdGlvbiA0LjExIG9mIENJUyBBV1MgRm91bmRhdGlvbiBCZW5jaG1hcmsgMS40LjAgKS4KCg==", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLW5hY2wtY2hhbmdlCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEFXUyBOQUNMIGNoYW5nZSIKZmlsdGVyOiB8CiAgICAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2F3cy1jbG91ZHRyYWlsJyAmJgogICAgICgKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJDcmVhdGVOZXR3b3JrQWNsIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkNyZWF0ZU5ldHdvcmtBY2xFbnRyeSIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEZWxldGVOZXR3b3JrQWNsIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZU5ldHdvcmtBY2xFbnRyeSIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJSZXBsYWNlTmV0d29ya0FjbEVudHJ5IiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIlJlcGxhY2VOZXR3b3JrQWNsQXNzb2NpYXRpb24iCiAgICAgKQpsYWJlbHM6CiAgdHlwZTogY29tcGxpYW5jZQo=", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLW5hY2wtY2hhbmdlCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEFXUyBOQUNMIGNoYW5nZSIKZmlsdGVyOiB8CiAgICAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2F3cy1jbG91ZHRyYWlsJyAmJgogICAgICgKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJDcmVhdGVOZXR3b3JrQWNsIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkNyZWF0ZU5ldHdvcmtBY2xFbnRyeSIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEZWxldGVOZXR3b3JrQWNsIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZU5ldHdvcmtBY2xFbnRyeSIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJSZXBsYWNlTmV0d29ya0FjbEVudHJ5IiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIlJlcGxhY2VOZXR3b3JrQWNsQXNzb2NpYXRpb24iCiAgICAgKQpsYWJlbHM6CiAgICAgY29uZmlkZW5jZTogMwogICAgIHNwb29mYWJsZTogMAogICAgIGNsYXNzaWZpY2F0aW9uOgogICAgICAgICAgLSBhdHRhY2suVDE1NzgKICAgICBiZWhhdmlvcjogImNsb3VkOmF1ZGl0IgogICAgIGxhYmVsOiAiQVdTIE5BQ0wgY2hhbmdlIgogICAgIHNlcnZpY2U6IGF3cwogICAgIGN0aTogZmFsc2UKICAgICByZW1lZGlhdGlvbjogZmFsc2UK", "description": "Detect AWS NACL change", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:audit", + "classification": [ + "attack.T1578" + ], + "confidence": 3, + "cti": false, + "label": "AWS NACL change", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cis-benchmark-ngw-change": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-ngw-change.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "5a14ac3091ce73ecd32c2f37f5280676baae5b9b8161435bdd71a010a1faeb0d", @@ -6365,19 +7357,32 @@ "0.2": { "digest": "802a2aeb7b24f95c4280e75ec62efa941af5714785d1828dddb35e62fbe2ea2b", "deprecated": false + }, + "0.3": { + "digest": "07e40919e70ffc2a14ab744a51846b80ee486c061d4b4326fc0ddd65b2584a1f", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBBV1MgTmV0d29yayBHYXRld2F5IGNoYW5nZXMgYmFzZWQgb24gY2xvdWR0cmFpbCBsb2dzIChTZWN0aW9uIDQuMTIgb2YgQ0lTIEFXUyBGb3VuZGF0aW9uIEJlbmNobWFyayAxLjQuMCApLgoK", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLW5ndy1jaGFuZ2UKZGVzY3JpcHRpb246ICJEZXRlY3QgQVdTIE5ldHdvcmsgR2F0ZXdheSBjaGFuZ2UiCmZpbHRlcjogfAogICAgIGV2dC5NZXRhLmxvZ190eXBlID09ICdhd3MtY2xvdWR0cmFpbCcgJiYKICAgICAoCiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ3JlYXRlQ3VzdG9tZXJHYXRld2F5IiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZUN1c3RvbWVyR2F0ZXdheSIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJBdHRhY2hJbnRlcm5ldEdhdGV3YXkiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ3JlYXRlSW50ZXJuZXRHYXRld2F5IiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZUludGVybmV0R2F0ZXdheSIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEZXRhY2hJbnRlcm5ldEdhdGV3YXkiCiAgICAgKQpsYWJlbHM6CiAgdHlwZTogY29tcGxpYW5jZQo=", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLW5ndy1jaGFuZ2UKZGVzY3JpcHRpb246ICJEZXRlY3QgQVdTIE5ldHdvcmsgR2F0ZXdheSBjaGFuZ2UiCmZpbHRlcjogfAogICAgIGV2dC5NZXRhLmxvZ190eXBlID09ICdhd3MtY2xvdWR0cmFpbCcgJiYKICAgICAoCiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ3JlYXRlQ3VzdG9tZXJHYXRld2F5IiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZUN1c3RvbWVyR2F0ZXdheSIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJBdHRhY2hJbnRlcm5ldEdhdGV3YXkiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ3JlYXRlSW50ZXJuZXRHYXRld2F5IiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZUludGVybmV0R2F0ZXdheSIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEZXRhY2hJbnRlcm5ldEdhdGV3YXkiCiAgICAgKQpsYWJlbHM6CiAgICAgY29uZmlkZW5jZTogMwogICAgIHNwb29mYWJsZTogMAogICAgIGNsYXNzaWZpY2F0aW9uOgogICAgICAgICAgLSBhdHRhY2suVDE1NzgKICAgICBiZWhhdmlvcjogImNsb3VkOmF1ZGl0IgogICAgIGxhYmVsOiAiQVdTIE5ldHdvcmsgR2F0ZXdheSBjaGFuZ2UiCiAgICAgc2VydmljZTogYXdzCiAgICAgY3RpOiBmYWxzZQogICAgIHJlbWVkaWF0aW9uOiBmYWxzZQo=", "description": "Detect AWS Network Gateway change", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:audit", + "classification": [ + "attack.T1578" + ], + "confidence": 3, + "cti": false, + "label": "AWS Network Gateway change", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cis-benchmark-root-usage": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-root-usage.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "4fc540e39e1ee2d314e22c1d1fcfb2dfd215b2773befb7c0d688feacb4dd7f05", @@ -6386,19 +7391,33 @@ "0.2": { "digest": "0327d973e276861ef87fa71b6cf7503791d080e8cbf8e2581ae901e4dd270658", "deprecated": false + }, + "0.3": { + "digest": "e74032688adb9f64b803e02750bf257b7e6f4dd4557a796c0b2d28748539d0e0", + "deprecated": false } }, "long_description": "RGV0ZWN0cyB1c2FnZSBvZiB0aGUgQVdTIHJvb3QgYWNjb3VudCBiYXNlZCBvbiBjbG91dHJhaWwgbG9ncyAoU2VjdGlvbiAxLjcgb2YgQ0lTIEFXUyBGb3VuZGF0aW9uIEJlbmNobWFyayAxLjQuMCApLgoK", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLXJvb3QtdXNhZ2UKZGVzY3JpcHRpb246ICJEZXRlY3QgQVdTIHJvb3QgYWNjb3VudCB1c2FnZSIKZmlsdGVyOiB8CiAgICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXdzLWNsb3VkdHJhaWwnICYmCiAgICBldnQuVW5tYXJzaGFsZWQuY2xvdWR0cmFpbC51c2VySWRlbnRpdHkudHlwZSA9PSAiUm9vdCIgJiYKICAgIGV2dC5Vbm1hcnNoYWxlZC5jbG91ZHRyYWlsLnVzZXJJZGVudGl0eS5pbnZva2VkQnkgPT0gbmlsICYmCiAgICBldnQuVW5tYXJzaGFsZWQuY2xvdWR0cmFpbC5ldmVudFR5cGUgIT0gIkF3c1NlcnZpY2VFdmVudCIKbGFiZWxzOgogIHR5cGU6IGNvbXBsaWFuY2UK", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLXJvb3QtdXNhZ2UKZGVzY3JpcHRpb246ICJEZXRlY3QgQVdTIHJvb3QgYWNjb3VudCB1c2FnZSIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2F3cy1jbG91ZHRyYWlsJyAmJgogIGV2dC5Vbm1hcnNoYWxlZC5jbG91ZHRyYWlsLnVzZXJJZGVudGl0eS50eXBlID09ICJSb290IiAmJgogIGV2dC5Vbm1hcnNoYWxlZC5jbG91ZHRyYWlsLnVzZXJJZGVudGl0eS5pbnZva2VkQnkgPT0gbmlsICYmCiAgZXZ0LlVubWFyc2hhbGVkLmNsb3VkdHJhaWwuZXZlbnRUeXBlICE9ICJBd3NTZXJ2aWNlRXZlbnQiCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTA3OAogICAgLSBhdHRhY2suVDEwOTgKICBiZWhhdmlvcjogImNsb3VkOnVudXN1YWwtYWN0aXZpdHkiCiAgbGFiZWw6ICJBV1Mgcm9vdCBhY2NvdW50IHVzYWdlIgogIHNlcnZpY2U6IGF3cwogIGN0aTogZmFsc2UKICByZW1lZGlhdGlvbjogZmFsc2UK", "description": "Detect AWS root account usage", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:unusual-activity", + "classification": [ + "attack.T1078", + "attack.T1098" + ], + "confidence": 3, + "cti": false, + "label": "AWS root account usage", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cis-benchmark-route-table-change": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-route-table-change.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "2ad4d52b87e36f02ab21e417aa716ddc55b07eb13c4c48acf18adb43d4b03784", @@ -6407,19 +7426,32 @@ "0.2": { "digest": "8a0f435a6f66b90447c8dd34b0b20767e1f83982793a4c7cf7d4fa61fb64018e", "deprecated": false + }, + "0.3": { + "digest": "c3f8f25d06824a347f4798d05e565847f9dbf5ed9fc3b3707ef3c947000b02ca", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBBV1MgUm91dGUgVGFibGUgY2hhbmdlcyBiYXNlZCBvbiBjbG91ZHRyYWlsIGxvZ3MgKFNlY3Rpb24gNC4xMyBvZiBDSVMgQVdTIEZvdW5kYXRpb24gQmVuY2htYXJrIDEuNC4wICkuCgo=", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLXJvdXRlLXRhYmxlLWNoYW5nZQpkZXNjcmlwdGlvbjogIkRldGVjdCBBV1Mgcm91dGUgdGFibGUgY2hhbmdlIgpmaWx0ZXI6IHwKICAgICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXdzLWNsb3VkdHJhaWwnICYmCiAgICAgKAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkNyZWF0ZVJvdXRlIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkNyZWF0ZVJvdXRlVGFibGUiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiUmVwbGFjZVJvdXRlIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIlJlcGxhY2VSb3V0ZVRhYmxlQXNzb2NpYXRpb24iIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGVsZXRlUm91dGVUYWJsZSIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEZWxldGVSb3V0ZSIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEaXNhc3NvY2lhdGVSb3V0ZVRhYmxlIgogICAgICkKbGFiZWxzOgogIHR5cGU6IGNvbXBsaWFuY2UK", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLXJvdXRlLXRhYmxlLWNoYW5nZQpkZXNjcmlwdGlvbjogIkRldGVjdCBBV1Mgcm91dGUgdGFibGUgY2hhbmdlIgpmaWx0ZXI6IHwKICAgICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXdzLWNsb3VkdHJhaWwnICYmCiAgICAgKAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkNyZWF0ZVJvdXRlIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkNyZWF0ZVJvdXRlVGFibGUiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiUmVwbGFjZVJvdXRlIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIlJlcGxhY2VSb3V0ZVRhYmxlQXNzb2NpYXRpb24iIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGVsZXRlUm91dGVUYWJsZSIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEZWxldGVSb3V0ZSIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEaXNhc3NvY2lhdGVSb3V0ZVRhYmxlIgogICAgICkKbGFiZWxzOgogICAgIGNvbmZpZGVuY2U6IDMKICAgICBzcG9vZmFibGU6IDAKICAgICBjbGFzc2lmaWNhdGlvbjoKICAgICAgICAgIC0gYXR0YWNrLlQxNTc4CiAgICAgYmVoYXZpb3I6ICJjbG91ZDphdWRpdCIKICAgICBsYWJlbDogIkFXUyByb3V0ZSB0YWJsZSBjaGFuZ2UiCiAgICAgc2VydmljZTogYXdzCiAgICAgY3RpOiBmYWxzZQogICAgIHJlbWVkaWF0aW9uOiBmYWxzZQo=", "description": "Detect AWS route table change", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:audit", + "classification": [ + "attack.T1578" + ], + "confidence": 3, + "cti": false, + "label": "AWS route table change", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cis-benchmark-s3-policy-change": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-s3-policy-change.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "fdbf3d2258567b03570a351499548e9ddffcef378699e396488c402961010f3b", @@ -6428,19 +7460,32 @@ "0.2": { "digest": "8901ab45f32826f94cabd09b66aaae362e628784c89b54c5f2f3338c1de6ae43", "deprecated": false + }, + "0.3": { + "digest": "13dc450f6b43544b9b7a7f51dbc149cba22d63fc902b29fc7299e71538b424dc", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBBV1MgUzMgYnVja2V0cyBwb2xpY3kgY2hhbmdlcyBiYXNlZCBvbiBjbG91ZHRyYWlsIGxvZ3MgKFNlY3Rpb24gNC44IG9mIENJUyBBV1MgRm91bmRhdGlvbiBCZW5jaG1hcmsgMS40LjAgKS4KCg==", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLXMzLXBvbGljeS1jaGFuZ2UKZGVzY3JpcHRpb246ICJEZXRlY3QgQVdTIFMzIGJ1Y2tldCBwb2xpY3kgY2hhbmdlIgpmaWx0ZXI6IHwKICAgIGV2dC5NZXRhLmxvZ190eXBlID09ICdhd3MtY2xvdWR0cmFpbCcgJiYKICAgIGV2dC5Vbm1hcnNoYWxlZC5jbG91ZHRyYWlsLmV2ZW50U291cmNlID09ICJzMy5hbWF6b25hd3MuY29tIiAmJgogICAgKAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIlB1dEJ1Y2tldEFjbCIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJQdXRCdWNrZXRQb2xpY3kiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiUHV0QnVja2V0Q29ycyIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJQdXRCdWNrZXRMaWZlY3ljbGUiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiUHV0QnVja2V0UmVwbGljYXRpb24iIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGVsZXRlQnVja2V0UG9saWN5IiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZUJ1Y2tldENvcnMiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGVsZXRlQnVja2V0TGlmZWN5Y2xlIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZUJ1Y2tldFJlcGxpY2F0aW9uIgogICAgKQpsYWJlbHM6CiAgdHlwZTogY29tcGxpYW5jZQo=", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLXMzLXBvbGljeS1jaGFuZ2UKZGVzY3JpcHRpb246ICJEZXRlY3QgQVdTIFMzIGJ1Y2tldCBwb2xpY3kgY2hhbmdlIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXdzLWNsb3VkdHJhaWwnICYmCiAgZXZ0LlVubWFyc2hhbGVkLmNsb3VkdHJhaWwuZXZlbnRTb3VyY2UgPT0gInMzLmFtYXpvbmF3cy5jb20iICYmCiAgKAogICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJQdXRCdWNrZXRBY2wiIHx8CiAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIlB1dEJ1Y2tldFBvbGljeSIgfHwKICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiUHV0QnVja2V0Q29ycyIgfHwKICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiUHV0QnVja2V0TGlmZWN5Y2xlIiB8fAogICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJQdXRCdWNrZXRSZXBsaWNhdGlvbiIgfHwKICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGVsZXRlQnVja2V0UG9saWN5IiB8fAogICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEZWxldGVCdWNrZXRDb3JzIiB8fAogICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJEZWxldGVCdWNrZXRMaWZlY3ljbGUiIHx8CiAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZUJ1Y2tldFJlcGxpY2F0aW9uIgogICkKbGFiZWxzOgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTc4CiAgYmVoYXZpb3I6ICJjbG91ZDphdWRpdCIKICBsYWJlbDogIkFXUyBTMyBidWNrZXQgcG9saWN5IGNoYW5nZSIKICBzZXJ2aWNlOiBhd3MKICBjdGk6IGZhbHNlCiAgcmVtZWRpYXRpb246IGZhbHNlCg==", "description": "Detect AWS S3 bucket policy change", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:audit", + "classification": [ + "attack.T1578" + ], + "confidence": 3, + "cti": false, + "label": "AWS S3 bucket policy change", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cis-benchmark-security-group-change": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-security-group-change.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "d607b48d890f43c1f2c56fcf0ae77e762d2f3fffc197cfc9a9a5d512d7f8cbdf", @@ -6449,19 +7494,32 @@ "0.2": { "digest": "c3f007b90e064c06f12dc844c8b364f400c4cf136773f84a0e6592b3669b733e", "deprecated": false + }, + "0.3": { + "digest": "8d4a3a69d3af2137f542d56f0dc6e95bf1239b3c02d3570ac07d32ccc08e4520", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBBV1MgU2VjdXJpdHkgR3JvdXAgY2hhbmdlcyBiYXNlZCBvbiBjbG91ZHRyYWlsIGxvZ3MgKFNlY3Rpb24gNC4xMCBvZiBDSVMgQVdTIEZvdW5kYXRpb24gQmVuY2htYXJrIDEuNC4wICkuCgo=", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLXNlY3VyaXR5LWdyb3VwLWNoYW5nZQpkZXNjcmlwdGlvbjogIkRldGVjdCBBV1MgU2VjdXJpdHkgR3JvdXAgY2hhbmdlIgpmaWx0ZXI6IHwKICAgICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXdzLWNsb3VkdHJhaWwnICYmCiAgICAgKAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkF1dGhvcml6ZVNlY3VyaXR5R3JvdXBJbmdyZXNzIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkF1dGhvcml6ZVNlY3VyaXR5R3JvdXBFZ3Jlc3MiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiUmV2b2tlU2VjdXJpdHlHcm91cEluZ3Jlc3MiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiUmV2b2tlU2VjdXJpdHlHcm91cEVncmVzcyIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJDcmVhdGVTZWN1cml0eUdyb3VwIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZVNlY3VyaXR5R3JvdXAiCiAgICAgKQpsYWJlbHM6CiAgdHlwZTogY29tcGxpYW5jZQo=", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLXNlY3VyaXR5LWdyb3VwLWNoYW5nZQpkZXNjcmlwdGlvbjogIkRldGVjdCBBV1MgU2VjdXJpdHkgR3JvdXAgY2hhbmdlIgpmaWx0ZXI6IHwKICAgICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXdzLWNsb3VkdHJhaWwnICYmCiAgICAgKAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkF1dGhvcml6ZVNlY3VyaXR5R3JvdXBJbmdyZXNzIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkF1dGhvcml6ZVNlY3VyaXR5R3JvdXBFZ3Jlc3MiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiUmV2b2tlU2VjdXJpdHlHcm91cEluZ3Jlc3MiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiUmV2b2tlU2VjdXJpdHlHcm91cEVncmVzcyIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJDcmVhdGVTZWN1cml0eUdyb3VwIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZVNlY3VyaXR5R3JvdXAiCiAgICAgKQpsYWJlbHM6CiAgICAgY29uZmlkZW5jZTogMwogICAgIHNwb29mYWJsZTogMAogICAgIGNsYXNzaWZpY2F0aW9uOgogICAgICAgICAgLSBhdHRhY2suVDE1NzgKICAgICBiZWhhdmlvcjogImNsb3VkOmF1ZGl0IgogICAgIGxhYmVsOiAiQVdTIFNlY3VyaXR5IEdyb3VwIGNoYW5nZSIKICAgICBzZXJ2aWNlOiBhd3MKICAgICBjdGk6IGZhbHNlCiAgICAgcmVtZWRpYXRpb246IGZhbHNlCg==", "description": "Detect AWS Security Group change", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:audit", + "classification": [ + "attack.T1578" + ], + "confidence": 3, + "cti": false, + "label": "AWS Security Group change", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cis-benchmark-unauthorized-call": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-unauthorized-call.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "170dec43ada23d1dbcc17b41339153be450c327cc52a0c7d6d185d27b980285e", @@ -6474,19 +7532,32 @@ "0.3": { "digest": "5a70025204fcf6e779098e33a95bd45af119fe889167b99c1889904800ffe9c5", "deprecated": false + }, + "0.4": { + "digest": "f8bcacd4930eb310c925ea58d3170bcaf6a765fbfb743e66de5406b88c26ea1a", + "deprecated": false } }, "long_description": "RGV0ZWN0IHVuYXV0aG9yaXplZCBBV1MgQVBJIGNhbGxzIGJhc2VkIG9uIGNsb3VkdHJhaWwgbG9ncyAoU2VjdGlvbiAzLjEgb2YgQ0lTIEFXUyBGb3VuZGF0aW9uIEJlbmNobWFyayAxLjIuMCApLg==", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLXVuYXV0aG9yaXplZC1jYWxsCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEFXUyBBUEkgdW5hdXRob3JpemVkIGNhbGxzIgpmaWx0ZXI6IHwKICAgICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXdzLWNsb3VkdHJhaWwnICYmCiAgICAgKAogICAgICAgICAgKGV2dC5Vbm1hcnNoYWxlZC5jbG91ZHRyYWlsLmVycm9yQ29kZSAhPSBuaWwgJiYgZXZ0LlVubWFyc2hhbGVkLmNsb3VkdHJhaWwuZXJyb3JDb2RlIG1hdGNoZXMgIi4qVW5hdXRob3JpemVkT3BlcmF0aW9uJCIpIHx8CiAgICAgICAgICAoZXZ0LlVubWFyc2hhbGVkLmNsb3VkdHJhaWwuZXJyb3JDb2RlICE9IG5pbCAmJiBldnQuVW5tYXJzaGFsZWQuY2xvdWR0cmFpbC5lcnJvckNvZGUgbWF0Y2hlcyAiXkFjY2Vzc0RlbmllZC4qIikKICAgICApCmxhYmVsczoKICB0eXBlOiBjb21wbGlhbmNlCg==", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLXVuYXV0aG9yaXplZC1jYWxsCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEFXUyBBUEkgdW5hdXRob3JpemVkIGNhbGxzIgpmaWx0ZXI6IHwKICAgICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXdzLWNsb3VkdHJhaWwnICYmCiAgICAgKAogICAgICAgICAgKGV2dC5Vbm1hcnNoYWxlZC5jbG91ZHRyYWlsLmVycm9yQ29kZSAhPSBuaWwgJiYgZXZ0LlVubWFyc2hhbGVkLmNsb3VkdHJhaWwuZXJyb3JDb2RlIG1hdGNoZXMgIi4qVW5hdXRob3JpemVkT3BlcmF0aW9uJCIpIHx8CiAgICAgICAgICAoZXZ0LlVubWFyc2hhbGVkLmNsb3VkdHJhaWwuZXJyb3JDb2RlICE9IG5pbCAmJiBldnQuVW5tYXJzaGFsZWQuY2xvdWR0cmFpbC5lcnJvckNvZGUgbWF0Y2hlcyAiXkFjY2Vzc0RlbmllZC4qIikKICAgICApCmxhYmVsczoKICAgICBjb25maWRlbmNlOiAzCiAgICAgc3Bvb2ZhYmxlOiAwCiAgICAgY2xhc3NpZmljYXRpb246CiAgICAgICAgICAtIGF0dGFjay5UMTIxMgogICAgIGJlaGF2aW9yOiAiY2xvdWQ6YXVkaXQiCiAgICAgbGFiZWw6ICJBV1MgQVBJIHVuYXV0aG9yaXplZCBjYWxscyIKICAgICBzZXJ2aWNlOiBhd3MKICAgICBjdGk6IGZhbHNlCiAgICAgcmVtZWRpYXRpb246IGZhbHNlCg==", "description": "Detect AWS API unauthorized calls", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:audit", + "classification": [ + "attack.T1212" + ], + "confidence": 3, + "cti": false, + "label": "AWS API unauthorized calls", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cis-benchmark-vpc-change": { "path": "scenarios/crowdsecurity/aws-cis-benchmark-vpc-change.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "03be2557184d98582fa9d460f45c73e67860926b8afbebea9737e2220e7ca54d", @@ -6495,19 +7566,32 @@ "0.2": { "digest": "ff3de61cf76336f3a9b87b8390172e9113ea3d92457845e29704fc114d8ec644", "deprecated": false + }, + "0.3": { + "digest": "dbaf2ca85f6d5129bb3ad9031559ce21b8a1eb844e3a614cb00c47f23dbfb803", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBBV1MgVlBDIGNoYW5nZXMgYmFzZWQgb24gY2xvdWR0cmFpbCBsb2dzIChTZWN0aW9uIDQuMTQgb2YgQ0lTIEFXUyBGb3VuZGF0aW9uIEJlbmNobWFyayAxLjQuMCApLgoK", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLXZwYy1jaGFuZ2UKZGVzY3JpcHRpb246ICJEZXRlY3QgQVdTIFZQQyBjaGFuZ2UiCmZpbHRlcjogfAogICAgIGV2dC5NZXRhLmxvZ190eXBlID09ICdhd3MtY2xvdWR0cmFpbCcgJiYKICAgICAoCiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ3JlYXRlVnBjIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZVZwYyIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJNb2RpZnlWcGNBdHRyaWJ1dGUiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQWNjZXB0VnBjUGVlcmluZ0Nvbm5lY3Rpb24iIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ3JlYXRlVnBjUGVlcmluZ0Nvbm5lY3Rpb24iIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGVsZXRlVnBjUGVlcmluZ0Nvbm5lY3Rpb24iIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiUmVqZWN0VnBjUGVlcmluZ0Nvbm5lY3Rpb24iIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQXR0YWNoQ2xhc3NpY0xpbmtWcGMiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGV0YWNoQ2xhc3NpY0xpbmtWcGMiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGlzYWJsZVZwY0NsYXNzaWNMaW5rIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkVuYWJsZVZwY0NsYXNzaWNMaW5rIgogICAgICkKbGFiZWxzOgogIHR5cGU6IGNvbXBsaWFuY2UK", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2F3cy1jaXMtYmVuY2htYXJrLXZwYy1jaGFuZ2UKZGVzY3JpcHRpb246ICJEZXRlY3QgQVdTIFZQQyBjaGFuZ2UiCmZpbHRlcjogfAogICAgIGV2dC5NZXRhLmxvZ190eXBlID09ICdhd3MtY2xvdWR0cmFpbCcgJiYKICAgICAoCiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ3JlYXRlVnBjIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkRlbGV0ZVZwYyIgfHwKICAgICBldnQuTWV0YS5ldmVudF9uYW1lID09ICJNb2RpZnlWcGNBdHRyaWJ1dGUiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQWNjZXB0VnBjUGVlcmluZ0Nvbm5lY3Rpb24iIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQ3JlYXRlVnBjUGVlcmluZ0Nvbm5lY3Rpb24iIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGVsZXRlVnBjUGVlcmluZ0Nvbm5lY3Rpb24iIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiUmVqZWN0VnBjUGVlcmluZ0Nvbm5lY3Rpb24iIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiQXR0YWNoQ2xhc3NpY0xpbmtWcGMiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGV0YWNoQ2xhc3NpY0xpbmtWcGMiIHx8CiAgICAgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAiRGlzYWJsZVZwY0NsYXNzaWNMaW5rIiB8fAogICAgIGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gIkVuYWJsZVZwY0NsYXNzaWNMaW5rIgogICAgICkKbGFiZWxzOgogICAgIGNvbmZpZGVuY2U6IDMKICAgICBzcG9vZmFibGU6IDAKICAgICBjbGFzc2lmaWNhdGlvbjoKICAgICAgICAgIC0gYXR0YWNrLlQxNTc4CiAgICAgYmVoYXZpb3I6ICJjbG91ZDphdWRpdCIKICAgICBsYWJlbDogIkFXUyBWUEMgY2hhbmdlIgogICAgIHNlcnZpY2U6IGF3cwogICAgIGN0aTogZmFsc2UKICAgICByZW1lZGlhdGlvbjogZmFsc2UK", "description": "Detect AWS VPC change", "author": "crowdsecurity", "labels": { - "type": "compliance" + "behavior": "cloud:audit", + "classification": [ + "attack.T1578" + ], + "confidence": 3, + "cti": false, + "label": "AWS VPC change", + "remediation": false, + "service": "aws", + "spoofable": 0 } }, "crowdsecurity/aws-cloudtrail-postexploit": { "path": "scenarios/crowdsecurity/aws-cloudtrail-postexploit.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "66e1721989b0bca40bdf99b15be757138bdf9968153692618ada0a1df57d3131", @@ -6516,17 +7600,33 @@ "0.2": { "digest": "043c04b40049195eb4b64ee20f4273379b58b8937fdeaa538583ca31777f5b3e", "deprecated": false + }, + "0.3": { + "digest": "c42300373b23dd1d14b380c8ef7fbc491ac431726353f7142a1ecea1db1df4a3", + "deprecated": false } }, "long_description": "IyBBV1MgY2xvdWR0cmFpbCBwb3N0ZXhwbG9pdGF0aW9uIGRldGVjdGlvbgoKVGhlc2Ugc2NlbmFyaW9zIG5lZWQgdGhlIGNyb3dkc2VjdXJpdHkvYXdzLWNsb3VkdHJhaWwgcGFyc2VyIGFuZApkZXRlY3QgQVBJIGNhbGxzIGtub3duIGZvciBiZWluZyB1c2VkIGZvciBlbnVtZXJhdGlvbiBhZnRlciBhCmNvbXByb21pc3Npb24uIFRob3NlIHNjZW5hcmlvcyB0cmlnZ2VyaW5nIGNhbiBiZSBhbiBpbmRpY2F0aW9uIG9mCmNvbXByb21pc3Npb24uIFRoZXJlJ3JlIHR3byBzY2VuYXJpb3MgaGVyZSwgYW5kIG9uZSBpcyBhIGJpdCBtb3JlCm5vaXN5LCBtZWFudCB0byBiZSB1c2VkIGluIGVudmlyb25tZW50IHdoZXJlIHNlY3VyaXR5IHN0YW5kYXJkIGFyZQptZWFudCB0byBiZSBoaWdoLgoK", - "content": "dHlwZTogY29uZGl0aW9uYWwKbmFtZTogY3Jvd2RzZWN1cml0eS9hd3MtY2xvdWR0cmFpbC1wb3N0ZXhwbG9pdApkZXNjcmlwdGlvbjogInBvc3RleHBsb2l0YXRpb24gZGV0ZWN0aW9uIChub2lzeSkiCiNkZWJ1ZzogdHJ1ZQpjYXBhY2l0eTogLTEKbGVha3NwZWVkOiAxbQpkaXN0aW5jdDogZXZ0Lk1ldGEuZXZlbnRfbmFtZQpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdhd3MtY2xvdWR0cmFpbCcKY29uZGl0aW9uOiB8CiAgY291bnQocXVldWUuUXVldWUsICMuTWV0YS5ldmVudF9uYW1lIGluIFsiTGlzdFVzZXJQb2xpY2llcyIsICJMaXN0UG9saWNpZXMiLCAiTGlzdEJ1Y2tldHMiLCAiTGlzdEFwcGxpY2F0aW9ucyIsICJEZXNjcmliZUluc3RhbmNlcyIsICJHZXRDYWxsZXJJZGVudGl0eSIsICJHZXRGdW5jdGlvbnMiLCAiRGVzY3JpYmVBY2NvdW50QXR0cmlidXRlcyIsICJMaXN0UmVzb3VyY2VzIl0gb3IgIy5NZXRhLmV2ZW50X25hbWUgc3RhcnRzV2l0aCAiTGlzdEZ1bmN0aW9ucyIpID4gMgpibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKc2NvcGU6CiAgdHlwZTogQXdzQVJOCiAgZXhwcmVzc2lvbjogZXZ0Lk1ldGEudXNlcl9hcm4K", + "content": "dHlwZTogY29uZGl0aW9uYWwKbmFtZTogY3Jvd2RzZWN1cml0eS9hd3MtY2xvdWR0cmFpbC1wb3N0ZXhwbG9pdApkZXNjcmlwdGlvbjogInBvc3RleHBsb2l0YXRpb24gZGV0ZWN0aW9uIChub2lzeSkiCiNkZWJ1ZzogdHJ1ZQpjYXBhY2l0eTogLTEKbGVha3NwZWVkOiAxbQpkaXN0aW5jdDogZXZ0Lk1ldGEuZXZlbnRfbmFtZQpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdhd3MtY2xvdWR0cmFpbCcKY29uZGl0aW9uOiB8CiAgY291bnQocXVldWUuUXVldWUsICMuTWV0YS5ldmVudF9uYW1lIGluIFsiTGlzdFVzZXJQb2xpY2llcyIsICJMaXN0UG9saWNpZXMiLCAiTGlzdEJ1Y2tldHMiLCAiTGlzdEFwcGxpY2F0aW9ucyIsICJEZXNjcmliZUluc3RhbmNlcyIsICJHZXRDYWxsZXJJZGVudGl0eSIsICJHZXRGdW5jdGlvbnMiLCAiRGVzY3JpYmVBY2NvdW50QXR0cmlidXRlcyIsICJMaXN0UmVzb3VyY2VzIl0gb3IgIy5NZXRhLmV2ZW50X25hbWUgc3RhcnRzV2l0aCAiTGlzdEZ1bmN0aW9ucyIpID4gMgpibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKc2NvcGU6CiAgdHlwZTogQXdzQVJOCiAgZXhwcmVzc2lvbjogZXZ0Lk1ldGEudXNlcl9hcm4KbGFiZWxzOgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMDg3CiAgICAtIGF0dGFjay5UMTUyNgogIGJlaGF2aW9yOiAiY2xvdWQ6YXVkaXQiCiAgbGFiZWw6ICJBV1MgcG9zdC1leHBsb2l0YXRpb24gZGV0ZWN0aW9uIgogIHNlcnZpY2U6IGF3cwogIGN0aTogZmFsc2UKICByZW1lZGlhdGlvbjogZmFsc2UK", "description": "postexploitation detection (noisy)", "author": "crowdsecurity", - "labels": null + "labels": { + "behavior": "cloud:audit", + "classification": [ + "attack.T1087", + "attack.T1526" + ], + "confidence": 3, + "cti": false, + "label": "AWS post-exploitation detection", + "remediation": false, + "service": "aws", + "spoofable": 0 + } }, "crowdsecurity/aws-nwo-login": { "path": "scenarios/crowdsecurity/aws-nwo-login.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "f093c51096d55419851635001ec2c2e31fbbc1453286237d1d6229ec1bcc6808", @@ -6539,13 +7639,28 @@ "0.3": { "digest": "ec5be63c7781960eadca9f774b2ea4e2461c8615741c5f039f3bc48bcd594b91", "deprecated": false + }, + "0.4": { + "digest": "09ef326dcdf808760c146ff2e5078245666b247c3023f30fb6f03cf27f8a0b3d", + "deprecated": false } }, "long_description": "IyBOb24gd29ya2luZyBob3VyIC8gbm9uIHdvcmtpbmcgZGF5IGxvZ2luCgpUaGlzIHNjZW5hcmlvIG5lZWRzIHRoZSBjcm93ZHNlY3VyaXR5L2F3cy1jbG91ZHRyYWlsIHBhcnNlciBhbmQKZGV0ZWN0cyBub24gd29ya2luZyBob3Vycy9kYXlzIGxvZ2luIGluIHRoZSBhd3MgY29uc29sZS4gWW91IG1heSB3YW50IHRvCmFkYXB0IHRoZSBob3VycyB0byB5b3VyIHNwZWNpZmljIG5lZWRzLiBBcyBhbiBleGFtcGxlLCB0aGUgc2NlbmFyaW8gaXMKd3JpdHRlbiBmb3IgVVRDKzIgd29ya2luZyBob3Vycy4KCkZvbGxvd2luZyB0aGUKW2h0dHBzOi8vZG9jcy5hd3MuYW1hem9uLmNvbS9hd3NjbG91ZHRyYWlsL2xhdGVzdC91c2VyZ3VpZGUvY2xvdWR0cmFpbC1ldmVudC1yZWZlcmVuY2UtYXdzLWNvbnNvbGUtc2lnbi1pbi1ldmVudHMuaHRtbF0oZG9jdW1lbnRhdGlvbikKdGFrZSBhbiBleHRyYSBjYXJlIG9mIHlvdXIgY2xvdWR0cmFpbCByZWdpb24gY29uZmlndXJhdGlvbiB3aGVuCmRlYWxpbmcgd2l0aCBjb25zb2xlIHNpZ25pbmcgZXZlbnQgY2FwdHVyZS4K", - "content": "IyBOV0QvTldIIEFXUyBjb25zb2xlIGxvZ2luCnR5cGU6IHRyaWdnZXIKbmFtZTogY3Jvd2RzZWN1cml0eS9hd3MtY2xvdWR0cmFpbC1ud28tbndkLWNvbnNvbGUtbG9naW4KZGVzY3JpcHRpb246ICJEZXRlY3QgY29uc29sZSBsb2dpbiBvdXRzaWRlIG9mIG9mZmljZSBob3VycyIKZmlsdGVyOiB8CiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnYXdzLWNsb3VkdHJhaWwnICYmCiAoZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAnQ29uc29sZUxvZ2luJyB8fCBldnQuTWV0YS5ldmVudF9uYW1lID09ICdHZXRTZXNzaW9uVG9rZW4nIHx8IGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gJ0dldEZlZGVyYXRpb25Ub2tlbicpICYmCiBldnQuVW5tYXJzaGFsZWQuY2xvdWR0cmFpbC5yZXNwb25zZUVsZW1lbnRzPy5Db25zb2xlTG9naW4gPT0gJ1N1Y2Nlc3MnICYmCiAoCiAgKGV2dC5UaW1lLkhvdXIoKSA+PSAxOCB8fCBldnQuVGltZS5Ib3VyKCkgPCA2KSB8fCAKICAoZXZ0LlRpbWUuV2Vla2RheSgpLlN0cmluZygpID09ICdTYXR1cmRheScgfHwgZXZ0LlRpbWUuV2Vla2RheSgpLlN0cmluZygpID09ICdTdW5kYXknKQogKQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKc2NvcGU6CiB0eXBlOiBBd3NBUk4KIGV4cHJlc3Npb246IGV2dC5NZXRhLnVzZXJfYXJuCg==", + "content": "IyBOV0QvTldIIEFXUyBjb25zb2xlIGxvZ2luCnR5cGU6IHRyaWdnZXIKbmFtZTogY3Jvd2RzZWN1cml0eS9hd3MtY2xvdWR0cmFpbC1ud28tbndkLWNvbnNvbGUtbG9naW4KZGVzY3JpcHRpb246ICJEZXRlY3QgY29uc29sZSBsb2dpbiBvdXRzaWRlIG9mIG9mZmljZSBob3VycyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2F3cy1jbG91ZHRyYWlsJyAmJgogIChldnQuTWV0YS5ldmVudF9uYW1lID09ICdDb25zb2xlTG9naW4nIHx8IGV2dC5NZXRhLmV2ZW50X25hbWUgPT0gJ0dldFNlc3Npb25Ub2tlbicgfHwgZXZ0Lk1ldGEuZXZlbnRfbmFtZSA9PSAnR2V0RmVkZXJhdGlvblRva2VuJykgJiYKICBldnQuVW5tYXJzaGFsZWQuY2xvdWR0cmFpbC5yZXNwb25zZUVsZW1lbnRzPy5Db25zb2xlTG9naW4gPT0gJ1N1Y2Nlc3MnICYmCiAgKAogICAoZXZ0LlRpbWUuSG91cigpID49IDE4IHx8IGV2dC5UaW1lLkhvdXIoKSA8IDYpIHx8IAogICAoZXZ0LlRpbWUuV2Vla2RheSgpLlN0cmluZygpID09ICdTYXR1cmRheScgfHwgZXZ0LlRpbWUuV2Vla2RheSgpLlN0cmluZygpID09ICdTdW5kYXknKQogICkKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCnNjb3BlOgogIHR5cGU6IEF3c0FSTgogIGV4cHJlc3Npb246IGV2dC5NZXRhLnVzZXJfYXJuCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTA3OAogIGJlaGF2aW9yOiAiY2xvdWQ6dW51c3VhbC1hY3Rpdml0eSIKICBsYWJlbDogIkFXUyBicnV0ZWZvcmNlIgogIHNlcnZpY2U6IGF3cwogIGN0aTogZmFsc2UKICByZW1lZGlhdGlvbjogZmFsc2UK", "description": "Detect console login outside of office hours", "author": "crowdsecurity", - "labels": null + "labels": { + "behavior": "cloud:unusual-activity", + "classification": [ + "attack.T1078" + ], + "confidence": 3, + "cti": false, + "label": "AWS bruteforce", + "remediation": false, + "service": "aws", + "spoofable": 0 + } }, "crowdsecurity/ban-defcon-drop_range": { "path": "scenarios/crowdsecurity/ban-defcon-drop_range.yaml", @@ -6565,12 +7680,12 @@ "description": "Ban a range if more than 5 ips from it are banned at a time", "author": "crowdsecurity", "labels": { - "remediation": "true" + "remediation": true } }, "crowdsecurity/cpanel-bf": { "path": "scenarios/crowdsecurity/cpanel-bf.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "120b1820b330939330df55df5da536cbe0885c9df11a2a0986fe80197be68981", @@ -6579,40 +7694,60 @@ "0.2": { "digest": "25d6094169ab75c028f7d35e0b5bacf9ecf24e46484826c95405966562a2db0c", "deprecated": false + }, + "0.3": { + "digest": "de1e8f9f8b442ad1a83a61d19a13af18821475e69086940d6521fdd6751753e2", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBicnV0ZWZvcmNlIGF0dGVtcHRzIGluIGNwYW5lbCBsb2dpbi4g", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9jcGFuZWwtYmYKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAxMHMKZGVzY3JpcHRpb246ICJEZXRlY3QgYnJ1dGVmb3JjZSBvbiBjcGFuZWwgbG9naW4iCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdhdXRoX2JmX2xvZyciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKICBzZXJ2aWNlOiBjcGFuZWwKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWUKCg==", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9jcGFuZWwtYmYKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAxMHMKZGVzY3JpcHRpb246ICJEZXRlY3QgYnJ1dGVmb3JjZSBvbiBjcGFuZWwgbG9naW4iCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdhdXRoX2JmX2xvZyciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJjcGFuZWwgYnJ1dGVmb3JjZSIKICBzZXJ2aWNlOiBjcGFuZWwKICByZW1lZGlhdGlvbjogdHJ1ZQoK", "description": "Detect bruteforce on cpanel login", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "cpanel bruteforce", + "remediation": true, "service": "cpanel", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/cpanel-bf-attempt": { "path": "scenarios/crowdsecurity/cpanel-bf-attempt.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "6b7b084a9a5ea68ade56b6bd171cfed65cc661b63b197a0f3cec2aef2fcdaeca", "deprecated": false + }, + "0.2": { + "digest": "fa0b71d88fe4a96298bea7caadb858795ad091656907e3f94223d12f98b91715", + "deprecated": false } }, "long_description": "VHJpZ2dlciBhbGVydHMgd2hlbiB0aGlzIGxpbmUgaXMgbWF0Y2hlZDoKCmBgYGJhc2gKRkFJTEVEIExPR0lOIGNwYW5lbGQ6IGJydXRlIGZvcmNlIGF0dGVtcHQgKHVzZXIgY3NjcGFuZWwpIGhhcyBsb2NrZWQgb3V0IElQIDEuMi4zLjQKYGBg", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2NwYW5lbC1iZi1hdHRlbXB0CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGJydXRlZm9yY2UgYXR0ZW1wdCBvbiBjcGFuZWwgbG9naW4iCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdhdXRoX2JmX2F0dGVtcHQnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogY3BhbmVsCiAgdHlwZTogYnJ1dGVmb3JjZQogIHJlbWVkaWF0aW9uOiB0cnVlCgo=", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2NwYW5lbC1iZi1hdHRlbXB0CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGJydXRlZm9yY2UgYXR0ZW1wdCBvbiBjcGFuZWwgbG9naW4iCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdhdXRoX2JmX2F0dGVtcHQnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMQogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiY3BhbmVsIGJydXRlZm9yY2UiCiAgc2VydmljZTogY3BhbmVsCiAgcmVtZWRpYXRpb246IHRydWU=", "description": "Detect bruteforce attempt on cpanel login", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 1, + "label": "cpanel bruteforce", + "remediation": true, "service": "cpanel", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/dovecot-spam": { "path": "scenarios/crowdsecurity/dovecot-spam.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "fc1429f0c8d5b1ba20660ac0725fe0b52bb0382efa746e9bd962d80bdf7c9310", @@ -6625,41 +7760,62 @@ "0.3": { "digest": "c350f1a24a7ff5aed8902691a1bf67b08e963a013dffc3e2500c9db61ad6b62e", "deprecated": false + }, + "0.4": { + "digest": "8c5fd647e5f2ad29620b0dc37c5221a4b6f6a24bf443b55837ebcac290ecf17c", + "deprecated": false } }, "long_description": "U3BhbSBkZXRlY3Rpb24gZm9yIGRvdmVjb3QgKGNhcGFjaXR5IG9mIDMgYW5kIGxlYWtzcGVlZCBvZiAzNjBzKQoKLSBhbGxvd3MgZmFpbCBhdXRoZW50aWNhdGlvbiBhdHRlbXB0IGV2ZXJ5IDYgbWludXRlcyB3aXRoIGEgYnVyc3Qgb2YgMwoKPiBDb250cmlidXRpb24gYnkgaHR0cHM6Ly9naXRodWIuY29tL0x0U2ljaAo=", - "content": "I2NvbnRyaWJ1dGlvbiBieSBAbHRzaWNoCnR5cGU6IGxlYWt5Cm5hbWU6IGNyb3dkc2VjdXJpdHkvZG92ZWNvdC1zcGFtCmRlc2NyaXB0aW9uOiAiZGV0ZWN0IGVycm9ycyBvbiBkb3ZlY290IgpkZWJ1ZzogZmFsc2UKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2RvdmVjb3RfbG9ncycgJiYgZXZ0Lk1ldGEuZG92ZWNvdF9sb2dpbl9yZXN1bHQgPT0gJ2F1dGhfZmFpbGVkJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmNhcGFjaXR5OiAzCmxlYWtzcGVlZDogIjM2MHMiCmJsYWNraG9sZTogNW0KbGFiZWxzOgogdHlwZTogc2NhbgogcmVtZWRpYXRpb246IHRydWUK", + "content": "I2NvbnRyaWJ1dGlvbiBieSBAbHRzaWNoCnR5cGU6IGxlYWt5Cm5hbWU6IGNyb3dkc2VjdXJpdHkvZG92ZWNvdC1zcGFtCmRlc2NyaXB0aW9uOiAiZGV0ZWN0IGVycm9ycyBvbiBkb3ZlY290IgpkZWJ1ZzogZmFsc2UKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2RvdmVjb3RfbG9ncycgJiYgZXZ0Lk1ldGEuZG92ZWNvdF9sb2dpbl9yZXN1bHQgPT0gJ2F1dGhfZmFpbGVkJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmNhcGFjaXR5OiAzCmxlYWtzcGVlZDogIjM2MHMiCmJsYWNraG9sZTogNW0KbGFiZWxzOgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJwb3AzL2ltYXA6YnJ1dGVmb3JjZSIKICBsYWJlbDogImRvdmVjb3QgYnJ1dGVmb3JjZSIKICBzZXJ2aWNlOiBkb3ZlY290CiAgcmVtZWRpYXRpb246IHRydWUK", "description": "detect errors on dovecot", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "scan" + "behavior": "pop3/imap:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "dovecot bruteforce", + "remediation": true, + "service": "dovecot", + "spoofable": 0 } }, "crowdsecurity/endlessh-bf": { "path": "scenarios/crowdsecurity/endlessh-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "2113a6f5e8e2d675581e93d4bcf546526d0bd22aaa35ecafdd041d95e3f3422d", "deprecated": false + }, + "0.2": { + "digest": "b241bc0364aeed20ee30fb8d2ee2b748b71751592a89c9e86eaf4f6a49a25bcb", + "deprecated": false } }, - "content": "IyBlbmRsZXNzaCBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IGNyb3dkc2VjdXJpdHkvZW5kbGVzc2gtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgU1NIIGJydXRlZm9yY2UgY2F1Z2h0IGJ5IEVuZGxlc3NoIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnZW5kbGVzc2hfYWNjZXB0JyIKbGVha3NwZWVkOiAiNW0iCnJlZmVyZW5jZXM6CiAgLSBodHRwOi8vd2lraXBlZGlhLmNvbS9zc2gtYmYtaXMtYmFkCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDEyMG0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBlbmRsZXNzaAogIHR5cGU6IGJydXRlZm9yY2UKICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyBlbmRsZXNzaCBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IGNyb3dkc2VjdXJpdHkvZW5kbGVzc2gtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgU1NIIGJydXRlZm9yY2UgY2F1Z2h0IGJ5IEVuZGxlc3NoIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnZW5kbGVzc2hfYWNjZXB0JyIKbGVha3NwZWVkOiAiNW0iCnJlZmVyZW5jZXM6CiAgLSBodHRwOi8vd2lraXBlZGlhLmNvbS9zc2gtYmYtaXMtYmFkCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDEyMG0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAic3NoOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJlbmRsZXNzaCBicnV0ZWZvcmNlIgogIHNlcnZpY2U6IGVuZGxlc3NoCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect SSH bruteforce caught by Endlessh", "author": "crowdsecurity", "references": [ "http://wikipedia.com/ssh-bf-is-bad" ], "labels": { - "remediation": "true", + "behavior": "ssh:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "endlessh bruteforce", + "remediation": true, "service": "endlessh", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/exchange-bf": { "path": "scenarios/crowdsecurity/exchange-bf.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "7900671abf67cdc000b2dd68d0da35a0960e07f4ac3505fdd4d78f929c29a238", @@ -6668,74 +7824,115 @@ "0.2": { "digest": "8d67052a1fc4e5b48be549165ed6ea47aebaa154960166828fd8b114a6ba5bd0", "deprecated": false + }, + "0.3": { + "digest": "51d223031a71e4215a9ffe78feec7f855a493f8e00e6e760c15aa38915a98bef", + "deprecated": false } }, - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9leGNoYW5nZS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBleGNoYW5nZSBicnV0ZWZvcmNlIChTTVRQLElNQVAsUE9QMykiCmZpbHRlcjogZXZ0Lk1ldGEuc2VydmljZSA9PSAnZXhjaGFuZ2UnICYmIGV2dC5NZXRhLnN1Yl90eXBlID09ICdhdXRoX2ZhaWwnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApsZWFrc3BlZWQ6IDEwcwpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBleGNoYW5nZQogIHR5cGU6IGJydXRlZm9yY2UKICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9leGNoYW5nZS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBleGNoYW5nZSBicnV0ZWZvcmNlIChTTVRQLElNQVAsUE9QMykiCmZpbHRlcjogZXZ0Lk1ldGEuc2VydmljZSA9PSAnZXhjaGFuZ2UnICYmIGV2dC5NZXRhLnN1Yl90eXBlID09ICdhdXRoX2ZhaWwnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApsZWFrc3BlZWQ6IDEwcwpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAicG9wMy9pbWFwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJleGNoYW5nZSBicnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCiAgc2VydmljZTogZXhjaGFuZ2UK", "description": "Detect exchange bruteforce (SMTP,IMAP,POP3)", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "pop3/imap:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "exchange bruteforce", + "remediation": true, "service": "exchange", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/exim-bf": { "path": "scenarios/crowdsecurity/exim-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "a5e177acbd8bbc3a6330100dc64aaebc14f5915a1dda3a8115e54f8825227e7b", "deprecated": false + }, + "0.2": { + "digest": "7f3433d01cf835eced84072ce8475e650740aec6300637757a47a4800a4d846e", + "deprecated": false } }, "long_description": "RGV0ZWN0IGJydXRlZm9yY2Ugb24gRXhpbSBtYWlsIHNlcnZlci4KCiAtIGxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDUgb24gc2FtZSBpcAogLSBsZWFrc3BlZWQgb2YgMTBzLCBjYXBhY2l0eSBvZiA1IG9uIHNhbWUgdGFyZ2V0IHVzZXIK", - "content": "dHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvZXhpbS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBFeGltIGJydXRlIGZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnZXhpbV9mYWlsZWRfYXV0aCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogNQpsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogMW0KbGFiZWxzOgogc2VydmljZTogZXhpbQogdHlwZTogYmYKIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQp0eXBlOiBsZWFreQojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9leGltLXVzZXItYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgRXhpbSB1c2VyIGVtYWlsIGJydXRlIGZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnZXhpbV9mYWlsZWRfYXV0aCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcm5hbWUKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAiMTBzIgpibGFja2hvbGU6IDFtCmxhYmVsczoKIHNlcnZpY2U6IGV4aW0KIHR5cGU6IGJmCiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvZXhpbS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBFeGltIGJydXRlIGZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnZXhpbV9mYWlsZWRfYXV0aCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogNQpsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJwb3AzL2ltYXA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIkV4aW0gYnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQogIHNlcnZpY2U6IHNtdHAKLS0tCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L2V4aW0tdXNlci1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBFeGltIHVzZXIgZW1haWwgYnJ1dGUgZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdleGltX2ZhaWxlZF9hdXRoJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VybmFtZQpjYXBhY2l0eTogNQpsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJwb3AzL2ltYXA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIkV4aW0gYnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQogIHNlcnZpY2U6IHNtdHAK", "description": "Detect Exim brute force", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "exim", - "type": "bf" + "behavior": "pop3/imap:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Exim bruteforce", + "remediation": true, + "service": "smtp", + "spoofable": 0 } }, "crowdsecurity/exim-spam": { "path": "scenarios/crowdsecurity/exim-spam.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "b556e7f5a75118639d28765e93ae858bfa5416b8e73142c5b318bfda8ca1ae6e", "deprecated": false + }, + "0.2": { + "digest": "d679e96623139ba186423cbdc3bdb4d98baf33811321cad0a8d2b6d4895dcc44", + "deprecated": false } }, "long_description": "U3BhbSBkZXRlY3Rpb24gZm9yIEV4aW0gKGNhcGFjaXR5IG9mIDMgYW5kIGxlYWtzcGVlZCBvZiAzNjBzKQoKCg==", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9leGltLXNwYW0KZGVzY3JpcHRpb246ICJkZXRlY3Qgc3BhbSBvbiBFeGltIgojZGVidWc6IHRydWUKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3NwYW0tYXR0ZW1wdCcgJiYgZXZ0Lk1ldGEuc2VydmljZSA9PSAnZXhpbSciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogMwpsZWFrc3BlZWQ6ICIzNjBzIgpibGFja2hvbGU6IDVtCmxhYmVsczoKIHR5cGU6IHNwYW0KIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9leGltLXNwYW0KZGVzY3JpcHRpb246ICJkZXRlY3Qgc3BhbSBvbiBFeGltIgojZGVidWc6IHRydWUKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3NwYW0tYXR0ZW1wdCcgJiYgZXZ0Lk1ldGEuc2VydmljZSA9PSAnZXhpbSciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogMwpsZWFrc3BlZWQ6ICIzNjBzIgpibGFja2hvbGU6IDVtCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgYmVoYXZpb3I6ICJzbXRwOnNwYW0iCiAgbGFiZWw6ICJFeGltIHNwYW0gYXR0ZW1wdCIKICByZW1lZGlhdGlvbjogdHJ1ZQogIHNlcnZpY2U6IHNtdHAK", "description": "detect spam on Exim", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "spam" + "behavior": "smtp:spam", + "confidence": 3, + "label": "Exim spam attempt", + "remediation": true, + "service": "smtp", + "spoofable": 0 } }, "crowdsecurity/f5-big-ip-cve-2020-5902": { "path": "scenarios/crowdsecurity/f5-big-ip-cve-2020-5902.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "04def871dad424adf0227232c8b22acab9938901a879dca070b58e2389039326", "deprecated": false + }, + "0.2": { + "digest": "8c8c704906bc05d7b9e40f9d99e3d85d5084fd462d99dea74b0687ab1268eb97", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L2Y1LWJpZy1pcC1jdmUtMjAyMC01OTAyCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDIwLTU5MDIgZXhwbG9pdGF0aW9uIGF0dGVtcHMiCmZpbHRlcjogfAogIGV2dC5NZXRhLmxvZ190eXBlIGluIFsiaHR0cF9hY2Nlc3MtbG9nIiwgImh0dHBfZXJyb3ItbG9nIl0gYW5kIAogICAgKAogICAgVXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBtYXRjaGVzIFVwcGVyKCcvdG11aS9sb2dpbi5qc3AvLi47L3RtdWkvW14uXSsuanNwXFw/KGZpbGVOYW1lfGNvbW1hbmR8ZGlyZWN0b3J5UGF0aHx0YWJJZCk9JykKICAgIG9yCiAgICBVcHBlcihldnQuTWV0YS5odHRwX3BhdGgpIG1hdGNoZXMgVXBwZXIoJy90bXVpL2xvZ2luLmpzcC8lMkUlMkU7L3RtdWkvW14uXSsuanNwXFw/KGZpbGVOYW1lfGNvbW1hbmR8ZGlyZWN0b3J5UGF0aHx0YWJJZCk9JykKICAgICkKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKYmxhY2tob2xlOiAybQpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L2Y1LWJpZy1pcC1jdmUtMjAyMC01OTAyCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDIwLTU5MDIgZXhwbG9pdGF0aW9uIGF0dGVtcHMiCmZpbHRlcjogfAogIGV2dC5NZXRhLmxvZ190eXBlIGluIFsiaHR0cF9hY2Nlc3MtbG9nIiwgImh0dHBfZXJyb3ItbG9nIl0gYW5kIAogICAgKAogICAgVXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBtYXRjaGVzIFVwcGVyKCcvdG11aS9sb2dpbi5qc3AvLi47L3RtdWkvW14uXSsuanNwXFw/KGZpbGVOYW1lfGNvbW1hbmR8ZGlyZWN0b3J5UGF0aHx0YWJJZCk9JykKICAgIG9yCiAgICBVcHBlcihldnQuTWV0YS5odHRwX3BhdGgpIG1hdGNoZXMgVXBwZXIoJy90bXVpL2xvZ2luLmpzcC8lMkUlMkU7L3RtdWkvW14uXSsuanNwXFw/KGZpbGVOYW1lfGNvbW1hbmR8ZGlyZWN0b3J5UGF0aHx0YWJJZCk9JykKICAgICkKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKYmxhY2tob2xlOiAybQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExOTAKICAgIC0gYXR0YWNrLlQxNTk1CiAgICAtIGN2ZS5DVkUtMjAyMC01OTAyCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJDVkUtMjAyMC01OTAyIgogIHJlbWVkaWF0aW9uOiB0cnVlCiAgc2VydmljZTogZjUK", "description": "Detect cve-2020-5902 exploitation attemps", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1190", + "attack.T1595", + "cve.CVE-2020-5902" + ], + "confidence": 3, + "label": "CVE-2020-5902", + "remediation": true, + "service": "f5", + "spoofable": 0 } }, "crowdsecurity/fortinet-cve-2018-13379": { "path": "scenarios/crowdsecurity/fortinet-cve-2018-13379.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "c966840446a481f46237df14963224a106cd15e8b7c72dc903de1ae098dbb58d", @@ -6744,94 +7941,154 @@ "0.2": { "digest": "a7952444f7fc5d039bc415c5e56baa8243badd1bcc4013e8d8e52bc6c2e1a431", "deprecated": false + }, + "0.3": { + "digest": "719602d5447335d3a176aebfd60b8246a7e166656e278f5b10f557cf3b5a218d", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L2ZvcnRpbmV0LWN2ZS0yMDE4LTEzMzc5CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDE4LTEzMzc5IGV4cGxvaXRhdGlvbiBhdHRlbXBzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZCAKICAgIFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgVXBwZXIoJy9yZW1vdGUvZmd0X2xhbmc/bGFuZz0vLi4vLi4vLi4vLi4vLy8vLy8vLy8vZGV2L2NtZGIvc3NsdnBuX3dlYnNlc3Npb24nKQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCmxhYmVsczoKICB0eXBlOiBleHBsb2l0CiAgcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L2ZvcnRpbmV0LWN2ZS0yMDE4LTEzMzc5CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGN2ZS0yMDE4LTEzMzc5IGV4cGxvaXRhdGlvbiBhdHRlbXBzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZCAKICAgIFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgVXBwZXIoJy9yZW1vdGUvZmd0X2xhbmc/bGFuZz0vLi4vLi4vLi4vLi4vLy8vLy8vLy8vZGV2L2NtZGIvc3NsdnBuX3dlYnNlc3Npb24nKQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTE5MAogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gY3ZlLkNWRS0yMDE4LTEzMzc5CiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJDVkUtMjAxOC0xMzM3OSIKICByZW1lZGlhdGlvbjogdHJ1ZQogIHNlcnZpY2U6IGZvcnRpbmV0Cg==", "description": "Detect cve-2018-13379 exploitation attemps", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1190", + "attack.T1595", + "cve.CVE-2018-13379" + ], + "confidence": 3, + "label": "CVE-2018-13379", + "remediation": true, + "service": "fortinet", + "spoofable": 0 } }, "crowdsecurity/freeswitch-acl-reject": { "path": "scenarios/crowdsecurity/freeswitch-acl-reject.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "947017331043b3e4c7a600d2bc7e9b40262ffdcd290389ef9cd0b0877a1fe4a7", "deprecated": false + }, + "0.2": { + "digest": "d8cb04c939b4e6e3eb315cd90535b5adec9368dada292602feb184f57a2db20d", + "deprecated": false } }, "long_description": "IyMgZnJlZXN3aXRjaCBhY2wgcmVqZWN0CgojIyMgRGVzY3JpcHRpb24KCkZyZWVTV0lUQ0ggaGFzIHRoZSBvcHRpb24gdG8gc2V0IHRydXN0ZWQgQUNMJ3MgdGhpcyB3aWxsIGRldGVjdCB3aGVuIGEgcmVxdWVzdCBpcyByZWplY3RlZCBkdWUgdG8gdGhlIEFDTC4gQW4gSVAgd2lsbCBoYXZlIDE1IGF0dGVtcHRzIGJlZm9yZSBiZWluZyBibG9ja2VkLg==", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9mcmVlc3dpdGNoLWFjbC1yZWplY3QKZGVzY3JpcHRpb246ICJEZXRlY3QgZnJlZXN3aXRjaCBhY2wgcmVqZWN0cyIKZmlsdGVyOiAiZXZ0Lk1ldGEuc2VydmljZSA9PSAnZnJlZXN3aXRjaCcgJiYgZXZ0Lk1ldGEuc3ViX3R5cGUgPT0gJ2FjbF9yZWplY3QnIgpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiAxNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiBzZXJ2aWNlOiBmcmVlc3dpdGNoCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9mcmVlc3dpdGNoLWFjbC1yZWplY3QKZGVzY3JpcHRpb246ICJEZXRlY3QgZnJlZXN3aXRjaCBhY2wgcmVqZWN0cyIKZmlsdGVyOiAiZXZ0Lk1ldGEuc2VydmljZSA9PSAnZnJlZXN3aXRjaCcgJiYgZXZ0Lk1ldGEuc3ViX3R5cGUgPT0gJ2FjbF9yZWplY3QnIgpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiAxNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExOTAKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBsYWJlbDogIkNWRS0yMDE4LTEzMzc5IgogIHJlbWVkaWF0aW9uOiB0cnVlCiAgc2VydmljZTogZnJlZXN3aXRjaAo=", "description": "Detect freeswitch acl rejects", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1190" + ], + "confidence": 3, + "label": "CVE-2018-13379", + "remediation": true, "service": "freeswitch", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/freeswitch-bf": { "path": "scenarios/crowdsecurity/freeswitch-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "de4be679bd6d04d4b06bcd45ce6dad21689f9ffb92c9ddc66a9f3fa50add8300", "deprecated": false + }, + "0.2": { + "digest": "ba040ff32f6d9c6a340276ff6dfa4e8d60f1f9a8e861368e3500d23197c06115", + "deprecated": false } }, "long_description": "IyMgZnJlZXN3aXRjaCBhdXRoIGJydXRlZm9yY2UKCiMjIyBEZXNjcmlwdGlvbgoKZnJlZVNXSVRDSCBsb2dzIHdoZW4gYW4gYXV0aGVudGljYXRpb24gYXR0ZW1wdCBmYWlscy4gVGhpcyBzY2VuYXJpbyB3aWxsIGRldGVjdCB3aGVuIGFuIElQIGhhcyBtb3JlIHRoYW4gNSBmYWlsZWQgYXR0ZW1wdHMuIFRoZXJlIGlzIGFsc28gYSBzbG93ZXIgc2NlbmFyaW9zIHRvIGRldGVjdCB3aGVuIGFuIElQIGhhcyBtb3JlIHRoYW4gMjAgZmFpbGVkIGF0dGVtcHRzLg==", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9mcmVlc3dpdGNoLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGZyZWVzd2l0Y2ggYXV0aCBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5zZXJ2aWNlID09ICdmcmVlc3dpdGNoJyAmJiBldnQuTWV0YS5zdWJfdHlwZSA9PSAnYXV0aF9mYWlsdXJlJyIKbGVha3NwZWVkOiAiMTBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogc2VydmljZTogZnJlZXN3aXRjaAogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUKLS0tCnR5cGU6IGxlYWt5Cm5hbWU6IGNyb3dkc2VjdXJpdHkvZnJlZXN3aXRjaC1zbG93LWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGZyZWVzd2l0Y2ggYXV0aCBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5zZXJ2aWNlID09ICdmcmVlc3dpdGNoJyAmJiBldnQuTWV0YS5zdWJfdHlwZSA9PSAnYXV0aF9mYWlsdXJlJyIKbGVha3NwZWVkOiAiMW0iCmNhcGFjaXR5OiAyMApncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiBzZXJ2aWNlOiBmcmVlc3dpdGNoCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9mcmVlc3dpdGNoLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGZyZWVzd2l0Y2ggYXV0aCBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5zZXJ2aWNlID09ICdmcmVlc3dpdGNoJyAmJiBldnQuTWV0YS5zdWJfdHlwZSA9PSAnYXV0aF9mYWlsdXJlJyIKbGVha3NwZWVkOiAiMTBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IGZyZWVzd2l0Y2gKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiZ2VuZXJpYzpicnV0ZWZvcmNlIgogIGxhYmVsOiAiZnJlZXN3aXRjaCBicnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCgotLS0KdHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9mcmVlc3dpdGNoLXNsb3ctYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgZnJlZXN3aXRjaCBhdXRoIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLnNlcnZpY2UgPT0gJ2ZyZWVzd2l0Y2gnICYmIGV2dC5NZXRhLnN1Yl90eXBlID09ICdhdXRoX2ZhaWx1cmUnIgpsZWFrc3BlZWQ6ICIxbSIKY2FwYWNpdHk6IDIwCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBmcmVlc3dpdGNoCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImdlbmVyaWM6YnJ1dGVmb3JjZSIKICBsYWJlbDogImZyZWVzd2l0Y2ggYnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect freeswitch auth bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "generic:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "freeswitch bruteforce", + "remediation": true, "service": "freeswitch", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/freeswitch-user-enumeration": { "path": "scenarios/crowdsecurity/freeswitch-user-enumeration.yaml", - "version": "0.1", + "version": "0.3", "versions": { "0.1": { "digest": "826b44367faa41e39a224ffdae5c4e9824d7f1e157dd67d24e97e785c7478922", "deprecated": false + }, + "0.2": { + "digest": "05d37cdecfac483f944e249b358d24f3c7e75292a1b4465d71d3994004e1548d", + "deprecated": false + }, + "0.3": { + "digest": "435670ee2f37b2f2d4918e282566c2cd97b6c79e94d488f8052ee351fdd14176", + "deprecated": false } }, "long_description": "IyMgZnJlZXN3aXRjaCB1c2VyIGVudW1lcmF0aW9uCgojIyMgRGVzY3JpcHRpb24KCkZyZWVTV0lUQ0ggd2lsbCBsb2cgd2hlbiBhbiBhIG5vdCBmb3VuZCB1c2VyLiBUaGlzIHNjZW5hcmlvIHdpbGwgZGV0ZWN0IHdoZW4gYW4gSVAgaGFzIG1vcmUgdGhhbiA1IGF0dGVtcHRzLiBUaGVyZSBpcyBhbHNvIGEgc2xvd2VyIHNjZW5hcmlvcyB0byBkZXRlY3Qgd2hlbiBhbiBJUCBoYXMgbW9yZSB0aGFuIDIwIGF0dGVtcHRzLg==", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9mcmVlc3dpdGNoLXVzZXItZW51bWVyYXRpb24KZGVzY3JpcHRpb246ICJEZXRlY3QgZnJlZXN3aXRjaCB1c2VyIGVudW1lcmF0aW9uIgpmaWx0ZXI6ICJldnQuTWV0YS5zZXJ2aWNlID09ICdmcmVlc3dpdGNoJyAmJiBldnQuTWV0YS5zdWJfdHlwZSA9PSAndXNlcl9lbnVtZXJhdGlvbiciCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKIHNlcnZpY2U6IGZyZWVzd2l0Y2gKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L2ZyZWVzd2l0Y2gtdXNlci1lbnVtZXJhdGlvbgpkZXNjcmlwdGlvbjogIkRldGVjdCBmcmVlc3dpdGNoIHVzZXIgZW51bWVyYXRpb24iCmZpbHRlcjogImV2dC5NZXRhLnNlcnZpY2UgPT0gJ2ZyZWVzd2l0Y2gnICYmIGV2dC5NZXRhLnN1Yl90eXBlID09ICd1c2VyX2VudW1lcmF0aW9uJyIKbGVha3NwZWVkOiAiMW0iCmNhcGFjaXR5OiAyMApncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiBzZXJ2aWNlOiBmcmVlc3dpdGNoCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9mcmVlc3dpdGNoLXVzZXItZW51bWVyYXRpb24KZGVzY3JpcHRpb246ICJEZXRlY3QgZnJlZXN3aXRjaCB1c2VyIGVudW1lcmF0aW9uIgpmaWx0ZXI6ICJldnQuTWV0YS5zZXJ2aWNlID09ICdmcmVlc3dpdGNoJyAmJiBldnQuTWV0YS5zdWJfdHlwZSA9PSAndXNlcl9lbnVtZXJhdGlvbiciCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBmcmVlc3dpdGNoCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1ODkKICBiZWhhdmlvcjogImdlbmVyaWM6YnJ1dGVmb3JjZSIKICBsYWJlbDogIkZyZWVzd2l0Y2ggdXNlciBlbnVtZXJhdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KdHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9mcmVlc3dpdGNoLXVzZXItZW51bWVyYXRpb24KZGVzY3JpcHRpb246ICJEZXRlY3QgZnJlZXN3aXRjaCB1c2VyIGVudW1lcmF0aW9uIgpmaWx0ZXI6ICJldnQuTWV0YS5zZXJ2aWNlID09ICdmcmVlc3dpdGNoJyAmJiBldnQuTWV0YS5zdWJfdHlwZSA9PSAndXNlcl9lbnVtZXJhdGlvbiciCmxlYWtzcGVlZDogIjFtIgpjYXBhY2l0eTogMjAKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGZyZWVzd2l0Y2gKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU4OQogIGJlaGF2aW9yOiAiZ2VuZXJpYzpicnV0ZWZvcmNlIgogIGxhYmVsOiAiRnJlZXN3aXRjaCB1c2VyIGVudW1lcmF0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect freeswitch user enumeration", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "generic:bruteforce", + "classification": [ + "attack.T1589" + ], + "confidence": 3, + "label": "Freeswitch user enumeration", + "remediation": true, "service": "freeswitch", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/grafana-cve-2021-43798": { "path": "scenarios/crowdsecurity/grafana-cve-2021-43798.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "38e2367afa09fce19313601b205c7ef60ff0dcda0d5a5fbfe162d391998727cf", "deprecated": false + }, + "0.2": { + "digest": "6fbaa53ca18c5826185024bce25c34e850508bf5bde27b90343938766b3a19e1", + "deprecated": false } }, "long_description": "RGV0ZWN0IGV4cGxvaXRhdGlvbiBvZiBDVkUtMjAyMS00Mzc5OAo=", - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L2dyYWZhbmEtY3ZlLTIwMjEtNDM3OTgKZGVzY3JpcHRpb246ICJEZXRlY3QgY3ZlLTIwMjEtNDM3OTggZXhwbG9pdGF0aW9uIGF0dGVtcHMiCmZpbHRlcjogfAogIGV2dC5NZXRhLmxvZ190eXBlIGluIFsiaHR0cF9hY2Nlc3MtbG9nIiwgImh0dHBfZXJyb3ItbG9nIl0gYW5kIAogICAgKFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgbWF0Y2hlcyAnL1BVQkxJQy9QTFVHSU5TL1teL10rLy4uL1suL10rLycKICAgIG9yCiAgICBVcHBlcihldnQuTWV0YS5odHRwX3BhdGgpIG1hdGNoZXMgJy9QVUJMSUMvUExVR0lOUy9bXi9dKy8lMkUlMkUvWyUyRS9dKy8nKQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCmxhYmVsczoKICB0eXBlOiBleHBsb2l0CiAgcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L2dyYWZhbmEtY3ZlLTIwMjEtNDM3OTgKZGVzY3JpcHRpb246ICJEZXRlY3QgY3ZlLTIwMjEtNDM3OTggZXhwbG9pdGF0aW9uIGF0dGVtcHMiCmZpbHRlcjogfAogIGV2dC5NZXRhLmxvZ190eXBlIGluIFsiaHR0cF9hY2Nlc3MtbG9nIiwgImh0dHBfZXJyb3ItbG9nIl0gYW5kIAogICAgKFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgbWF0Y2hlcyAnL1BVQkxJQy9QTFVHSU5TL1teL10rLy4uL1suL10rLycKICAgIG9yCiAgICBVcHBlcihldnQuTWV0YS5odHRwX3BhdGgpIG1hdGNoZXMgJy9QVUJMSUMvUExVR0lOUy9bXi9dKy8lMkUlMkUvWyUyRS9dKy8nKQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCmxhYmVsczoKICBzZXJ2aWNlOiBncmFmYW5hCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExOTAKICAgIC0gYXR0YWNrLlQxNTk1CiAgICAtIGN2ZS5DVkUtMjAyMS00Mzc5OAogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiQ1ZFLTIwMjEtNDM3OTgiCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect cve-2021-43798 exploitation attemps", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1190", + "attack.T1595", + "cve.CVE-2021-43798" + ], + "confidence": 3, + "label": "CVE-2021-43798", + "remediation": true, + "service": "grafana", + "spoofable": 0 } }, "crowdsecurity/home-assistant-bf": { "path": "scenarios/crowdsecurity/home-assistant-bf.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "7e155354a1558caba3896dc0af3ad311db2e4df90ea20d7809c288fd080b0356", @@ -6840,21 +8097,31 @@ "0.2": { "digest": "fb78b93bb62bf525357967eb64cfbca6ca315cec23288bc4e7e2272a82381770", "deprecated": false + }, + "0.3": { + "digest": "c0062c2ba368d81ed47dcc7fc8ac1b895363f69c4d8489ff40f284ce8d24c0ce", + "deprecated": false } }, "long_description": "RGV0ZWN0IHNldmVyYWwgZmFpbGVkIEhvbWUgYXNzaXN0YW50IGF1dGhlbnRpY2F0aW9ucy4KCmxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDUK", - "content": "IyBob21lLWFzc2lzdGFudCBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L2hvbWUtYXNzaXN0YW50LWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEhvbWUgQXNzaXN0YW50IGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2hvbWUtYXNzaXN0YW50X2ZhaWxlZF9hdXRoJwpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IGhvbWUtYXNzaXN0YW50CiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "IyBob21lLWFzc2lzdGFudCBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L2hvbWUtYXNzaXN0YW50LWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEhvbWUgQXNzaXN0YW50IGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2hvbWUtYXNzaXN0YW50X2ZhaWxlZF9hdXRoJwpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiaW90OmJydXRlZm9yY2UiCiAgbGFiZWw6ICJob21lIGFzc2lzdGFudCBicnV0ZWZvcmNlIgogIHNlcnZpY2U6IGhvbWUtYXNzaXN0YW50CiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect Home Assistant bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "iot:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "home assistant bruteforce", + "remediation": true, "service": "home-assistant", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/http-apiscp-bf": { "path": "scenarios/crowdsecurity/http-apiscp-bf.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "c0dec456fded0c14c7c48a918eb30e1ab35892581adb9263572cfa49fddc908e", @@ -6863,21 +8130,31 @@ "0.2": { "digest": "f6f5ed461e46ff730a57ae5bc2ee9187cdca20d0d5e13114fed8e381e384528b", "deprecated": false + }, + "0.3": { + "digest": "302d872cdb0695b8471e681e9da268e77d6fd0a63dc521929ed103924f37dafe", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBicnV0ZWZvcmNlIG9uIGFwaXNDUCBsb2dpbiBwYWdlICcvYXBwcy9sb2dpbicuCgpsZWFrc3BlZWQgb2YgMTBzLCBjYXBhY2l0eSBvZiA1Cg==", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWFwaXNjcC1iZgpkZXNjcmlwdGlvbjogImRldGVjdCBhcGlzQ1AgZGFzaGJvYXJkIGJydXRlZm9yY2UiCmRlYnVnOiBmYWxzZQojIHN1Y2Nlc3MgYXV0aCBvbiBhcGlzQ1AgcmV0dXJucyAzMDMKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2h0dHBfYWNjZXNzLWxvZycgJiYgZXZ0Lk1ldGEuaHR0cF9wYXRoIHN0YXJ0c1dpdGggJy9hcHBzL2xvZ2luJyAmJiBldnQuUGFyc2VkLnZlcmIgPT0gJ1BPU1QnICYmIGV2dC5NZXRhLmh0dHBfc3RhdHVzID09ICcyMDAnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAxMHMKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBodHRwCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWFwaXNjcC1iZgpkZXNjcmlwdGlvbjogImRldGVjdCBhcGlzQ1AgZGFzaGJvYXJkIGJydXRlZm9yY2UiCmRlYnVnOiBmYWxzZQojIHN1Y2Nlc3MgYXV0aCBvbiBhcGlzQ1AgcmV0dXJucyAzMDMKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2h0dHBfYWNjZXNzLWxvZycgJiYgZXZ0Lk1ldGEuaHR0cF9wYXRoIHN0YXJ0c1dpdGggJy9hcHBzL2xvZ2luJyAmJiBldnQuUGFyc2VkLnZlcmIgPT0gJ1BPU1QnICYmIGV2dC5NZXRhLmh0dHBfc3RhdHVzID09ICcyMDAnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAxMHMKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogYXBpc0NQCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogImFwaXNDUCBicnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "detect apisCP dashboard bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "http", - "type": "bruteforce" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "apisCP bruteforce", + "remediation": true, + "service": "apisCP", + "spoofable": 0 } }, "crowdsecurity/http-backdoors-attempts": { "path": "scenarios/crowdsecurity/http-backdoors-attempts.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "2eaba549ef284a36349482aa803b201fa8dcbff0f4d1ab2c5127d6b29806bba1", @@ -6890,21 +8167,31 @@ "0.3": { "digest": "9eab7252dba254defcc9f90f38874df9f4f323d75aca0c831b9c9567edf9c00f", "deprecated": false + }, + "0.4": { + "digest": "45241f8074b19ce99d11fc082af5600f6c1833d748659361057947ebbac1a876", + "deprecated": false } }, "long_description": "RGV0ZWN0IGF0dGVtcHRzIHRvIGFjY2VzcyBjb21tb24gYmFja2Rvb3JzIHN1Y2ggYXMgYzk5LnBocCAuLi4KCiMjIENvbmZpZ3VyYXRpb24KClRoaXMgc2NlbmFyaW8gd2lsbCBiZSB0cmlnZ2VyIGlmIGFuIGF0dGFja2VyIHJlcXVlc3RzIGEgbWluaW11bSBvZiB0d28gZGlmZmVyZW50cyBmaWxlIG9mIFt0aGUgbGlzdF0oaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2Nyb3dkc2VjdXJpdHkvc2VjLWxpc3RzL21hc3Rlci93ZWIvYmFja2Rvb3JzLnR4dCkvCgpDb25maWd1cmF0aW9uOgoKYGRpc3RpbmN0YCA6IGBldnQuUGFyc2VkLnJlcXVlc3RgIChIVFRQIHJlcXVlc3QgVVJJKQoKYGxlYWtzcGVlZGAgOiA1IHNlY29uZGVzCgpgZ3JvdXBfYnlgIDogYGV2dC5NZXRhLnNvdXJjZV9pcGAKCgojIyMgRGF0YQoKVGhpcyBzY2VuYXJpbyB1c2UgdGhlIFtmb2xsb3dpbmcgbGlzdCBiYWNrZG9vcnMudHh0XShodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vY3Jvd2RzZWN1cml0eS9zZWMtbGlzdHMvbWFzdGVyL3dlYi9iYWNrZG9vcnMudHh0KSBmcm9tIFtkYW5pZWxtaWVzc2xlcl0oaHR0cHM6Ly9naXRodWIuY29tL2RhbmllbG1pZXNzbGVyL1NlY0xpc3RzKQ==", - "content": "dHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvaHR0cC1iYWNrZG9vcnMtYXR0ZW1wdHMKZGVzY3JpcHRpb246ICJEZXRlY3QgYXR0ZW1wdCB0byBjb21tb24gYmFja2Rvb3JzIgpmaWx0ZXI6ICdldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZCBhbnkoRmlsZSgiYmFja2Rvb3JzLnR4dCIpLCB7IGV2dC5QYXJzZWQuZmlsZV9uYW1lID09ICN9KScKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKZGlzdGluY3Q6IGV2dC5QYXJzZWQuZmlsZV9uYW1lCmRhdGE6CiAgLSBzb3VyY2VfdXJsOiBodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vY3Jvd2RzZWN1cml0eS9zZWMtbGlzdHMvbWFzdGVyL3dlYi9iYWNrZG9vcnMudHh0CiAgICBkZXN0X2ZpbGU6IGJhY2tkb29ycy50eHQKICAgIHR5cGU6IHN0cmluZwpjYXBhY2l0eTogMQpsZWFrc3BlZWQ6IDVzCmJsYWNraG9sZTogNW0KbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICB0eXBlOiBkaXNjb3ZlcnkKICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvaHR0cC1iYWNrZG9vcnMtYXR0ZW1wdHMKZGVzY3JpcHRpb246ICJEZXRlY3QgYXR0ZW1wdCB0byBjb21tb24gYmFja2Rvb3JzIgpmaWx0ZXI6ICdldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZCBhbnkoRmlsZSgiYmFja2Rvb3JzLnR4dCIpLCB7IGV2dC5QYXJzZWQuZmlsZV9uYW1lID09ICN9KScKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKZGlzdGluY3Q6IGV2dC5QYXJzZWQuZmlsZV9uYW1lCmRhdGE6CiAgLSBzb3VyY2VfdXJsOiBodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vY3Jvd2RzZWN1cml0eS9zZWMtbGlzdHMvbWFzdGVyL3dlYi9iYWNrZG9vcnMudHh0CiAgICBkZXN0X2ZpbGU6IGJhY2tkb29ycy50eHQKICAgIHR5cGU6IHN0cmluZwpjYXBhY2l0eTogMQpsZWFrc3BlZWQ6IDVzCmJsYWNraG9sZTogNW0KbGFiZWxzOgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1CiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJzY2FubmluZyBmb3IgYmFja2Rvb3JzIgogIHNlcnZpY2U6IGh0dHAKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect attempt to common backdoors", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1595" + ], + "confidence": 3, + "label": "scanning for backdoors", + "remediation": true, "service": "http", - "type": "discovery" + "spoofable": 0 } }, "crowdsecurity/http-bad-user-agent": { "path": "scenarios/crowdsecurity/http-bad-user-agent.yaml", - "version": "0.8", + "version": "0.9", "versions": { "0.1": { "digest": "46e7058419bc3086f2919fb9afad6b2e85f0d4764f74153dd336ed491f99fa08", @@ -6937,20 +8224,31 @@ "0.8": { "digest": "38bc505811135db4788cb7a70199f43a7276f7828b86676fb8b4fc6da62a0adc", "deprecated": false + }, + "0.9": { + "digest": "6142a2394aaa38810c6d5c7258f8011bc4b39f7e2bf4cb6b6d557475bb377328", + "deprecated": false } }, "long_description": "IyBLbm93biBiYWQgdXNlci1hZ2VudHMKCkRldGVjdCBrbm93biBiYWQgdXNlci1hZ2VudHMuCgpCYW5zIGFmdGVyIHR3byByZXF1ZXN0cy4KCgoKCgo=", - "content": "dHlwZTogbGVha3kKZm9ybWF0OiAyLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvaHR0cC1iYWQtdXNlci1hZ2VudApkZXNjcmlwdGlvbjogIkRldGVjdCBiYWQgdXNlci1hZ2VudHMiCmZpbHRlcjogJ2V2dC5NZXRhLmxvZ190eXBlIGluIFsiaHR0cF9hY2Nlc3MtbG9nIiwgImh0dHBfZXJyb3ItbG9nIl0gJiYgUmVnZXhwSW5GaWxlKGV2dC5QYXJzZWQuaHR0cF91c2VyX2FnZW50LCAiYmFkX3VzZXJfYWdlbnRzLnJlZ2V4LnR4dCIpJwpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2Nyb3dkc2VjdXJpdHkvc2VjLWxpc3RzL21hc3Rlci93ZWIvYmFkX3VzZXJfYWdlbnRzLnJlZ2V4LnR4dAogICAgZGVzdF9maWxlOiBiYWRfdXNlcl9hZ2VudHMucmVnZXgudHh0CiAgICB0eXBlOiByZWdleHAKICAgIHN0cmF0ZWd5OiBMUlUKICAgIHNpemU6IDQwCiAgICB0dGw6IDEwcwpjYXBhY2l0eTogMQpsZWFrc3BlZWQ6IDFtCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHR5cGU6IHNjYW4KICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKZm9ybWF0OiAyLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvaHR0cC1iYWQtdXNlci1hZ2VudApkZXNjcmlwdGlvbjogIkRldGVjdCBiYWQgdXNlci1hZ2VudHMiCmZpbHRlcjogJ2V2dC5NZXRhLmxvZ190eXBlIGluIFsiaHR0cF9hY2Nlc3MtbG9nIiwgImh0dHBfZXJyb3ItbG9nIl0gJiYgUmVnZXhwSW5GaWxlKGV2dC5QYXJzZWQuaHR0cF91c2VyX2FnZW50LCAiYmFkX3VzZXJfYWdlbnRzLnJlZ2V4LnR4dCIpJwpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2Nyb3dkc2VjdXJpdHkvc2VjLWxpc3RzL21hc3Rlci93ZWIvYmFkX3VzZXJfYWdlbnRzLnJlZ2V4LnR4dAogICAgZGVzdF9maWxlOiBiYWRfdXNlcl9hZ2VudHMucmVnZXgudHh0CiAgICB0eXBlOiByZWdleHAKICAgIHN0cmF0ZWd5OiBMUlUKICAgIHNpemU6IDQwCiAgICB0dGw6IDEwcwpjYXBhY2l0eTogMQpsZWFrc3BlZWQ6IDFtCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIGNvbmZpZGVuY2U6IDEKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1CiAgYmVoYXZpb3I6ICJodHRwOnNjYW4iCiAgbGFiZWw6ICJkZXRlY3Rpb24gb2YgYmFkIHVzZXItYWdlbnRzIgogIHNlcnZpY2U6IGh0dHAKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect bad user-agents", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "scan" + "behavior": "http:scan", + "classification": [ + "attack.T1595" + ], + "confidence": 1, + "label": "detection of bad user-agents", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "crowdsecurity/http-bf-wordpress_bf": { "path": "scenarios/crowdsecurity/http-bf-wordpress_bf.yaml", - "version": "0.4", + "version": "0.5", "versions": { "0.1": { "digest": "628d9988c1f2448f4ffa5a72fe8aec6e1c1eedd8c838447630cce653bf31cbd9", @@ -6967,40 +8265,60 @@ "0.4": { "digest": "09f9a5e176da2971ddbdd07522fb64948500f867d78fc77167bcd494bce079a8", "deprecated": false + }, + "0.5": { + "digest": "9baa872c3b85a560952e57a77fd6fc49a5257a45c4296f89577ea6c490c0265f", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBicnV0ZWZvcmNlIG9uIHdvcmRwcmVzcyBsb2dpbiBwYWdlICd3cC1sb2dpbi5waHAnLgoKbGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgNQoK", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWJmLXdvcmRwcmVzc19iZgpkZXNjcmlwdGlvbjogImRldGVjdCB3b3JkcHJlc3MgYnJ1dGVmb3JjZSIKZGVidWc6IGZhbHNlCiMgZmFpbGVkIGF1dGggb24gd3AtbG9naW4ucGhwIHJldHVybnMgMjAwCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdodHRwX2FjY2Vzcy1sb2cnICYmIGV2dC5QYXJzZWQuZmlsZV9uYW1lID09ICd3cC1sb2dpbi5waHAnICYmIGV2dC5QYXJzZWQudmVyYiA9PSAnUE9TVCcgJiYgZXZ0Lk1ldGEuaHR0cF9zdGF0dXMgPT0gJzIwMCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogNQpsZWFrc3BlZWQ6IDEwcwpibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IGh0dHAKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWJmLXdvcmRwcmVzc19iZgpkZXNjcmlwdGlvbjogImRldGVjdCB3b3JkcHJlc3MgYnJ1dGVmb3JjZSIKZGVidWc6IGZhbHNlCiMgZmFpbGVkIGF1dGggb24gd3AtbG9naW4ucGhwIHJldHVybnMgMjAwCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdodHRwX2FjY2Vzcy1sb2cnICYmIGV2dC5QYXJzZWQuZmlsZV9uYW1lID09ICd3cC1sb2dpbi5waHAnICYmIGV2dC5QYXJzZWQudmVyYiA9PSAnUE9TVCcgJiYgZXZ0Lk1ldGEuaHR0cF9zdGF0dXMgPT0gJzIwMCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogNQpsZWFrc3BlZWQ6IDEwcwpibGFja2hvbGU6IDVtCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiV1AgYnJ1dGVmb3JjZSIKICBzZXJ2aWNlOiB3b3JkcHJlc3MKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "detect wordpress bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "http", - "type": "bruteforce" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "WP bruteforce", + "remediation": true, + "service": "wordpress", + "spoofable": 0 } }, "crowdsecurity/http-bf-wordpress_bf_xmlrpc": { "path": "scenarios/crowdsecurity/http-bf-wordpress_bf_xmlrpc.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "d4a3456d8fc2edb27b895967f79053f649b943f043763369d437d5c55591c402", "deprecated": false + }, + "0.2": { + "digest": "c3da65b418bd36dc8e26aaf7c620f7629c60a65b34115525b9c93e6312d261b2", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBicnV0ZWZvcmNlIG9uIHdvcmRwcmVzcyBBUEkgJ3htbHJwYy5waHAnLgoKKipXYXJuaW5nKio6IFNvbWUgcGx1Z2luIGhlYXZpbHkgcmVseSBvbiB0aGUgeG1scnBjLCBieSBlbmFibGluZyB0aGlzIHNjZW5hcmlvIHlvdSBjb3VsZCBibG9jayB5b3VyIG93biBzZXJ2ZXIuCkJlIHN1cmUgdG8gY2hlY2sgdGhlIHNvdXJjZSBvZiB0aGUgY2FsbHMgb24gdGhlIFhNTFJQQyBBUEkgYmVmb3JlIGVuYWJsaW5nIHRoaXMuCgpsZWFrc3BlZWQgb2YgMm0sIGNhcGFjaXR5IG9mIDUK", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWJmLXdvcmRwcmVzc19iZl94bWxycGMKZGVzY3JpcHRpb246ICJkZXRlY3Qgd29yZHByZXNzIGJydXRlZm9yY2Ugb24geG1scnBjIgpkZWJ1ZzogZmFsc2UKIyBYTUxSUEMgYWx3YXlzIHJldHVybnMgMjAwCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdodHRwX2FjY2Vzcy1sb2cnICYmIGV2dC5QYXJzZWQuZmlsZV9uYW1lID09ICd4bWxycGMucGhwJyAmJiBldnQuUGFyc2VkLnZlcmIgPT0gJ1BPU1QnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAybQpibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IGh0dHAKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWJmLXdvcmRwcmVzc19iZl94bWxycGMKZGVzY3JpcHRpb246ICJkZXRlY3Qgd29yZHByZXNzIGJydXRlZm9yY2Ugb24geG1scnBjIgpkZWJ1ZzogZmFsc2UKIyBYTUxSUEMgYWx3YXlzIHJldHVybnMgMjAwCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdodHRwX2FjY2Vzcy1sb2cnICYmIGV2dC5QYXJzZWQuZmlsZV9uYW1lID09ICd4bWxycGMucGhwJyAmJiBldnQuUGFyc2VkLnZlcmIgPT0gJ1BPU1QnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAybQpibGFja2hvbGU6IDVtCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiV1AgWE1MUlBDIGJydXRlZm9yY2UiCiAgc2VydmljZTogd29yZHByZXNzCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "detect wordpress bruteforce on xmlrpc", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "http", - "type": "bruteforce" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "WP XMLRPC bruteforce", + "remediation": true, + "service": "wordpress", + "spoofable": 0 } }, "crowdsecurity/http-crawl-non_statics": { "path": "scenarios/crowdsecurity/http-crawl-non_statics.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "86265749b84641e86e7e8ea3c1df53a1cabd1e0e04b6f93853db5d0687913cc7", @@ -7013,55 +8331,219 @@ "0.3": { "digest": "f0fa40870cdeea7b0da40b9f132e9c6de5e32d584334ec8a2d355faa35cde01c", "deprecated": false + }, + "0.4": { + "digest": "cd8f8a7a450855ad656b10758589c0d6fa38317ce001f3ae82dc29f0561f7145", + "deprecated": false } }, "long_description": "RGV0ZWN0IGNyYXdsIChodHRwIEdFVC9IRUFEKSBvbiBub24tc3RhdGljIChqcGcsY3NzLGpzLGV0Yy4pIGh0dHAgcGFnZXMgZnJvbSBhIHNpbmdsZSBpcC4KCkxlYWtzcGVlZCBvZiAwLjVzLCBjYXBhY2l0eSBvZiA0MAo=", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWNyYXdsLW5vbl9zdGF0aWNzCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGFnZ3Jlc3NpdmUgY3Jhd2wgZnJvbSBzaW5nbGUgaXAiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlIGluIFsnaHR0cF9hY2Nlc3MtbG9nJywgJ2h0dHBfZXJyb3ItbG9nJ10gJiYgZXZ0LlBhcnNlZC5zdGF0aWNfcmVzc291cmNlID09ICdmYWxzZScgJiYgZXZ0LlBhcnNlZC52ZXJiIGluIFsnR0VUJywgJ0hFQUQnXSIKZGlzdGluY3Q6ICJldnQuUGFyc2VkLmZpbGVfbmFtZSIKbGVha3NwZWVkOiAwLjVzCmNhcGFjaXR5OiA0MAojZGVidWc6IHRydWUKI3RoaXMgbGltaXRzIHRoZSBtZW1vcnkgY2FjaGUgKGFuZCBldmVudF9zZXF1ZW5jZXMgaW4gb3V0cHV0KSB0byBmaXZlIGV2ZW50cwpjYWNoZV9zaXplOiA1Cmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAgKyAnLycgKyBldnQuUGFyc2VkLnRhcmdldF9mcWRuIgpibGFja2hvbGU6IDFtCmxhYmVsczoKIHNlcnZpY2U6IGh0dHAKIHR5cGU6IGNyYXdsCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWNyYXdsLW5vbl9zdGF0aWNzCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGFnZ3Jlc3NpdmUgY3Jhd2wgZnJvbSBzaW5nbGUgaXAiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlIGluIFsnaHR0cF9hY2Nlc3MtbG9nJywgJ2h0dHBfZXJyb3ItbG9nJ10gJiYgZXZ0LlBhcnNlZC5zdGF0aWNfcmVzc291cmNlID09ICdmYWxzZScgJiYgZXZ0LlBhcnNlZC52ZXJiIGluIFsnR0VUJywgJ0hFQUQnXSIKZGlzdGluY3Q6ICJldnQuUGFyc2VkLmZpbGVfbmFtZSIKbGVha3NwZWVkOiAwLjVzCmNhcGFjaXR5OiA0MAojZGVidWc6IHRydWUKI3RoaXMgbGltaXRzIHRoZSBtZW1vcnkgY2FjaGUgKGFuZCBldmVudF9zZXF1ZW5jZXMgaW4gb3V0cHV0KSB0byBmaXZlIGV2ZW50cwpjYWNoZV9zaXplOiA1Cmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAgKyAnLycgKyBldnQuUGFyc2VkLnRhcmdldF9mcWRuIgpibGFja2hvbGU6IDFtCmxhYmVsczoKICBjb25maWRlbmNlOiAxCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU5NQogIGJlaGF2aW9yOiAiaHR0cDpjcmF3bCIKICBzZXJ2aWNlOiBodHRwCiAgbGFiZWw6ICJkZXRlY3Rpb24gb2YgYWdncmVzc2l2ZSBjcmF3bCIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect aggressive crawl from single ip", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:crawl", + "classification": [ + "attack.T1595" + ], + "confidence": 1, + "label": "detection of aggressive crawl", + "remediation": true, "service": "http", - "type": "crawl" + "spoofable": 0 } }, "crowdsecurity/http-cve-2021-41773": { "path": "scenarios/crowdsecurity/http-cve-2021-41773.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "297eff27011c942a75937838e09c60c80f9dfdbfcb18b358b666777b4d1e89aa", "deprecated": false + }, + "0.2": { + "digest": "3cd742ad69889bee2644daf08c4eef1c14359fdf67e3642542d157e0c1bc0382", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWN2ZS0yMDIxLTQxNzczCmRlc2NyaXB0aW9uOiAiY3ZlLTIwMjEtNDE3NzMiCmZpbHRlcjogfAogIGV2dC5NZXRhLmxvZ190eXBlIGluIFsiaHR0cF9hY2Nlc3MtbG9nIiwgImh0dHBfZXJyb3ItbG9nIl0gYW5kIAogICAgKFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgIi8uJTJFLy4lMkUvIgogICAgICBvcgogICAgIFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgIi8lMkUlMkUvJTJFJTJFIikKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKYmxhY2tob2xlOiAybQpsYWJlbHM6CiAgdHlwZTogc2NhbgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWN2ZS0yMDIxLTQxNzczCmRlc2NyaXB0aW9uOiAiY3ZlLTIwMjEtNDE3NzMiCmZpbHRlcjogfAogIGV2dC5NZXRhLmxvZ190eXBlIGluIFsiaHR0cF9hY2Nlc3MtbG9nIiwgImh0dHBfZXJyb3ItbG9nIl0gYW5kIAogICAgKFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgIi8uJTJFLy4lMkUvIgogICAgICBvcgogICAgIFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgIi8lMkUlMkUvJTJFJTJFIikKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKYmxhY2tob2xlOiAybQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExOTAKICAgIC0gYXR0YWNrLlQxNTk1CiAgICAtIGN2ZS5DVkUtMjAyMS00MTc3MwogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiQ1ZFLTIwMjEtNDE3NzMiCiAgc2VydmljZTogYXBhY2hlCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "cve-2021-41773", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "scan" + "behavior": "http:exploit", + "classification": [ + "attack.T1190", + "attack.T1595", + "cve.CVE-2021-41773" + ], + "confidence": 3, + "label": "CVE-2021-41773", + "remediation": true, + "service": "apache", + "spoofable": 0 } }, "crowdsecurity/http-cve-2021-42013": { "path": "scenarios/crowdsecurity/http-cve-2021-42013.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "5f7e21b44bc4284dde1cde1610109a06a0c986777f48c2f00e08db9e2f156459", "deprecated": false + }, + "0.2": { + "digest": "0ed92efba1d5146795df08340c91535aee56e9a0e2d650c2496f46ecb977314f", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKI3RoaXMgaXMgZ2V0dGluZyBmdW5ueSwgaXQncyB0aGUgdGhpcmQgcGF0Y2ggb24gdG9wIG9mIGN2ZS0yMDIxLTQxNzczCm5hbWU6IGNyb3dkc2VjdXJpdHkvaHR0cC1jdmUtMjAyMS00MjAxMwpkZXNjcmlwdGlvbjogImN2ZS0yMDIxLTQyMDEzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZCAKICAgIFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgIi8lJTMyJTY1JSUzMiU2NS8iCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHR5cGU6IHNjYW4KICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKI3RoaXMgaXMgZ2V0dGluZyBmdW5ueSwgaXQncyB0aGUgdGhpcmQgcGF0Y2ggb24gdG9wIG9mIGN2ZS0yMDIxLTQxNzczCm5hbWU6IGNyb3dkc2VjdXJpdHkvaHR0cC1jdmUtMjAyMS00MjAxMwpkZXNjcmlwdGlvbjogImN2ZS0yMDIxLTQyMDEzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZCAKICAgIFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgIi8lJTMyJTY1JSUzMiU2NS8iCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHNlcnZpY2U6IGFwYWNoZQogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTkwCiAgICAtIGF0dGFjay5UMTU5NQogICAgLSBjdmUuQ1ZFLTIwMjEtNDIwMTMKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBsYWJlbDogIkNWRS0yMDIxLTQyMDEzIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "cve-2021-42013", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "scan" + "behavior": "http:exploit", + "classification": [ + "attack.T1190", + "attack.T1595", + "cve.CVE-2021-42013" + ], + "confidence": 3, + "label": "CVE-2021-42013", + "remediation": true, + "service": "apache", + "spoofable": 0 + } + }, + "crowdsecurity/http-dos-bypass-cache": { + "path": "scenarios/crowdsecurity/http-dos-bypass-cache.yaml", + "version": "0.2", + "versions": { + "0.1": { + "digest": "0e58abde23b14beae6be2ca1b2bfe58ad980f75c5691b8c0cacf1b2fff4d23bd", + "deprecated": false + }, + "0.2": { + "digest": "05d3d10236ceb9b23f3f9355970f9b25583c891e0d0d3cf210dc289240b48f25", + "deprecated": false + } + }, + "long_description": "IyMgRGV0ZWN0aW5nIERPUyB3aXRoIGNhY2hlIGJ5cGFzcwoKVGhpcyBzY2VuYXJpbyBkZXRlY3RzIERvUyB0b29scyB0aGF0IGlzc3VlIGEgaGlnaCBudW1iZXIgb2YgcmVxdWVzdHMsIHdoaWxlIGF0dGVtcHRpbmcgdG8gYnlwYXNzIGNhY2hlIHJ1bGVzIGJ5IGFwcGVuZGluZyByYW5kb20gbnVtZXJpYyBzdWZmaXguCgpEaXJlY3RseSBpbnNwaXJlZCBieSBzb21lIHNwZWNpZmljIERvUyB0b29scyBUVFAuCgo6d2FybmluZzogVGhpcyBzY2VuYXJpbyBtaWdodCB0cmlnZ2VyIGZhbHNlIHBvc2l0aXZlcywgcHJvcGVyIHRlc3RpbmcgaXMgYWR2aXNlZCA6d2FybmluZzo=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWRvcy1ieXBhc3MtY2FjaGUKZGVzY3JpcHRpb246ICJEZXRlY3QgRG9TIHRvb2xzIGJ5cGFzc2luZyBjYWNoZSBldmVyeSByZXF1ZXN0IgojYXMgc2VlbiBpbiBjYy1hdHRhY2sgdG9vbApmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnaHR0cF9hY2Nlc3MtbG9nJyAmJiBpbnQoZXZ0Lk1ldGEuaHR0cF9hcmdzX2xlbikgPj0gNyAmJiBpbnQoZXZ0Lk1ldGEuaHR0cF9hcmdzX2xlbikgPD0gMTIgJiYgZXZ0LlBhcnNlZC5odHRwX2FyZ3MgbWF0Y2hlcyAnXlswLTldKyQnICYmIGV2dC5QYXJzZWQuc3RhdGljX3Jlc3NvdXJjZSA9PSAnZmFsc2UnIgpkaXN0aW5jdDogImV2dC5QYXJzZWQuaHR0cF9hcmdzIgpsZWFrc3BlZWQ6IDFzCmNhcGFjaXR5OiAzMAojZGVidWc6IHRydWUKY2FjaGVfc2l6ZTogMTAKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIHJlbWVkaWF0aW9uOiB0cnVlCiAgY29uZmlkZW5jZTogMgogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE0OTgKICBiZWhhdmlvcjogImh0dHA6ZG9zIgogIGxhYmVsOiAiZGV0ZWN0aW9uIG9mIGh0dHAgZG9zIHdpdGggY2FjaGUgYnlwYXNzIg==", + "description": "Detect DoS tools bypassing cache every request", + "author": "crowdsecurity", + "labels": { + "behavior": "http:dos", + "classification": [ + "attack.T1498" + ], + "confidence": 2, + "label": "detection of http dos with cache bypass", + "remediation": true, + "service": "http", + "spoofable": 0 + } + }, + "crowdsecurity/http-dos-invalid-http-versions": { + "path": "scenarios/crowdsecurity/http-dos-invalid-http-versions.yaml", + "version": "0.4", + "versions": { + "0.1": { + "digest": "4508b6364d19557247a86c08b6bd8c262295a661c01c183313c38aaeea08fd00", + "deprecated": false + }, + "0.2": { + "digest": "7a0fe2257c1e04db49ac1f9c1a882553caa7b787168f574cc28a116e52974b14", + "deprecated": false + }, + "0.3": { + "digest": "6ad1c79bf0ca97716b1176a9070a9eaf9e8356d0b5e3c1d7b4652cfa8acf8297", + "deprecated": false + }, + "0.4": { + "digest": "2cb7ced10c6122aee759e1c0abec546c23a339337abae98292a9bd4752113887", + "deprecated": false + } + }, + "long_description": "IyMgRGV0ZWN0aW5nIERPUyB3aXRoIGludmFsaWQgSFRUUCB2ZXJzaW9ucwoKVGhpcyBzY2VuYXJpbyBkZXRlY3RzIERvUyB0b29scyB0aGF0IGlzc3VlIGEgaGlnaCBudW1iZXIgb2YgcmVxdWVzdHMgd2l0aCBpbnZhbGlkIEhUVFAgdmVyc2lvbnMuCgpEaXJlY3RseSBpbnNwaXJlZCBieSBzb21lIHNwZWNpZmljIERvUyB0b29scyBUVFAuCgo6d2FybmluZzogVGhpcyBzY2VuYXJpbyBtaWdodCB0cmlnZ2VyIGZhbHNlIHBvc2l0aXZlcywgcHJvcGVyIHRlc3RpbmcgaXMgYWR2aXNlZCA6d2FybmluZzo=", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWRvcy1pbnZhbGlkLWh0dHAtdmVyc2lvbnMKZGVzY3JpcHRpb246ICJEZXRlY3QgRG9TIHRvb2xzIHVzaW5nIGludmFsaWQgSFRUUCB2ZXJzaW9ucyIKI3BhdHRlcm4gc2VlbiBpbiBtaGRkb3MgdG9vbApmaWx0ZXI6ICdldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdICYmIGV2dC5QYXJzZWQuaHR0cF92ZXJzaW9uIG5vdCBpbiBbIjAuOSIsICIxLjAiLCAiMS4xIiwgIjIuMCIsICIzLjAiXScgCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNvbmZpZGVuY2U6IDIKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNDk4CiAgYmVoYXZpb3I6ICJodHRwOmRvcyIKICBsYWJlbDogImRldGVjdGlvbiBvZiBodHRwIGRvcyB3aXRoIGludmFsaWQgaHR0cCB2ZXJzaW9uIg==", + "description": "Detect DoS tools using invalid HTTP versions", + "author": "crowdsecurity", + "labels": { + "behavior": "http:dos", + "classification": [ + "attack.T1498" + ], + "confidence": 2, + "label": "detection of http dos with invalid http version", + "remediation": true, + "service": "http", + "spoofable": 0 + } + }, + "crowdsecurity/http-dos-random-uri": { + "path": "scenarios/crowdsecurity/http-dos-random-uri.yaml", + "version": "0.2", + "versions": { + "0.1": { + "digest": "0fed8a75f88fd41f17498166bc1a60ec9e981ce1b82f0cd840ef52ae4fc71d39", + "deprecated": false + }, + "0.2": { + "digest": "f1ed5aefe6fce34ce3253e85b342c3849620e7582e21ea03596121d540e2265b", + "deprecated": false + } + }, + "long_description": "IyMgSFRUUCBET1MgUmFuZG9tIFVSSQoKClRoaXMgc2NlbmFyaW8gZGV0ZWN0cyBEb1MgdG9vbHMgdGhhdCBpc3N1ZSBhIGhpZ2ggbnVtYmVyIG9mIHJlcXVlc3RzLCB3aGlsZSB2YXJ5aW5nIHRoZSBzdWZmaXggVVJMIHRvIGV2YWRlIHN0YXRpYyBydWxlcy4KCkRpcmVjdGx5IGluc3BpcmVkIGJ5IHNvbWUgc3BlY2lmaWMgRG9TIHRvb2xzIFRUUC4KCjp3YXJuaW5nOiBUaGlzIHNjZW5hcmlvIG1pZ2h0IHRyaWdnZXIgZmFsc2UgcG9zaXRpdmVzLCBwcm9wZXIgdGVzdGluZyBpcyBhZHZpc2VkIDp3YXJuaW5nOgo=", + "content": "dHlwZTogbGVha3kKZm9ybWF0OiAyLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvaHR0cC1kb3MtcmFuZG9tLXVyaQpkZXNjcmlwdGlvbjogIkRldGVjdCBEb1MgdG9vbHMgdXNpbmcgcmFuZG9tIHVyaSIKI3BhdHRlcm4gc2VlbiBpbiBsb2ljIHRvb2wKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gImh0dHBfYWNjZXNzLWxvZyIgJiYKICBldnQuTWV0YS5odHRwX3ZlcmIgPT0gJ0dFVCcgJiYKICBldnQuUGFyc2VkLnN0YXRpY19yZXNzb3VyY2UgPT0gJ2ZhbHNlJyAmJgogIFVwcGVyKGV2dC5QYXJzZWQuZmlsZV9mcmFnKSA9PSBldnQuUGFyc2VkLmZpbGVfZnJhZyAmJgogIGxlbihldnQuUGFyc2VkLmZpbGVfZnJhZykgPT0gNiAmJgogIGludChldnQuTWV0YS5odHRwX2FyZ3NfbGVuKSA9PSAwCmNhcGFjaXR5OiAzMApsZWFrc3BlZWQ6IDFzCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIGNvbmZpZGVuY2U6IDIKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNDk4CiAgYmVoYXZpb3I6ICJodHRwOmRvcyIKICBsYWJlbDogImRldGVjdGlvbiBvZiBodHRwIGRvcyB2aWEgcmFuZG9tIHVyaSIKICBzZXJ2aWNlOiBodHRwCiAgcmVtZWRpYXRpb246IHRydWUK", + "description": "Detect DoS tools using random uri", + "author": "crowdsecurity", + "labels": { + "behavior": "http:dos", + "classification": [ + "attack.T1498" + ], + "confidence": 2, + "label": "detection of http dos via random uri", + "remediation": true, + "service": "http", + "spoofable": 0 + } + }, + "crowdsecurity/http-dos-switching-ua": { + "path": "scenarios/crowdsecurity/http-dos-switching-ua.yaml", + "version": "0.3", + "versions": { + "0.1": { + "digest": "3e0821e088a069ff12b26bfd106c913405b8cda87755438b535bbb803da6d5a1", + "deprecated": false + }, + "0.2": { + "digest": "54b1bc5cade329a7b8dd8a4447258b8c0029732759dae3e2632e0f96abc04b36", + "deprecated": false + }, + "0.3": { + "digest": "f40b2ff1b0a7351994ec48af5f5c31d66e4e475632e34e3e7c9218fb88b67cb6", + "deprecated": false + } + }, + "long_description": "IyMgSFRUUCBET1MgQ2hhbmdpbmcgVXNlci1BZ2VudAoKVGhpcyBzY2VuYXJpbyBkZXRlY3RzIHNwZWNpZmljIERvUyB0b29scyB0aGF0IGlzc3VlIGEgaGlnaCBudW1iZXIgb2YgcmVxdWVzdHMsIHdoaWxlIGNoYW5naW5nIHRoZSBgVXNlci1BZ2VudGAgZXZlcnkgcmVxdWVzdC4KCkRpcmVjdGx5IGluc3BpcmVkIGJ5IHNvbWUgc3BlY2lmaWMgRG9TIHRvb2xzIFRUUC4KCjp3YXJuaW5nOiBUaGlzIHNjZW5hcmlvIG1pZ2h0IHRyaWdnZXIgZmFsc2UgcG9zaXRpdmVzLCBwcm9wZXIgdGVzdGluZyBpcyBhZHZpc2VkIDp3YXJuaW5nOgo=", + "content": "dHlwZTogbGVha3kKZm9ybWF0OiAyLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvaHR0cC1kb3Mtc3dpdGhjaW5nLXVhCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IERvUyB0b29scyBzd2l0Y2hpbmcgdXNlci1hZ2VudCB0b28gZmFzdCIKI3BhdHRlcm4gc2VlbiBpbiBtaGRkb3MgdG9vbApmaWx0ZXI6ICdldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdJwpjYXBhY2l0eTogMTAKZGlzdGluY3Q6IGV2dC5QYXJzZWQuaHR0cF91c2VyX2FnZW50CmxlYWtzcGVlZDogOHMKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKYmxhY2tob2xlOiAybQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIHJlbWVkaWF0aW9uOiB0cnVlCiAgY29uZmlkZW5jZTogMgogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE0OTgKICBiZWhhdmlvcjogImh0dHA6ZG9zIgogIGxhYmVsOiAiZGV0ZWN0aW9uIG9mIGh0dHAgZG9zIHdpdGggdmFyeWluZyBVQSI=", + "description": "Detect DoS tools switching user-agent too fast", + "author": "crowdsecurity", + "labels": { + "behavior": "http:dos", + "classification": [ + "attack.T1498" + ], + "confidence": 2, + "label": "detection of http dos with varying UA", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "crowdsecurity/http-generic-bf": { "path": "scenarios/crowdsecurity/http-generic-bf.yaml", - "version": "0.4", + "version": "0.5", "versions": { "0.1": { "digest": "aaaf0209fe77be79d8d61a50e73e5da6807e8f13eb7d9832e705553770f6d376", @@ -7078,21 +8560,31 @@ "0.4": { "digest": "be339072fbbe0691926e92678c48edd17141fc0f17ac14fd8b08f6a4e4f72748", "deprecated": false + }, + "0.5": { + "digest": "d03fa7fbb3179407f221bc4e11d177422d21e5adcdcf408edf5f8b0ef492741f", + "deprecated": false } }, "long_description": "QWxlcnQgd2hlbiBhIHNpbmdsZSBJUCB0aGF0IHRyeSB0byBicnV0ZWZvcmNlIGh0dHAgYmFzaWMgYXV0aC4KCkxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDUuCg==", - "content": "IyA0MDQgc2Nhbgp0eXBlOiBsZWFreQojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWdlbmVyaWMtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgZ2VuZXJpYyBodHRwIGJydXRlIGZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5zZXJ2aWNlID09ICdodHRwJyAmJiBldnQuTWV0YS5zdWJfdHlwZSA9PSAnYXV0aF9mYWlsJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmNhcGFjaXR5OiA1CmxlYWtzcGVlZDogIjEwcyIKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiBzZXJ2aWNlOiBodHRwCiB0eXBlOiBiZgogcmVtZWRpYXRpb246IHRydWUKLS0tCiMgR2VuZXJpYyA0MDEgQXV0aG9yaXphdGlvbiBFcnJvcnMKdHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IExlUHJlc2lkZW50ZS9odHRwLWdlbmVyaWMtNDAxLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGdlbmVyaWMgNDAxIEF1dGhvcml6YXRpb24gZXJyb3IgYnJ1dGUgZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdodHRwX2FjY2Vzcy1sb2cnICYmIGV2dC5QYXJzZWQudmVyYiA9PSAnUE9TVCcgJiYgZXZ0Lk1ldGEuaHR0cF9zdGF0dXMgPT0gJzQwMSciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogNQpsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogMW0KbGFiZWxzOgogc2VydmljZTogaHR0cAogdHlwZTogYmYKIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIEdlbmVyaWMgNDAzIEZvcmJpZGRlbiAoQXV0aG9yaXphdGlvbikgRXJyb3JzCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBMZVByZXNpZGVudGUvaHR0cC1nZW5lcmljLTQwMy1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBnZW5lcmljIDQwMyBGb3JiaWRkZW4gKEF1dGhvcml6YXRpb24pIGVycm9yIGJydXRlIGZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnaHR0cF9hY2Nlc3MtbG9nJyAmJiBldnQuUGFyc2VkLnZlcmIgPT0gJ1BPU1QnICYmIGV2dC5NZXRhLmh0dHBfc3RhdHVzID09ICc0MDMnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAiMTBzIgpibGFja2hvbGU6IDFtCmxhYmVsczoKIHNlcnZpY2U6IGh0dHAKIHR5cGU6IGJmCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyA0MDQgc2Nhbgp0eXBlOiBsZWFreQojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLWdlbmVyaWMtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgZ2VuZXJpYyBodHRwIGJydXRlIGZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5zZXJ2aWNlID09ICdodHRwJyAmJiBldnQuTWV0YS5zdWJfdHlwZSA9PSAnYXV0aF9mYWlsJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmNhcGFjaXR5OiA1CmxlYWtzcGVlZDogIjEwcyIKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogImh0dHAgYnJ1dGVmb3JjZSIKICBzZXJ2aWNlOiBodHRwCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgR2VuZXJpYyA0MDEgQXV0aG9yaXphdGlvbiBFcnJvcnMKdHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IExlUHJlc2lkZW50ZS9odHRwLWdlbmVyaWMtNDAxLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGdlbmVyaWMgNDAxIEF1dGhvcml6YXRpb24gZXJyb3IgYnJ1dGUgZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdodHRwX2FjY2Vzcy1sb2cnICYmIGV2dC5QYXJzZWQudmVyYiA9PSAnUE9TVCcgJiYgZXZ0Lk1ldGEuaHR0cF9zdGF0dXMgPT0gJzQwMSciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogNQpsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJodHRwIGJydXRlZm9yY2UiCiAgc2VydmljZTogaHR0cAogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIEdlbmVyaWMgNDAzIEZvcmJpZGRlbiAoQXV0aG9yaXphdGlvbikgRXJyb3JzCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBMZVByZXNpZGVudGUvaHR0cC1nZW5lcmljLTQwMy1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBnZW5lcmljIDQwMyBGb3JiaWRkZW4gKEF1dGhvcml6YXRpb24pIGVycm9yIGJydXRlIGZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnaHR0cF9hY2Nlc3MtbG9nJyAmJiBldnQuUGFyc2VkLnZlcmIgPT0gJ1BPU1QnICYmIGV2dC5NZXRhLmh0dHBfc3RhdHVzID09ICc0MDMnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAiMTBzIgpibGFja2hvbGU6IDFtCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiaHR0cCBicnV0ZWZvcmNlIgogIHNlcnZpY2U6IGh0dHAKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect generic http brute force", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "http bruteforce", + "remediation": true, "service": "http", - "type": "bf" + "spoofable": 0 } }, "crowdsecurity/http-magento-bf": { "path": "scenarios/crowdsecurity/http-magento-bf.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "a77e4cb9a813ac8bad557138f3b20abaa67d8210768fcb350fb3efcc58c1dfc1", @@ -7101,22 +8593,31 @@ "0.2": { "digest": "98091fa975da7753f9b52ae6e028f9fef0dc46cb93575533a5a04ba824cda8f0", "deprecated": false + }, + "0.3": { + "digest": "e70c86f1a22879247fb6085ca2e6949a3163f92fd33c803ce7f89f0586324a00", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBicnV0ZWZvcmNlIG9uIE1hZ2VudG8gQWRtaW4gcGFnZS4KCmxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDUKCg==", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLW1hZ2VudG8tYmYKZGVidWc6IGZhbHNlCmRlc2NyaXB0aW9uOiAiZGV0ZWN0IE1hZ2VudG8gYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ0FETUlOX0xPR0lOX0ZBSUxFRCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogNQpsZWFrc3BlZWQ6IDEwcwpibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IGh0dHAKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCiBhcHBsaWNhdGlvbjogbWFnZW50bwo=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLW1hZ2VudG8tYmYKZGVidWc6IGZhbHNlCmRlc2NyaXB0aW9uOiAiZGV0ZWN0IE1hZ2VudG8gYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ0FETUlOX0xPR0lOX0ZBSUxFRCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogNQpsZWFrc3BlZWQ6IDEwcwpibGFja2hvbGU6IDVtCmxhYmVsczoKICBzZXJ2aWNlOiBtYWdlbnRvCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogImh0dHAgYnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "detect Magento bruteforce", "author": "crowdsecurity", "labels": { - "application": "magento", - "remediation": "true", - "service": "http", - "type": "bruteforce" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "http bruteforce", + "remediation": true, + "service": "magento", + "spoofable": 0 } }, "crowdsecurity/http-magento-ccs": { "path": "scenarios/crowdsecurity/http-magento-ccs.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "bf2bc42b888e36b62144129dd2d61e7b1aac6a4d1926c3ebbfe8453d15c3f6f3", @@ -7125,22 +8626,31 @@ "0.2": { "digest": "07dc5f21d5c4bcf6863c3ce57c4490a8a74c13d2c11ff32e73e419b768478468", "deprecated": false + }, + "0.3": { + "digest": "a390e04333ce744c7f3cb00ac3d7e72333c40f4f1407c87116244fc0a2a0ca86", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBjcmVkaXQgY2FyZCBzdHVmZmluZyBvbiBNYWdlbnRvIHdlYnNpdGUuCgpNb3JlIHRoYW4gMyBwYXltZW50cyBmYWlsZWQgZnJvbSBhIHNhbWUgSVAgaW4gbGVzcyB0aGFuIDMwIHNlY29uZGVzIHdpbGwgdHJpZ2dlciB0aGlzIHNjZW5hcmlvLgo=", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLW1hZ2VudG8tY2NzCmRlYnVnOiBmYWxzZQpkZXNjcmlwdGlvbjogIkRldGVjdCBjcmVkaXQgY2FyZCBzdHVmZmluZyBmcm9tIGEgc2luZ2xlIElQIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnUEFZTUVOVF9GQUlMRUQnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDMKbGVha3NwZWVkOiAzMHMKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBodHRwCiB0eXBlOiBzY2FuCiByZW1lZGlhdGlvbjogdHJ1ZQogYXBwbGljYXRpb246IG1hZ2VudG8K", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLW1hZ2VudG8tY2NzCmRlYnVnOiBmYWxzZQpkZXNjcmlwdGlvbjogIkRldGVjdCBjcmVkaXQgY2FyZCBzdHVmZmluZyBmcm9tIGEgc2luZ2xlIElQIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnUEFZTUVOVF9GQUlMRUQnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDMKbGVha3NwZWVkOiAzMHMKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgcmVtZWRpYXRpb246IHRydWUKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwLjAwNAogIGNvbmZpZGVuY2U6IDIKICBzcG9vZmFibGU6IDAKICBzZXJ2aWNlOiBtYWdlbnRvCiAgYmVoYXZpb3I6ICJlY29tbWVyY2U6ZnJhdWQiCiAgbGFiZWw6ICJNYWdlbnRvIENyZWRpdCBDYXJkIFN0dWZmaW5nIgo=", "description": "Detect credit card stuffing from a single IP", "author": "crowdsecurity", "labels": { - "application": "magento", - "remediation": "true", - "service": "http", - "type": "scan" + "behavior": "ecommerce:fraud", + "classification": [ + "attack.T1110.004" + ], + "confidence": 2, + "label": "Magento Credit Card Stuffing", + "remediation": true, + "service": "magento", + "spoofable": 0 } }, "crowdsecurity/http-magento-ccs-by-as": { "path": "scenarios/crowdsecurity/http-magento-ccs-by-as.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "6e585961ae092036eb9a506c311d331c3cbd59eccdf642cae86b424c39ad730a", @@ -7149,22 +8659,31 @@ "0.2": { "digest": "f65c1ddfabf04040ce288ff53a5d63db45e0db5995d43c86bd868243e3d3c099", "deprecated": false + }, + "0.3": { + "digest": "e77332ad52bff93a640417fa59b9762979421828ac32484df886af68208dc335", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBkaXN0cmlidXRlZCBjcmVkaXQgY2FyZCBzdHVmZmluZyBieSBBUyBvbiBNYWdlbnRvIHdlYnNpdGUuCgoKTW9yZSB0aGFuIDEwIHBheW1lbnRzIGZhaWxlZCBpbiB0aGUgc2FtZSBBUyBpbiBsZXNzIHRoYW4gMzBzZWNvbmRlcyB3aWxsIHRyaWdnZXIgdGhpcyBzY2VuYXJpby4K", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLW1hZ2VudG8tY2NzLWJ5LWFzCmRlYnVnOiBmYWxzZQpkZXNjcmlwdGlvbjogIkRldGVjdCBkaXN0cmlidXRlZCBjcmVkaXQgY2FyZCBzdHVmZmluZyBmcm9tIHNhbWUgQVMiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdQQVlNRU5UX0ZBSUxFRCcgYW5kIGV2dC5NZXRhLkFTTk51bWJlciAhPSAnJyAiCmdyb3VwYnk6IGV2dC5NZXRhLkFTTk51bWJlcgpkaXN0aW5jdDogZXZ0Lk1ldGEuc291cmNlX2lwCmNhcGFjaXR5OiAxMApsZWFrc3BlZWQ6IDMwcwpibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IGh0dHAKIHR5cGU6IHNjYW4KIHJlbWVkaWF0aW9uOiB0cnVlCiBhcHBsaWNhdGlvbjogbWFnZW50bwo=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLW1hZ2VudG8tY2NzLWJ5LWFzCmRlYnVnOiBmYWxzZQpkZXNjcmlwdGlvbjogIkRldGVjdCBkaXN0cmlidXRlZCBjcmVkaXQgY2FyZCBzdHVmZmluZyBmcm9tIHNhbWUgQVMiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdQQVlNRU5UX0ZBSUxFRCcgYW5kIGV2dC5NZXRhLkFTTk51bWJlciAhPSAnJyAiCmdyb3VwYnk6IGV2dC5NZXRhLkFTTk51bWJlcgpkaXN0aW5jdDogZXZ0Lk1ldGEuc291cmNlX2lwCmNhcGFjaXR5OiAxMApsZWFrc3BlZWQ6IDMwcwpibGFja2hvbGU6IDVtCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAuMDA0CiAgY29uZmlkZW5jZTogMQogIHNwb29mYWJsZTogMwogIHNlcnZpY2U6IG1hZ2VudG8KICBiZWhhdmlvcjogImVjb21tZXJjZTpmcmF1ZCIKICBsYWJlbDogIk1hZ2VudG8gQ3JlZGl0IENhcmQgU3R1ZmZpbmcgQnkgQVMiCg==", "description": "Detect distributed credit card stuffing from same AS", "author": "crowdsecurity", "labels": { - "application": "magento", - "remediation": "true", - "service": "http", - "type": "scan" + "behavior": "ecommerce:fraud", + "classification": [ + "attack.T1110.004" + ], + "confidence": 1, + "label": "Magento Credit Card Stuffing By AS", + "remediation": true, + "service": "magento", + "spoofable": 3 } }, "crowdsecurity/http-magento-ccs-by-country": { "path": "scenarios/crowdsecurity/http-magento-ccs-by-country.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "be8ae3f56024ef1be29104fa72a84e0178b2330f2e873b170cef782b1d3d6bc0", @@ -7173,22 +8692,31 @@ "0.2": { "digest": "fa29d5fb5f1f420753717485319e5c85fe39c977b5525ccc895a7b24f15a598c", "deprecated": false + }, + "0.3": { + "digest": "f4ff753638b54a01a2f455acc045e6229f62c6ce5d5751c8d1815b62f3161521", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBkaXN0cmlidXRlZCBjcmVkaXQgY2FyZCBzdHVmZmluZyBieSBjb3VudHJ5IG9uIE1hZ2VudG8gd2Vic2l0ZS4KCk1vcmUgdGhhbiAxMCBwYXltZW50cyBmYWlsZWQgaW4gdGhlIHNhbWUgY291bnRyeSBpbiBsZXNzIHRoYW4gMzBzZWNvbmRlcyB3aWxsIHRyaWdnZXIgdGhpcyBzY2VuYXJpby4KCg==", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLW1hZ2VudG8tY2NzLWJ5LWNvdW50cnkKZGVidWc6IGZhbHNlCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGRpc3RyaWJ1dGVkIGNyZWRpdCBjYXJkIHN0dWZmaW5nIGZyb20gc2FtZSBjb3VudHJ5IgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnUEFZTUVOVF9GQUlMRUQnIGFuZCBldnQuTWV0YS5Jc29Db2RlICE9ICcnICIKZ3JvdXBieTogZXZ0Lk1ldGEuSXNvQ29kZQpkaXN0aW5jdDogZXZ0Lk1ldGEuc291cmNlX2lwCmNhcGFjaXR5OiAxMApsZWFrc3BlZWQ6IDMwcwpibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IGh0dHAKIHR5cGU6IHNjYW4KIHJlbWVkaWF0aW9uOiB0cnVlCiBhcHBsaWNhdGlvbjogbWFnZW50bwo=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLW1hZ2VudG8tY2NzLWJ5LWNvdW50cnkKZGVidWc6IGZhbHNlCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGRpc3RyaWJ1dGVkIGNyZWRpdCBjYXJkIHN0dWZmaW5nIGZyb20gc2FtZSBjb3VudHJ5IgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnUEFZTUVOVF9GQUlMRUQnIGFuZCBldnQuTWV0YS5Jc29Db2RlICE9ICcnICIKZ3JvdXBieTogZXZ0Lk1ldGEuSXNvQ29kZQpkaXN0aW5jdDogZXZ0Lk1ldGEuc291cmNlX2lwCmNhcGFjaXR5OiAxMApsZWFrc3BlZWQ6IDMwcwpibGFja2hvbGU6IDVtCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAuMDA0CiAgY29uZmlkZW5jZTogMQogIHNwb29mYWJsZTogMwogIHNlcnZpY2U6IG1hZ2VudG8KICBiZWhhdmlvcjogImVjb21tZXJjZTpmcmF1ZCIKICBsYWJlbDogIk1hZ2VudG8gQ3JlZGl0IENhcmQgU3R1ZmZpbmcgQnkgQ291bnRyeSIK", "description": "Detect distributed credit card stuffing from same country", "author": "crowdsecurity", "labels": { - "application": "magento", - "remediation": "true", - "service": "http", - "type": "scan" + "behavior": "ecommerce:fraud", + "classification": [ + "attack.T1110.004" + ], + "confidence": 1, + "label": "Magento Credit Card Stuffing By Country", + "remediation": true, + "service": "magento", + "spoofable": 3 } }, "crowdsecurity/http-open-proxy": { "path": "scenarios/crowdsecurity/http-open-proxy.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "994b9d17d915f47f4ee5f10b2d8b9b7c72b5c93e64f75f3dc1313bf3b5c2613f", @@ -7201,21 +8729,32 @@ "0.3": { "digest": "e6629c2cdb8f06a1f10561079d926ae42b8d90f680541bb30355714675f0412a", "deprecated": false + }, + "0.4": { + "digest": "5f808fac4a5cfe22723d2b588b23a72cb523796f689c9f53582ed41e0b7cbb45", + "deprecated": false } }, "long_description": "VGFrZSBhIHJlbWVkaWF0aW9uIGFnYWluc3QgYW55IElQIG1ha2luZyBhIGBDT05ORUNUYCBIVFRQIHJlcXVlc3Qgd2hpY2ggcmV0dXJucyBhIDQwMCBzdGF0dXMgY29kZS4KVGhpcyBpcyBhIHRyaWdnZXIgYnVja2V0LCBzbyBvbmx5IG9uZSByZXF1ZXN0IGlzIGVub3VnaCB0byB0cmlnZ2VyIHRoZSBzY2VuYXJpby4=", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2h0dHAtb3Blbi1wcm94eQpkZXNjcmlwdGlvbjogIkRldGVjdCBzY2FuIGZvciBvcGVuIHByb3h5IgojYXBhY2hlIHJldHVybnMgNDA1LCBuZ2lueCA0MDAKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2h0dHBfYWNjZXNzLWxvZycgJiYgZXZ0Lk1ldGEuaHR0cF9zdGF0dXMgaW4gWyc0MDAnLCc0MDUnXSAmJiAoZXZ0LlBhcnNlZC52ZXJiID09ICdDT05ORUNUJyB8fCBldnQuUGFyc2VkLnJlcXVlc3QgbWF0Y2hlcyAnXmh0dHBbc10/Oi8vJykiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogc2VydmljZTogaHR0cAogdHlwZTogc2NhbgogcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2h0dHAtb3Blbi1wcm94eQpkZXNjcmlwdGlvbjogIkRldGVjdCBzY2FuIGZvciBvcGVuIHByb3h5IgojYXBhY2hlIHJldHVybnMgNDA1LCBuZ2lueCA0MDAKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2h0dHBfYWNjZXNzLWxvZycgJiYgZXZ0Lk1ldGEuaHR0cF9zdGF0dXMgaW4gWyc0MDAnLCc0MDUnXSAmJiAoZXZ0LlBhcnNlZC52ZXJiID09ICdDT05ORUNUJyB8fCBldnQuUGFyc2VkLnJlcXVlc3QgbWF0Y2hlcyAnXmh0dHBbc10/Oi8vJykiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICB0eXBlOiBzY2FuCiAgcmVtZWRpYXRpb246IHRydWUKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1CiAgYmVoYXZpb3I6ICJodHRwOnNjYW4iCiAgbGFiZWw6ICJIVFRQIE9wZW4gUHJveHkgUHJvYmluZyIKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCg==", "description": "Detect scan for open proxy", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:scan", + "classification": [ + "attack.T1595" + ], + "confidence": 3, + "label": "HTTP Open Proxy Probing", + "remediation": true, "service": "http", + "spoofable": 0, "type": "scan" } }, "crowdsecurity/http-path-traversal-probing": { "path": "scenarios/crowdsecurity/http-path-traversal-probing.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "3f00b0aa00448549a0a9635fdd86d8135503078c7087c1f5e4af11d49e7c2ee1", @@ -7224,21 +8763,31 @@ "0.2": { "digest": "b02022230086b96c212913406376584cc431332bb5cd26078dffa44ff9454499", "deprecated": false + }, + "0.3": { + "digest": "ae515cb83575c4f1e82ed1011d3b2ea9f9c86077fa6f59f28aa5d235b481adbe", + "deprecated": false } }, "long_description": "VGhlIGh0dHAgcGF0aCB0cmF2ZXJzYWwgcHJvYmluZyBzY2VuYXJpbyBhaW1zIGF0IGRldGVjdGluZywgd2l0aCB2ZXJ5IGxpdHRsZSBmYWxzZSBwb3NpdGl2ZSBjaGFuY2VzLCBwYXRoIHRyYXZlcnNhbCBwcm9iaW5nIGF0dGVtcHRzLgoKUGF0aCB0cmF2ZXJzYWwgYXR0ZW1wdHMgd2lsbCBiZSBkZXRlY3RlZCB3aXRoIHRoZSBwcmVzZW5jZSBvZiBzcGVjaWZpYyBwYXRoIG1hbmlwdWxhdGlvbiBwYXR0ZXJucyBpbiB0aGUgVVJJIG9yIHRoZSBgR0VUYCBwYXJhbWV0ZXIgc3VjaCBhcyBgLi4vYCAsIGAlMkZldGMlMkZwYXNzd2RgIC4uLgoKOndhcm5pbmc6IFRoaXMgc2NlbmFyaW8gaXMgX25vdF8gYSBXQUYgYW5kIHRoaXMgc2NlbmFyaW8gZG9lcyBfbm90XyBhaW1zIGF0IHJlcGxhY2luZyBhIFdBRi4=", - "content": "IyBwYXRoIHRyYXZlcnNhbCBwcm9iaW5nCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L2h0dHAtcGF0aC10cmF2ZXJzYWwtcHJvYmluZwpkZXNjcmlwdGlvbjogIkRldGVjdCBwYXRoIHRyYXZlcnNhbCBhdHRlbXB0IgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2h0dHBfYWNjZXNzLWxvZycsICdodHRwX2Vycm9yLWxvZyddICYmIGFueShGaWxlKCdodHRwX3BhdGhfdHJhdmVyc2FsLnR4dCcpLHtldnQuTWV0YS5odHRwX3BhdGggY29udGFpbnMgI30pIgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2Nyb3dkc2VjdXJpdHkvc2VjLWxpc3RzL21hc3Rlci93ZWIvcGF0aF90cmF2ZXJzYWwudHh0CiAgICBkZXN0X2ZpbGU6IGh0dHBfcGF0aF90cmF2ZXJzYWwudHh0CiAgICB0eXBlOiBzdHJpbmcKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKZGlzdGluY3Q6ICJldnQuTWV0YS5odHRwX3BhdGgiCmNhcGFjaXR5OiAzCnJlcHJvY2VzczogdHJ1ZQpsZWFrc3BlZWQ6IDEwcwpibGFja2hvbGU6IDJtCmxhYmVsczoKIHNlcnZpY2U6IGh0dHAKIHR5cGU6IHNjYW4KIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "IyBwYXRoIHRyYXZlcnNhbCBwcm9iaW5nCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L2h0dHAtcGF0aC10cmF2ZXJzYWwtcHJvYmluZwpkZXNjcmlwdGlvbjogIkRldGVjdCBwYXRoIHRyYXZlcnNhbCBhdHRlbXB0IgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2h0dHBfYWNjZXNzLWxvZycsICdodHRwX2Vycm9yLWxvZyddICYmIGFueShGaWxlKCdodHRwX3BhdGhfdHJhdmVyc2FsLnR4dCcpLHtldnQuTWV0YS5odHRwX3BhdGggY29udGFpbnMgI30pIgpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2Nyb3dkc2VjdXJpdHkvc2VjLWxpc3RzL21hc3Rlci93ZWIvcGF0aF90cmF2ZXJzYWwudHh0CiAgICBkZXN0X2ZpbGU6IGh0dHBfcGF0aF90cmF2ZXJzYWwudHh0CiAgICB0eXBlOiBzdHJpbmcKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKZGlzdGluY3Q6ICJldnQuTWV0YS5odHRwX3BhdGgiCmNhcGFjaXR5OiAzCnJlcHJvY2VzczogdHJ1ZQpsZWFrc3BlZWQ6IDEwcwpibGFja2hvbGU6IDJtCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUuMDAyCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJIVFRQIFBhdGggVHJhdmVyc2FsIEV4cGxvaXQiCiAgc2VydmljZTogaHR0cAogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMK", "description": "Detect path traversal attempt", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1595.002" + ], + "confidence": 3, + "label": "HTTP Path Traversal Exploit", + "remediation": true, "service": "http", - "type": "scan" + "spoofable": 0 } }, "crowdsecurity/http-probing": { "path": "scenarios/crowdsecurity/http-probing.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "580a3bcbb3756b8da7717c88708305791f39ef17c1e5c3041a1dd54b7293f57a", @@ -7247,21 +8796,31 @@ "0.2": { "digest": "c8bb45b4fb8834ea1dc5cff6439dd272c87d7ee5af4a51e77341ec6edc5d7a25", "deprecated": false + }, + "0.3": { + "digest": "983c356924b6e01f709b3c2d901ceb4e4ce1abe6e840048558f2824a4c4a6719", + "deprecated": false } }, "long_description": "VGFrZSByZW1lZGlhdGlvbiBhZ2FpbnN0IGEgc2luZ2xlIElQIHRoYXQgcmVxdWlyZXMgbXVsdGlwbGUgZGlmZmVyZW50IChodHRwIHBhdGgpIHBhZ2VzIHRoYXQgZW5kIHVwIGluIDQwNC80MDMvNDAwLgoKTGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgMTAuCg==", - "content": "IyA0MDQgc2Nhbgp0eXBlOiBsZWFreQojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLXByb2JpbmcKZGVzY3JpcHRpb246ICJEZXRlY3Qgc2l0ZSBzY2FubmluZy9wcm9iaW5nIGZyb20gYSBzaW5nbGUgaXAiCmZpbHRlcjogImV2dC5NZXRhLnNlcnZpY2UgPT0gJ2h0dHAnICYmIGV2dC5NZXRhLmh0dHBfc3RhdHVzIGluIFsnNDA0JywgJzQwMycsICc0MDAnXSAmJiBldnQuUGFyc2VkLnN0YXRpY19yZXNzb3VyY2UgPT0gJ2ZhbHNlJyIKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCArICcvJyArIGV2dC5QYXJzZWQudGFyZ2V0X2ZxZG4iCmRpc3RpbmN0OiAiZXZ0Lk1ldGEuaHR0cF9wYXRoIgpjYXBhY2l0eTogMTAKcmVwcm9jZXNzOiB0cnVlCmxlYWtzcGVlZDogIjEwcyIKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBodHRwCiB0eXBlOiBzY2FuCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyA0MDQgc2Nhbgp0eXBlOiBsZWFreQojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLXByb2JpbmcKZGVzY3JpcHRpb246ICJEZXRlY3Qgc2l0ZSBzY2FubmluZy9wcm9iaW5nIGZyb20gYSBzaW5nbGUgaXAiCmZpbHRlcjogImV2dC5NZXRhLnNlcnZpY2UgPT0gJ2h0dHAnICYmIGV2dC5NZXRhLmh0dHBfc3RhdHVzIGluIFsnNDA0JywgJzQwMycsICc0MDAnXSAmJiBldnQuUGFyc2VkLnN0YXRpY19yZXNzb3VyY2UgPT0gJ2ZhbHNlJyIKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCArICcvJyArIGV2dC5QYXJzZWQudGFyZ2V0X2ZxZG4iCmRpc3RpbmN0OiAiZXZ0Lk1ldGEuaHR0cF9wYXRoIgpjYXBhY2l0eTogMTAKcmVwcm9jZXNzOiB0cnVlCmxlYWtzcGVlZDogIjEwcyIKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgcmVtZWRpYXRpb246IHRydWUKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1LjAwMwogIGJlaGF2aW9yOiAiaHR0cDpzY2FuIgogIGxhYmVsOiAiSFRUUCBQcm9iaW5nIgogIHNwb29mYWJsZTogMAogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAxCg==", "description": "Detect site scanning/probing from a single ip", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:scan", + "classification": [ + "attack.T1595.003" + ], + "confidence": 1, + "label": "HTTP Probing", + "remediation": true, "service": "http", - "type": "scan" + "spoofable": 0 } }, "crowdsecurity/http-sensitive-files": { "path": "scenarios/crowdsecurity/http-sensitive-files.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "9ed53c09709b6e9f11b52e204c8155e9a6b9db9de25686c6b1909a9c59740c5f", @@ -7270,21 +8829,31 @@ "0.2": { "digest": "3f20d74ee5b040db30743ed189537e8c43e04f8954bb5a02251a3495e7a2a555", "deprecated": false + }, + "0.3": { + "digest": "575087fce9fdb9351075bf563a6062fb3c5a9b35ab6844d0b2d4cc492f3497dd", + "deprecated": false } }, "long_description": "IyBIVFRQIFNlbnNpdGl2ZSBmaWxlcwoKRGV0ZWN0IHRlbnRhdGl2ZSBvZiBkYW5nZXJvdXMgZmlsZSBzY2FubmluZyBzdWNoIGFzIGxvZ3MgZmlsZSwgZGF0YWJhc2UgYmFja3VwLCB6aXAgYXJjaGl2ZSBldGMgLi4uCgojIyMgUnVsZQpNb3JlIHRoYW4gMyBhY2Nlc3MgdG8gc2Vuc2l0aXZlIGZpbGVzIGluIFt0aGlzIGxpc3RdKGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9jcm93ZHNlY3VyaXR5L3NlYy1saXN0cy9tYXN0ZXIvd2ViL3NlbnNpdGl2ZV9kYXRhLnR4dCk=", - "content": "dHlwZTogbGVha3kKZm9ybWF0OiAyLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvaHR0cC1zZW5zaXRpdmUtZmlsZXMKZGVzY3JpcHRpb246ICJEZXRlY3QgYXR0ZW1wdCB0byBhY2Nlc3MgdG8gc2Vuc2l0aXZlIGZpbGVzICgubG9nLCAuZGIgLi4pIG9yIGZvbGRlcnMgKC5naXQpIgpmaWx0ZXI6ICdldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZCBhbnkoRmlsZSgic2Vuc2l0aXZlX2RhdGEudHh0IiksIHsgZXZ0LlBhcnNlZC5yZXF1ZXN0IGVuZHNXaXRoICN9KScKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKZGlzdGluY3Q6IGV2dC5QYXJzZWQucmVxdWVzdApkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2Nyb3dkc2VjdXJpdHkvc2VjLWxpc3RzL21hc3Rlci93ZWIvc2Vuc2l0aXZlX2RhdGEudHh0CiAgICBkZXN0X2ZpbGU6IHNlbnNpdGl2ZV9kYXRhLnR4dAogICAgdHlwZTogc3RyaW5nCmNhcGFjaXR5OiA0CmxlYWtzcGVlZDogNXMKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIHR5cGU6IGRpc2NvdmVyeQogIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogbGVha3kKZm9ybWF0OiAyLjAKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvaHR0cC1zZW5zaXRpdmUtZmlsZXMKZGVzY3JpcHRpb246ICJEZXRlY3QgYXR0ZW1wdCB0byBhY2Nlc3MgdG8gc2Vuc2l0aXZlIGZpbGVzICgubG9nLCAuZGIgLi4pIG9yIGZvbGRlcnMgKC5naXQpIgpmaWx0ZXI6ICdldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZCBhbnkoRmlsZSgic2Vuc2l0aXZlX2RhdGEudHh0IiksIHsgZXZ0LlBhcnNlZC5yZXF1ZXN0IGVuZHNXaXRoICN9KScKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKZGlzdGluY3Q6IGV2dC5QYXJzZWQucmVxdWVzdApkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2Nyb3dkc2VjdXJpdHkvc2VjLWxpc3RzL21hc3Rlci93ZWIvc2Vuc2l0aXZlX2RhdGEudHh0CiAgICBkZXN0X2ZpbGU6IHNlbnNpdGl2ZV9kYXRhLnR4dAogICAgdHlwZTogc3RyaW5nCmNhcGFjaXR5OiA0CmxlYWtzcGVlZDogNXMKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgcmVtZWRpYXRpb246IHRydWUKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1LjAwMwogIGJlaGF2aW9yOiAiaHR0cDpzY2FuIgogIGxhYmVsOiAiQWNjZXNzIHRvIHNlbnNpdGl2ZSBmaWxlcyBvdmVyIEhUVFAiCiAgc3Bvb2ZhYmxlOiAwCiAgc2VydmljZTogaHR0cAogIGNvbmZpZGVuY2U6IDMK", "description": "Detect attempt to access to sensitive files (.log, .db ..) or folders (.git)", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:scan", + "classification": [ + "attack.T1595.003" + ], + "confidence": 3, + "label": "Access to sensitive files over HTTP", + "remediation": true, "service": "http", - "type": "discovery" + "spoofable": 0 } }, "crowdsecurity/http-sqli-probing": { "path": "scenarios/crowdsecurity/http-sqli-probing.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "f3388a2016f9a7fc48a31a357b21c8e65093b8031fc7b120ee2f020de16be246", @@ -7293,59 +8862,91 @@ "0.2": { "digest": "87683f8a569090e52fbcc6ca2ffe139658950d6a05f9d611fd13e90ab875cdb1", "deprecated": false + }, + "0.3": { + "digest": "5d3674a78d0dfb87d8f086f72830c61954575599883244cf23d5876954e9600c", + "deprecated": false } }, "long_description": "VGhlIGh0dHAgc3FsaSBwcm9iaW5nIHNjZW5hcmlvIGFpbXMgYXQgZGV0ZWN0aW5nLCB3aXRoIHZlcnkgbGl0dGxlIGZhbHNlIHBvc2l0aXZlIGNoYW5jZXMsIFNRTCBpbmplY3Rpb24gcHJvYmluZyBhdHRlbXB0cy4KClNRTCBpbmplY3Rpb24gcHJvYmluZyBhdHRlbXB0cyB3aWxsIGJlIGNoYXJhY3Rlcml6ZWQgYnkgdGhlIHByZXNlbmNlIG9mIHNwZWNpZmljIFNRTC1yZWxhdGVkIHBhdHRlcm5zIGluIHVyaS9HRVQgYXJndW1lbnRzIChpZiBhbmQgd2hlbiB0aGlzIGlzIHdoZXJlIHRoZSBpbmplY3RlZCBwYXJhbWV0ZXIgaXMpLCBhbmQgdGhpcyBpcyB3aGF0IHRoaXMgc2NlbmFyaW8gZGV0ZWN0cy4KCgpUaGUgW3dvcmQgbGlzdF0oaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2Nyb3dkc2VjdXJpdHkvc2VjLWxpc3RzL21hc3Rlci93ZWIvc3FsaV9wcm9iZV9wYXR0ZXJucy50eHQpIGlzIHBpY2tlZCBzcGVjaWZpY2FsbHkgdG8gbGltaXQgZmFsc2UgcG9zaXRpdmVzLgpGdXJ0aGVybW9yZSwgYSBgZGlzdGluY3RgIGRpcmVjdGl2ZSBpcyBwcmVzZW50IG9uIHRoZSBnZXQgcGFyYW1ldGVycyB0aGVtc2VsdmVzIHRvIHJlZHVjZSBmYWxzZSBwb3NpdGl2ZSBjaGFuY2VzLgoKWW91IGNhbiB0ZXN0IHRoZSBiZWhhdmlvciBvZiB0aGUgc2NlbmFyaW8gYnkgbGF1bmNoaW5nIHRoZSBleGNlbGxlbnQgW3NxbG1hcF0oaHR0cHM6Ly9zcWxtYXAub3JnKSBvbiBvbmUgb2YgeW91ciBwYWdlcy4KCioqV0FSTklORyoqIFRoaXMgc2NlbmFyaW8gaXMgX25vdF8gYSBXQUYsIGFuZCB0aGlzIHNjZW5hcmlvIGRvZXMgX25vdF8gYWltcyBhdCByZXBsYWNpbmcgYSBXQUYuIEEgbW90aXZhdGVkIGF0dGFja2VyIHdpdGgga25vd2xlZGdlIG9mIGNyb3dkc2VjIHdpbGwgYmUgYWJsZSB0byBieXBhc3MgaXQuIEl0IGlzIG1vc3RseSBtZWFudCB0byBiZSBhIHdheSB0byBkZXRlY3QgZ2VuZXJpYyBTUUwgaW5qZWN0aW9uIHByb2Jpbmcgc3VjaCBhcyBwZXJmb3JtZWQgYnkgb3Blbi1zb3VyY2Ugb3IgY29tbWVyY2lhbCBzY2FubmVycy4KCg==", - "content": "dHlwZTogbGVha3kKI3JlcXVpcmVzIGF0IGxlYXN0IDIuMCBiZWNhdXNlIGl0J3MgdXNpbmcgdGhlICdkYXRhJyBzZWN0aW9uIGFuZCB0aGUgJ1VwcGVyJyBleHByIGhlbHBlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L2h0dHAtc3FsaS1wcm9iYmluZy1kZXRlY3Rpb24KZGF0YToKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9jcm93ZHNlY3VyaXR5L3NlYy1saXN0cy9tYXN0ZXIvd2ViL3NxbGlfcHJvYmVfcGF0dGVybnMudHh0CiAgICBkZXN0X2ZpbGU6IHNxbGlfcHJvYmVfcGF0dGVybnMudHh0CiAgICB0eXBlOiBzdHJpbmcKZGVzY3JpcHRpb246ICJBIHNjZW5hcmlvIHRoYXQgZGV0ZWN0cyBTUUwgaW5qZWN0aW9uIHByb2Jpbmcgd2l0aCBtaW5pbWFsIGZhbHNlIHBvc2l0aXZlcyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWydodHRwX2FjY2Vzcy1sb2cnLCAnaHR0cF9lcnJvci1sb2cnXSAmJiBhbnkoRmlsZSgnc3FsaV9wcm9iZV9wYXR0ZXJucy50eHQnKSwge1VwcGVyKGV2dC5QYXJzZWQuaHR0cF9hcmdzKSBjb250YWlucyBVcHBlcigjKX0pIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDEwCmxlYWtzcGVlZDogMXMKYmxhY2tob2xlOiA1bQojbG93IGZhbHNlIHBvc2l0aXZlcyBhcHByb2FjaCA6IHdlIHJlcXVpcmUgZGlzdGluY3QgcGF5bG9hZHMgdG8gYXZvaWQgZmFsc2UgcG9zaXRpdmVzCmRpc3RpbmN0OiBldnQuUGFyc2VkLmh0dHBfYXJncwpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIHR5cGU6IHNxbGlfcHJvYmluZwogIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogbGVha3kKI3JlcXVpcmVzIGF0IGxlYXN0IDIuMCBiZWNhdXNlIGl0J3MgdXNpbmcgdGhlICdkYXRhJyBzZWN0aW9uIGFuZCB0aGUgJ1VwcGVyJyBleHByIGhlbHBlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L2h0dHAtc3FsaS1wcm9iYmluZy1kZXRlY3Rpb24KZGF0YToKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9jcm93ZHNlY3VyaXR5L3NlYy1saXN0cy9tYXN0ZXIvd2ViL3NxbGlfcHJvYmVfcGF0dGVybnMudHh0CiAgICBkZXN0X2ZpbGU6IHNxbGlfcHJvYmVfcGF0dGVybnMudHh0CiAgICB0eXBlOiBzdHJpbmcKZGVzY3JpcHRpb246ICJBIHNjZW5hcmlvIHRoYXQgZGV0ZWN0cyBTUUwgaW5qZWN0aW9uIHByb2Jpbmcgd2l0aCBtaW5pbWFsIGZhbHNlIHBvc2l0aXZlcyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWydodHRwX2FjY2Vzcy1sb2cnLCAnaHR0cF9lcnJvci1sb2cnXSAmJiBhbnkoRmlsZSgnc3FsaV9wcm9iZV9wYXR0ZXJucy50eHQnKSwge1VwcGVyKGV2dC5QYXJzZWQuaHR0cF9hcmdzKSBjb250YWlucyBVcHBlcigjKX0pIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDEwCmxlYWtzcGVlZDogMXMKYmxhY2tob2xlOiA1bQojbG93IGZhbHNlIHBvc2l0aXZlcyBhcHByb2FjaCA6IHdlIHJlcXVpcmUgZGlzdGluY3QgcGF5bG9hZHMgdG8gYXZvaWQgZmFsc2UgcG9zaXRpdmVzCmRpc3RpbmN0OiBldnQuUGFyc2VkLmh0dHBfYXJncwpsYWJlbHM6CiAgcmVtZWRpYXRpb246IHRydWUKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1LjAwMgogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiU1FMIEluamVjdGlvbiBBdHRlbXB0IgogIHNwb29mYWJsZTogMAogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAzCg==", "description": "A scenario that detects SQL injection probing with minimal false positives", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1595.002" + ], + "confidence": 3, + "label": "SQL Injection Attempt", + "remediation": true, "service": "http", - "type": "sqli_probing" + "spoofable": 0 } }, "crowdsecurity/http-wordpress_user-enum": { "path": "scenarios/crowdsecurity/http-wordpress_user-enum.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "b3d23b71ecb4434773e907675a1c117a97acaeeb18a9d57062bded417f18b646", "deprecated": false + }, + "0.2": { + "digest": "681c3829aefbbd4bf347ea85d62b4445012b276368d729114aa27bc380c801ab", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBwcm9iaW5nIHRvIGVudW1lcmF0ZSB3b3JkcHJlc3MgYXV0aG9ycyA6IGAvP2F1dGhvcj1YWGAKCmxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDUKCg==", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLXdvcmRwcmVzc191c2VyLWVudW0KZGVzY3JpcHRpb246ICJkZXRlY3Qgd29yZHByZXNzIHByb2JpbmcgOiBhdXRob3JzIGVudW1lcmF0aW9uIgpkZWJ1ZzogZmFsc2UKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2h0dHBfYWNjZXNzLWxvZycgJiYgVXBwZXIoZXZ0LlBhcnNlZC5odHRwX2FyZ3MpIGNvbnRhaW5zICdBVVRIT1I9JyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuUGFyc2VkLmh0dHBfYXJncwpjYXBhY2l0eTogNQpsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogNW0KbGFiZWxzOgogc2VydmljZTogaHR0cAogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLXdvcmRwcmVzc191c2VyLWVudW0KZGVzY3JpcHRpb246ICJkZXRlY3Qgd29yZHByZXNzIHByb2JpbmcgOiBhdXRob3JzIGVudW1lcmF0aW9uIgpkZWJ1ZzogZmFsc2UKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2h0dHBfYWNjZXNzLWxvZycgJiYgVXBwZXIoZXZ0LlBhcnNlZC5odHRwX2FyZ3MpIGNvbnRhaW5zICdBVVRIT1I9JyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuUGFyc2VkLmh0dHBfYXJncwpjYXBhY2l0eTogNQpsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogNW0KbGFiZWxzOgogIHJlbWVkaWF0aW9uOiB0cnVlCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU4OQogICAgLSBhdHRhY2suVDExMTAKICAgIC0gYXR0YWNrLlQxNTk1CiAgYmVoYXZpb3I6ICJodHRwOnNjYW4iCiAgbGFiZWw6ICJXb3JkcHJlc3MgVXNlciBFbnVtZXJhdGlvbiIKICBzcG9vZmFibGU6IDAKICBzZXJ2aWNlOiB3b3JkcHJlc3MKICBjb25maWRlbmNlOiAzCg==", "description": "detect wordpress probing : authors enumeration", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "http", - "type": "bruteforce" + "behavior": "http:scan", + "classification": [ + "attack.T1589", + "attack.T1110", + "attack.T1595" + ], + "confidence": 3, + "label": "Wordpress User Enumeration", + "remediation": true, + "service": "wordpress", + "spoofable": 0 } }, "crowdsecurity/http-wordpress_wpconfig": { "path": "scenarios/crowdsecurity/http-wordpress_wpconfig.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "ff3876c1f9828052ba633264920100aa49402ab3e41a9cb73d28853d248a6d98", "deprecated": false + }, + "0.2": { + "digest": "0d45562d1540796a109c8e986f2d0c79ce312f0d7547134ac449cf24c5934cb5", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBwcm9iaW5nIHRvIGZpbmQgYWx0ZXJuYXRlIHdwLWNvbmZpZyBmaWxlLCBzdWNoIGFzIGRvbmUgYnkgd3BzY2FuLgoKbGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgNQoK", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLXdvcmRwcmVzc193cGNvbmZpZwpkZXNjcmlwdGlvbjogImRldGVjdCB3b3JkcHJlc3MgcHJvYmluZyA6IHZhcmlhdGlvbnMgYXJvdW5kIHdwLWNvbmZpZy5waHAgYnkgd3BzY2FuIgpkZWJ1ZzogZmFsc2UKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2h0dHBfYWNjZXNzLWxvZycgJiYgZXZ0LlBhcnNlZC5maWxlX25hbWUgY29udGFpbnMgJ3dwLWNvbmZpZy5waHAnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5QYXJzZWQuZmlsZV9uYW1lCmNhcGFjaXR5OiA1CmxlYWtzcGVlZDogIjEwcyIKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBodHRwCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9odHRwLXdvcmRwcmVzc193cGNvbmZpZwpkZXNjcmlwdGlvbjogImRldGVjdCB3b3JkcHJlc3MgcHJvYmluZyA6IHZhcmlhdGlvbnMgYXJvdW5kIHdwLWNvbmZpZy5waHAgYnkgd3BzY2FuIgpkZWJ1ZzogZmFsc2UKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2h0dHBfYWNjZXNzLWxvZycgJiYgZXZ0LlBhcnNlZC5maWxlX25hbWUgY29udGFpbnMgJ3dwLWNvbmZpZy5waHAnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5QYXJzZWQuZmlsZV9uYW1lCmNhcGFjaXR5OiA1CmxlYWtzcGVlZDogIjEwcyIKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgcmVtZWRpYXRpb246IHRydWUKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1CiAgYmVoYXZpb3I6ICJodHRwOnNjYW4iCiAgbGFiZWw6ICJBY2Nlc3MgdG8gV29yZHByZXNzIHdwLWNvbmZpZy5waHAiCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIHNlcnZpY2U6IHdvcmRwcmVzcwo=", "description": "detect wordpress probing : variations around wp-config.php by wpscan", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "http", - "type": "bruteforce" + "behavior": "http:scan", + "classification": [ + "attack.T1595" + ], + "confidence": 3, + "label": "Access to Wordpress wp-config.php", + "remediation": true, + "service": "wordpress", + "spoofable": 0 } }, "crowdsecurity/http-xss-probing": { "path": "scenarios/crowdsecurity/http-xss-probing.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "8d6f0d6f9dc48f8f5ad561a2cdb315e499539b3575f259e0d6cf5850ef1efc9e", @@ -7354,57 +8955,91 @@ "0.2": { "digest": "1c4d58e1a29cf806a92f67c981532f8a4656312abd05697dcc69b59b757f0076", "deprecated": false + }, + "0.3": { + "digest": "c16d275e5e3bedd452be87f48aa52c6e8250211e8c205e96d653c8cc9032c44f", + "deprecated": false } }, "long_description": "VGhlIGh0dHAgWFNTIHByb2Jpbmcgc2NlbmFyaW8gYWltcyBhdCBkZXRlY3RpbmcsIHdpdGggdmVyeSBsaXR0bGUgZmFsc2UgcG9zaXRpdmUgY2hhbmNlcywgWFNTIHByb2JpbmcgYXR0ZW1wdHMuCgpYU1MgcHJvYmluZyBhdHRlbXB0cyB3aWxsIGJlIGNoYXJhY3Rlcml6ZWQgYnkgdGhlIHByZXNlbmNlIG9mIHNwZWNpZmljIFhTUyByZWxhdGVkIHBhdHRlcm5zIGluIHVyaS9HRVQgYXJndW1lbnRzIChpZiBhbmQgd2hlbiB0aGlzIGlzIHdoZXJlIHRoZSBpbmplY3RlZCBwYXJhbWV0ZXIgaXMpLCBhbmQgdGhpcyBpcyB3aGF0IHRoaXMgc2NlbmFyaW8gZGV0ZWN0cy4KCgpUaGUgW3dvcmQgbGlzdF0oaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2Nyb3dkc2VjdXJpdHkvc2VjLWxpc3RzL21hc3Rlci93ZWIveHNzX3Byb2JlX3BhdHRlcm5zLnR4dCkgaXMgcGlja2VkIHNwZWNpZmljYWxseSB0byBsaW1pdCBmYWxzZSBwb3NpdGl2ZXMuCkZ1cnRoZXJtb3JlLCBhIGBkaXN0aW5jdGAgZGlyZWN0aXZlIGlzIHByZXNlbnQgb24gdGhlIGdldCBwYXJhbWV0ZXJzIHRoZW1zZWx2ZXMgdG8gcmVkdWNlIGZhbHNlIHBvc2l0aXZlIGNoYW5jZXMuCgoKKipXQVJOSU5HKiogVGhpcyBzY2VuYXJpbyBpcyBfbm90XyBhIFdBRiwgYW5kIHRoaXMgc2NlbmFyaW8gZG9lcyBfbm90XyBhaW1zIGF0IHJlcGxhY2luZyBhIFdBRi4gQSBtb3RpdmF0ZWQgYXR0YWNrZXIgd2l0aCBrbm93bGVkZ2Ugb2YgY3Jvd2RzZWMgd2lsbCBiZSBhYmxlIHRvIGJ5cGFzcyBpdC4gSXQgaXMgbW9zdGx5IG1lYW50IHRvIGJlIGEgd2F5IHRvIGRldGVjdCBnZW5lcmljIFhTUyBwcm9iaW5nLgo=", - "content": "dHlwZTogbGVha3kKI3JlcXVpcmVzIGF0IGxlYXN0IDIuMCBiZWNhdXNlIGl0J3MgdXNpbmcgdGhlICdkYXRhJyBzZWN0aW9uIGFuZCB0aGUgJ1VwcGVyJyBleHByIGhlbHBlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L2h0dHAteHNzLXByb2JiaW5nCmRhdGE6CiAgLSBzb3VyY2VfdXJsOiBodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vY3Jvd2RzZWN1cml0eS9zZWMtbGlzdHMvbWFzdGVyL3dlYi94c3NfcHJvYmVfcGF0dGVybnMudHh0CiAgICBkZXN0X2ZpbGU6IHhzc19wcm9iZV9wYXR0ZXJucy50eHQKICAgIHR5cGU6IHN0cmluZwpkZXNjcmlwdGlvbjogIkEgc2NlbmFyaW8gdGhhdCBkZXRlY3RzIFhTUyBwcm9iaW5nIHdpdGggbWluaW1hbCBmYWxzZSBwb3NpdGl2ZXMiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlIGluIFsnaHR0cF9hY2Nlc3MtbG9nJywgJ2h0dHBfZXJyb3ItbG9nJ10gJiYgYW55KEZpbGUoJ3hzc19wcm9iZV9wYXR0ZXJucy50eHQnKSwge1VwcGVyKGV2dC5QYXJzZWQuaHR0cF9hcmdzKSBjb250YWlucyBVcHBlcigjKX0pIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAxcwpibGFja2hvbGU6IDVtCiNsb3cgZmFsc2UgcG9zaXRpdmVzIGFwcHJvYWNoIDogd2UgcmVxdWlyZSBkaXN0aW5jdCBwYXlsb2FkcyB0byBhdm9pZCBmYWxzZSBwb3NpdGl2ZXMKZGlzdGluY3Q6IGV2dC5QYXJzZWQuaHR0cF9hcmdzCmxhYmVsczoKICBzZXJ2aWNlOiBodHRwCiAgdHlwZTogeHNzX3Byb2JpbmcKICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKI3JlcXVpcmVzIGF0IGxlYXN0IDIuMCBiZWNhdXNlIGl0J3MgdXNpbmcgdGhlICdkYXRhJyBzZWN0aW9uIGFuZCB0aGUgJ1VwcGVyJyBleHByIGhlbHBlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L2h0dHAteHNzLXByb2JiaW5nCmRhdGE6CiAgLSBzb3VyY2VfdXJsOiBodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vY3Jvd2RzZWN1cml0eS9zZWMtbGlzdHMvbWFzdGVyL3dlYi94c3NfcHJvYmVfcGF0dGVybnMudHh0CiAgICBkZXN0X2ZpbGU6IHhzc19wcm9iZV9wYXR0ZXJucy50eHQKICAgIHR5cGU6IHN0cmluZwpkZXNjcmlwdGlvbjogIkEgc2NlbmFyaW8gdGhhdCBkZXRlY3RzIFhTUyBwcm9iaW5nIHdpdGggbWluaW1hbCBmYWxzZSBwb3NpdGl2ZXMiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlIGluIFsnaHR0cF9hY2Nlc3MtbG9nJywgJ2h0dHBfZXJyb3ItbG9nJ10gJiYgYW55KEZpbGUoJ3hzc19wcm9iZV9wYXR0ZXJucy50eHQnKSwge1VwcGVyKGV2dC5QYXJzZWQuaHR0cF9hcmdzKSBjb250YWlucyBVcHBlcigjKX0pIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAxcwpibGFja2hvbGU6IDVtCiNsb3cgZmFsc2UgcG9zaXRpdmVzIGFwcHJvYWNoIDogd2UgcmVxdWlyZSBkaXN0aW5jdCBwYXlsb2FkcyB0byBhdm9pZCBmYWxzZSBwb3NpdGl2ZXMKZGlzdGluY3Q6IGV2dC5QYXJzZWQuaHR0cF9hcmdzCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUuMDAyCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJYU1MgQXR0ZW1wdCIKICBzcG9vZmFibGU6IDAKICBzZXJ2aWNlOiBodHRwCiAgY29uZmlkZW5jZTogMwo=", "description": "A scenario that detects XSS probing with minimal false positives", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1595.002" + ], + "confidence": 3, + "label": "XSS Attempt", + "remediation": true, "service": "http", - "type": "xss_probing" + "spoofable": 0 } }, "crowdsecurity/iptables-scan-multi_ports": { "path": "scenarios/crowdsecurity/iptables-scan-multi_ports.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "85bd908ec6efae802035e4553f5dd41e4d5b6b53b2f237dd256533965bd44cd7", "deprecated": false + }, + "0.2": { + "digest": "af7ec1e0af8a778d80f6de3c8d28c15fdce53882e7cd5c8e3291e397b6ac4985", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBhIHBvcnQgc2NhbiA6IGRldGVjdHMgaWYgYSBzaW5nbGUgSVAgYXR0ZW1wdHMgY29ubmVjdGlvbiB0byBtYW55IGRpZmZlcmVudCBwb3J0cy4KCkxlYWtzcGVlZCBvZiA1cywgY2FwYWNpdHkgb2YgMTUuCg==", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9pcHRhYmxlcy1zY2FuLW11bHRpX3BvcnRzCmRlc2NyaXB0aW9uOiAiYmFuIElQcyB0aGF0IGFyZSBzY2FubmluZyB1cyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2lwdGFibGVzX2Ryb3AnICYmIGV2dC5NZXRhLnNlcnZpY2UgPT0gJ3RjcCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0LlBhcnNlZC5kc3RfcG9ydApjYXBhY2l0eTogMTUKbGVha3NwZWVkOiA1cwpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiB0Y3AKICB0eXBlOiBzY2FuCiAgcmVtZWRpYXRpb246IHRydWUKCg==", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9pcHRhYmxlcy1zY2FuLW11bHRpX3BvcnRzCmRlc2NyaXB0aW9uOiAiYmFuIElQcyB0aGF0IGFyZSBzY2FubmluZyB1cyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2lwdGFibGVzX2Ryb3AnICYmIGV2dC5NZXRhLnNlcnZpY2UgPT0gJ3RjcCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0LlBhcnNlZC5kc3RfcG9ydApjYXBhY2l0eTogMTUKbGVha3NwZWVkOiA1cwpibGFja2hvbGU6IDFtCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUuMDAxCiAgICAtIGF0dGFjay5UMTAxOAogICAgLSBhdHRhY2suVDEwNDYKICBiZWhhdmlvcjogInRjcDpzY2FuIgogIGxhYmVsOiAiVENQIFBvcnQgU2NhbiIKICBzcG9vZmFibGU6IDMKICBjb25maWRlbmNlOiAxCg==", "description": "ban IPs that are scanning us", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "tcp", - "type": "scan" + "behavior": "tcp:scan", + "classification": [ + "attack.T1595.001", + "attack.T1018", + "attack.T1046" + ], + "confidence": 1, + "label": "TCP Port Scan", + "remediation": true, + "spoofable": 3 } }, "crowdsecurity/jira_cve-2021-26086": { "path": "scenarios/crowdsecurity/jira_cve-2021-26086.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "1c3631aaa5818cb3af51e6ca6d4fe270eeb362d1ea0dd3fa19c735f3671253d5", "deprecated": false + }, + "0.2": { + "digest": "d5fef0d96708e47793854ac57ea135bed7801fc85c85f59b0e6ba95b93b3049b", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9qaXJhX2N2ZS0yMDIxLTI2MDg2CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEF0bGFzc2lhbiBKaXJhIENWRS0yMDIxLTI2MDg2IGV4cGxvaXRhdGlvbiBhdHRlbXBzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZCBhbnkoRmlsZSgiamlyYV9jdmVfMjAyMS0yNjA4Ni50eHQiKSwge1VwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgVXBwZXIoIyl9KQpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2Nyb3dkc2VjdXJpdHkvc2VjLWxpc3RzL21hc3Rlci93ZWIvamlyYV9jdmVfMjAyMS0yNjA4Ni50eHQKICAgIGRlc3RfZmlsZTogamlyYV9jdmVfMjAyMS0yNjA4Ni50eHQKICAgIHR5cGU6IHN0cmluZwpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCmxhYmVsczoKICB0eXBlOiBleHBsb2l0CiAgcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9qaXJhX2N2ZS0yMDIxLTI2MDg2CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEF0bGFzc2lhbiBKaXJhIENWRS0yMDIxLTI2MDg2IGV4cGxvaXRhdGlvbiBhdHRlbXBzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZCBhbnkoRmlsZSgiamlyYV9jdmVfMjAyMS0yNjA4Ni50eHQiKSwge1VwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgVXBwZXIoIyl9KQpkYXRhOgogIC0gc291cmNlX3VybDogaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2Nyb3dkc2VjdXJpdHkvc2VjLWxpc3RzL21hc3Rlci93ZWIvamlyYV9jdmVfMjAyMS0yNjA4Ni50eHQKICAgIGRlc3RfZmlsZTogamlyYV9jdmVfMjAyMS0yNjA4Ni50eHQKICAgIHR5cGU6IHN0cmluZwpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUuMDAxCiAgICAtIGF0dGFjay5UMTE5MAogICAgLSBjdmUuQ1ZFLTIwMjEtMjYwODYKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBsYWJlbDogIkppcmEgQ1ZFLTIwMjEtMjYwODYgZXhwbG9pdGF0aW9uIgogIHNwb29mYWJsZTogMAogIHNlcnZpY2U6IGppcmEKICBjb25maWRlbmNlOiAzCg==", "description": "Detect Atlassian Jira CVE-2021-26086 exploitation attemps", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595.001", + "attack.T1190", + "cve.CVE-2021-26086" + ], + "confidence": 3, + "label": "Jira CVE-2021-26086 exploitation", + "remediation": true, + "service": "jira", + "spoofable": 0 } }, "crowdsecurity/k8s-audit-anonymous-access": { "path": "scenarios/crowdsecurity/k8s-audit-anonymous-access.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "d554b9a458ed4edf24a67f1bdf13b32e2ddb43f7ff7b2675c706f0fa2b47ebf5", @@ -7417,21 +9052,31 @@ "0.3": { "digest": "2c3f6ef71eff02540727a872fa4f5cf7abd2271bb3bbd970b65de810b0894a71", "deprecated": false + }, + "0.4": { + "digest": "e5c03d518fc4133ed7a48a533a56cafb92aa6893e259f155f517963b239ab471", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBhbm9ueW1vdXMgYWNjZXNzIHRvIHRoZSBLOFMgQVBJLCB1c2luZyB0aGUgY2x1c3RlciBhdWRpdCBsb2dzLgoKT25seSBhdHRlbXB0cyBkb25lIG9uIHJlc291cmNlcyB0aGF0IGFyZSBsb2dnZWQgYXQgbGVhc3QgYXQgdGhlIGBNZXRhZGF0YWAgbGV2ZWwgd2lsbCBiZSByZWNvcmRlZC4KCkFjY2VzcyB0byBgaGVhbHRoemAsIGBsaXZlemAgYW5kIGByZWFkeXpgIGFyZSBpZ25vcmVkLgoKTm8gZGVjaXNpb24gd2lsbCBiZSB0YWtlbiBiYXNlZCBvbiB0aGlzIHNjZW5hcmlvLCBpdCBpcyBvbmx5IGludGVuZGVkIGZvciBub3RpZmljYXRpb24gcHVycG9zZXMuCg==", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2s4cy1hdWRpdC1hbm9ueW1vdXMtYWNjZXNzCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGFsbG93ZWQgYW5vbnltb3VzIGFjY2VzcyB0byB0aGUgSzhTIEFQSSIKZmlsdGVyOiB8CiAgIGV2dC5NZXRhLmxvZ190eXBlID09ICdrOHMtYXVkaXQnICYmCiAgICgKICAgIChldnQuTWV0YS5kYXRhc291cmNlX3R5cGUgPT0gIms4cy1hdWRpdCIgJiYgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5PYmplY3RSZWY/LlJlc291cmNlIG5vdCBpbiBbImhlYWx0aHoiLCAibGl2ZXoiLCAicmVhZHl6Il0pIAogICAgfHwgCiAgICAoZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlICE9ICJrOHMtYXVkaXQiICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQub2JqZWN0UmVmPy5yZXNvdXJjZSBub3QgaW4gWyJoZWFsdGh6IiwgImxpdmV6IiwgInJlYWR5eiJdKQogICApCiAgICYmIGV2dC5NZXRhLnVzZXIgaW4gWyJzeXN0ZW06YW5vbnltb3VzIiwgInN5c3RlbTp1bmF1dGhlbnRpY2F0ZWQiXQpsYWJlbHM6CiBzZXJ2aWNlOiBrOHMKIHR5cGU6IGFwaXNlcnZlci1hbm9ueW1vdXMtYWNjZXNzCiBub3RpZmljYXRpb246IHRydWU=", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2s4cy1hdWRpdC1hbm9ueW1vdXMtYWNjZXNzCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGFsbG93ZWQgYW5vbnltb3VzIGFjY2VzcyB0byB0aGUgSzhTIEFQSSIKZmlsdGVyOiB8CiAgIGV2dC5NZXRhLmxvZ190eXBlID09ICdrOHMtYXVkaXQnICYmCiAgICgKICAgIChldnQuTWV0YS5kYXRhc291cmNlX3R5cGUgPT0gIms4cy1hdWRpdCIgJiYgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5PYmplY3RSZWY/LlJlc291cmNlIG5vdCBpbiBbImhlYWx0aHoiLCAibGl2ZXoiLCAicmVhZHl6Il0pIAogICAgfHwgCiAgICAoZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlICE9ICJrOHMtYXVkaXQiICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQub2JqZWN0UmVmPy5yZXNvdXJjZSBub3QgaW4gWyJoZWFsdGh6IiwgImxpdmV6IiwgInJlYWR5eiJdKQogICApCiAgICYmIGV2dC5NZXRhLnVzZXIgaW4gWyJzeXN0ZW06YW5vbnltb3VzIiwgInN5c3RlbTp1bmF1dGhlbnRpY2F0ZWQiXQpsYWJlbHM6CiAgIG5vdGlmaWNhdGlvbjogdHJ1ZQogICBjbGFzc2lmaWNhdGlvbjoKICAgICAgLSBhdHRhY2suVDE1OTUKICAgYmVoYXZpb3I6ICJrOHM6c2NhbiIKICAgbGFiZWw6ICJLdWJlcm5ldGVzIEFQSSBhbm9ueW1vdXMgYWNjZXNzIgogICBzcG9vZmFibGU6IDAKICAgc2VydmljZTogazhzCiAgIGNvbmZpZGVuY2U6IDMK", "description": "Detect allowed anonymous access to the K8S API", "author": "crowdsecurity", "labels": { - "notification": "true", + "behavior": "k8s:scan", + "classification": [ + "attack.T1595" + ], + "confidence": 3, + "label": "Kubernetes API anonymous access", + "notification": true, "service": "k8s", - "type": "apiserver-anonymous-access" + "spoofable": 0 } }, "crowdsecurity/k8s-audit-api-server-bruteforce": { "path": "scenarios/crowdsecurity/k8s-audit-api-server-bruteforce.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "7ecb56f49b3fca372837c619a85b930b85905a318f9ab96a81a7b7f0e154720a", @@ -7444,21 +9089,31 @@ "0.3": { "digest": "c134ab48fbb7e97cf523733b3086da1bc08c1b020555e0ec1ccca4fff6adef04", "deprecated": false + }, + "0.4": { + "digest": "16f47cfcf58ab606ac40b384d8b8b0e26d937d27031e3247c700ecbedc06b7d0", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBicnV0ZWZvcmNlIGF0dGVtcHRzIGFnYWluc3QgdGhlIEs4UyBBUEkgc2VydmVyLgoKVGhpcyBzY2VuYXJpbyBuZWVkcyB0aGUgSzhTIGF1ZGl0IGxvZ3MgdG8gd29yay4=", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9rOHMtYXVkaXQtYXBpLXNlcnZlci1icnV0ZWZvcmNlCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGJydXRlZm9yY2UgYXR0ZW1wdHMgYWdhaW5zdCBLOFMgQVBJIHNlcnZlciIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2s4cy1hdWRpdCcgJiYgCiAgKAogICAoZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlID09ICJrOHMtYXVkaXQiICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQuUmVzcG9uc2VTdGF0dXMuY29kZSBpbiBbNDAxLCA0MDNdKQogICB8fAogICAoZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlICE9ICJrOHMtYXVkaXQiICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQucmVzcG9uc2VTdGF0dXMuY29kZSBpbiBbNDAxLCA0MDNdKQogICkKbGVha3NwZWVkOiAiMTBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogc2VydmljZTogazhzCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9rOHMtYXVkaXQtYXBpLXNlcnZlci1icnV0ZWZvcmNlCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGJydXRlZm9yY2UgYXR0ZW1wdHMgYWdhaW5zdCBLOFMgQVBJIHNlcnZlciIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2s4cy1hdWRpdCcgJiYgCiAgKAogICAoZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlID09ICJrOHMtYXVkaXQiICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQuUmVzcG9uc2VTdGF0dXMuY29kZSBpbiBbNDAxLCA0MDNdKQogICB8fAogICAoZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlICE9ICJrOHMtYXVkaXQiICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQucmVzcG9uc2VTdGF0dXMuY29kZSBpbiBbNDAxLCA0MDNdKQogICkKbGVha3NwZWVkOiAiMTBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHJlbWVkaWF0aW9uOiB0cnVlCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiazhzOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJLdWJlcm5ldGVzIEFQSSBCcnV0ZWZvcmNlIgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBzZXJ2aWNlOiBrOHMK", "description": "Detect bruteforce attempts against K8S API server", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "k8s:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Kubernetes API Bruteforce", + "remediation": true, "service": "k8s", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/k8s-audit-pod-exec": { "path": "scenarios/crowdsecurity/k8s-audit-pod-exec.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "da4d3286064bc873a090205cae1274e96eb9338794ecf7bebe5b7186d11d3907", @@ -7471,21 +9126,32 @@ "0.3": { "digest": "b5047e4cc82051818b47fdbbe3803c7fabdb91b91318e990692760c2034a61c6", "deprecated": false + }, + "0.4": { + "digest": "2c7bc8d2ff7d50616d7e29955a34ddd1fd05410b75965384f9c1698ef4eced9b", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBleGVjdXRpb24gKHZpYSBga3ViZWN0bCBleGVjYCkgaW4gcG9kcy4KClRoZSBzY2VuYXJpbyBuZWVkcyBsb2dzIGZyb20gdGhlIGBwb2RzYCByZXNvdXJjZXMgYXQgdGhlIGBNZXRhZGF0YWAgbGV2ZWwgYXQgYSBtaW5pbXVtLgoKTm8gZGVjaXNpb24gd2lsbCBiZSB0YWtlbiBiYXNlZCBvbiB0aGlzIHNjZW5hcmlvLCBpdCBpcyBvbmx5IGludGVuZGVkIGZvciBub3RpZmljYXRpb24gcHVycG9zZXMuCg==", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2s4cy1hdWRpdC1wb2QtZXhlYwpkZXNjcmlwdGlvbjogIkRldGVjdCBleGVjdXRpb24gKHZpYSBrdWJlY3RsIGV4ZWMpIGluIHBvZHMiCmZpbHRlcjogfAogIGV2dC5NZXRhLmxvZ190eXBlID09ICdrOHMtYXVkaXQnICYmCiAgKAogICAoZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlID09ICJrOHMtYXVkaXQiICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQuT2JqZWN0UmVmPy5SZXNvdXJjZSA9PSAncG9kcycgJiYgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5PYmplY3RSZWY/LlN1YnJlc291cmNlID09ICdleGVjJykKICAgfHwKICAgKGV2dC5NZXRhLmRhdGFzb3VyY2VfdHlwZSAhPSAiazhzLWF1ZGl0IiAmJiBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0Lm9iamVjdFJlZj8ucmVzb3VyY2UgPT0gJ3BvZHMnICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQub2JqZWN0UmVmPy5zdWJyZXNvdXJjZSA9PSAnZXhlYycpCiAgKQpsYWJlbHM6CiBzZXJ2aWNlOiBrOHMKIHR5cGU6IGV4ZWMtaW50by1wb2QKIG5vdGlmaWNhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2s4cy1hdWRpdC1wb2QtZXhlYwpkZXNjcmlwdGlvbjogIkRldGVjdCBleGVjdXRpb24gKHZpYSBrdWJlY3RsIGV4ZWMpIGluIHBvZHMiCmZpbHRlcjogfAogIGV2dC5NZXRhLmxvZ190eXBlID09ICdrOHMtYXVkaXQnICYmCiAgKAogICAoZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlID09ICJrOHMtYXVkaXQiICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQuT2JqZWN0UmVmPy5SZXNvdXJjZSA9PSAncG9kcycgJiYgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5PYmplY3RSZWY/LlN1YnJlc291cmNlID09ICdleGVjJykKICAgfHwKICAgKGV2dC5NZXRhLmRhdGFzb3VyY2VfdHlwZSAhPSAiazhzLWF1ZGl0IiAmJiBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0Lm9iamVjdFJlZj8ucmVzb3VyY2UgPT0gJ3BvZHMnICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQub2JqZWN0UmVmPy5zdWJyZXNvdXJjZSA9PSAnZXhlYycpCiAgKQpsYWJlbHM6CiAgbm90aWZpY2F0aW9uOiB0cnVlCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTYwOQogIGJlaGF2aW9yOiAiazhzOmF1ZGl0IgogIGxhYmVsOiAiS3ViZXJuZXRlcyBFeGVjIEludG8gUG9kIgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBjdGk6IGZhbHNlCiAgc2VydmljZTogazhzCg==", "description": "Detect execution (via kubectl exec) in pods", "author": "crowdsecurity", "labels": { - "notification": "true", + "behavior": "k8s:audit", + "classification": [ + "attack.T1609" + ], + "confidence": 3, + "cti": false, + "label": "Kubernetes Exec Into Pod", + "notification": true, "service": "k8s", - "type": "exec-into-pod" + "spoofable": 0 } }, "crowdsecurity/k8s-audit-pod-host-network": { "path": "scenarios/crowdsecurity/k8s-audit-pod-host-network.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "22c8869a8472b15bbdef04b4c9a0a30ee8479e909df4b7672515f009ea23b28c", @@ -7498,21 +9164,31 @@ "0.3": { "digest": "5162f7a8153ba082f0a67e14fa51cce45755a0d4a1d135cebd6af031609b8808", "deprecated": false + }, + "0.4": { + "digest": "23bf720e5426846200e199b9e21ff9825ee923d985079c1c7bb799275f3dd768", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBwb2RzIGNyZWF0ZWQgd2l0aCBob3N0IG5ldHdvcmtpbmcgaW4gYSBLOFMgY2x1c3RlciwgdXNpbmcgdGhlIGNsdXN0ZXIgYXVkaXQgbG9ncy4KClRoZSBzY2VuYXJpbyBuZWVkcyBsb2dzIGZyb20gdGhlIGBwb2RzYCByZXNvdXJjZXMgYXQgdGhlIGBSZXF1ZXN0YCBsZXZlbCBhdCBhIG1pbmltdW0uCgpObyBkZWNpc2lvbiB3aWxsIGJlIHRha2VuIGJhc2VkIG9uIHRoaXMgc2NlbmFyaW8sIGl0IGlzIG9ubHkgaW50ZW5kZWQgZm9yIG5vdGlmaWNhdGlvbiBwdXJwb3Nlcy4K", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2s4cy1hdWRpdC1wb2QtaG9zdC1uZXR3b3JrCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHBvZHMgc3RhcnRlZCB3aXRoIGhvc3QgbmV0d29ya2luZyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2s4cy1hdWRpdCcgJiYKICAoCiAgIChldnQuTWV0YS5kYXRhc291cmNlX3R5cGUgPT0gIms4cy1hdWRpdCIgJiYgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5WZXJiID09ICdjcmVhdGUnICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQuT2JqZWN0UmVmPy5SZXNvdXJjZSA9PSAncG9kcycgJiYgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5SZXF1ZXN0T2JqZWN0Py5zcGVjPy5ob3N0TmV0d29yayA9PSB0cnVlKQogICB8fAogICAoZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlICE9ICJrOHMtYXVkaXQiICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQudmVyYiA9PSAnY3JlYXRlJyAmJiBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0Lm9iamVjdFJlZj8ucmVzb3VyY2UgPT0gJ3BvZHMnICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQucmVxdWVzdE9iamVjdD8uc3BlYz8uaG9zdE5ldHdvcmsgPT0gdHJ1ZSkKICApCmxhYmVsczoKIHNlcnZpY2U6IGs4cwogdHlwZTogcG9kLWhvc3QtbmV0d29ya2luZwogbm90aWZpY2F0aW9uOiB0cnVl", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2s4cy1hdWRpdC1wb2QtaG9zdC1uZXR3b3JrCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHBvZHMgc3RhcnRlZCB3aXRoIGhvc3QgbmV0d29ya2luZyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2s4cy1hdWRpdCcgJiYKICAoCiAgIChldnQuTWV0YS5kYXRhc291cmNlX3R5cGUgPT0gIms4cy1hdWRpdCIgJiYgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5WZXJiID09ICdjcmVhdGUnICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQuT2JqZWN0UmVmPy5SZXNvdXJjZSA9PSAncG9kcycgJiYgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5SZXF1ZXN0T2JqZWN0Py5zcGVjPy5ob3N0TmV0d29yayA9PSB0cnVlKQogICB8fAogICAoZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlICE9ICJrOHMtYXVkaXQiICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQudmVyYiA9PSAnY3JlYXRlJyAmJiBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0Lm9iamVjdFJlZj8ucmVzb3VyY2UgPT0gJ3BvZHMnICYmIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQucmVxdWVzdE9iamVjdD8uc3BlYz8uaG9zdE5ldHdvcmsgPT0gdHJ1ZSkKICApCmxhYmVsczoKICBub3RpZmljYXRpb246IHRydWUKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNjEwCiAgYmVoYXZpb3I6ICJrOHM6YXVkaXQiCiAgbGFiZWw6ICJLdWJlcm5ldGVzIFBvZCBTdGFydCBXaXRoIEhvc3QgTmV0d29ya2luZyIKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgc2VydmljZTogazhzCg==", "description": "Detect pods started with host networking", "author": "crowdsecurity", "labels": { - "notification": "true", + "behavior": "k8s:audit", + "classification": [ + "attack.T1610" + ], + "confidence": 3, + "label": "Kubernetes Pod Start With Host Networking", + "notification": true, "service": "k8s", - "type": "pod-host-networking" + "spoofable": 0 } }, "crowdsecurity/k8s-audit-pod-host-path-volume": { "path": "scenarios/crowdsecurity/k8s-audit-pod-host-path-volume.yaml", - "version": "0.4", + "version": "0.5", "versions": { "0.1": { "digest": "a2cfbc902f353f46fa5d7a38565e2aebdf0c74ffc3ee1dc285331b93ad1989ef", @@ -7529,21 +9205,31 @@ "0.4": { "digest": "28bcdb0dc2e8303e445dadb0e1ea57a41bde1d7a57b98d9b70491b7af1d6f67e", "deprecated": false + }, + "0.5": { + "digest": "063db67636d42747f4c305984612ceccc9c427c278223d83c05bcf310f6416d8", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBwb2RzIGNyZWF0aW9uIG1vdW50aW5nIGEgc2Vuc2l0aXZlIGhvc3QgZm9sZGVyIGluIGEgSzhTIGNsdXN0ZXIsIHVzaW5nIHRoZSBjbHVzdGVyIGF1ZGl0IGxvZ3MuCgpGb2xkZXJzIG9yIGZpbGVzIGNvbnNpZGVyZWQgc2Vuc2l0aXZlIGFyZToKIC0gYC9gCiAtIGAvZXRjYAogLSBgL2V0Yy9rdWJlcm5ldGVzYAogLSBgL2V0Yy9rdWJlcm5ldGVzL21hbmlmZXN0c2AKIC0gYC9wcm9jYAogLSBgL3Jvb3RgCiAtIGAvaG9tZS9hZG1pbmAKIC0gYC92YXIvbGliL2t1YmVsZXRgCiAtIGAvdmFyL2xpYi9rdWJlbGV0L3BraWAKIC0gYC92YXIvcnVuL2RvY2tlci5zb2NrYCAKIC0gYC92YXIvcnVuL2NyaW8vY3Jpby5zb2NrYAoKVGhlIHNjZW5hcmlvIG5lZWRzIGxvZ3MgZnJvbSB0aGUgYHBvZHNgIHJlc291cmNlcyBhdCB0aGUgYFJlcXVlc3RgIGxldmVsIGF0IGEgbWluaW11bS4KCk5vIGRlY2lzaW9uIHdpbGwgYmUgdGFrZW4gYmFzZWQgb24gdGhpcyBzY2VuYXJpbywgaXQgaXMgb25seSBpbnRlbmRlZCBmb3Igbm90aWZpY2F0aW9uIHB1cnBvc2VzLgo=", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2s4cy1hdWRpdC1wb2QtaG9zdC1wYXRoLXZvbHVtZQpkZXNjcmlwdGlvbjogIkRldGVjdCBwb2RzIG1vdW50aW5nIGEgc2Vuc2l0aXZlIGhvc3QgZm9sZGVyIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnazhzLWF1ZGl0JyAmJgogICgKICAgKAogICAgZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlID09ICJrOHMtYXVkaXQiICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0Lk9iamVjdFJlZj8uUmVzb3VyY2UgPT0gJ3BvZHMnICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LlJlcXVlc3RPYmplY3QgIT0gbmlsICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LlJlcXVlc3RPYmplY3Quc3BlYyAhPSBuaWwgJiYKICAgIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQuUmVxdWVzdE9iamVjdC5zcGVjLnZvbHVtZXMgIT0gbmlsICYmCiAgICBhbnkoZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5SZXF1ZXN0T2JqZWN0LnNwZWMudm9sdW1lcywgeyAuaG9zdFBhdGggIT0gbmlsICYmIC5ob3N0UGF0aC5wYXRoIGluIFsiL3Byb2MiLCAiL3Zhci9ydW4vZG9ja2VyLnNvY2siLCAiLyIsICIvZXRjIiwgIi9yb290IiwgIi92YXIvcnVuL2NyaW8vY3Jpby5zb2NrIiwgIi9ob21lL2FkbWluIiwgIi92YXIvbGliL2t1YmVsZXQiLCAiL3Zhci9saWIva3ViZWxldC9wa2kiLCAiL2V0Yy9rdWJlcm5ldGVzIiwgIi9ldGMva3ViZXJuZXRlcy9tYW5pZmVzdHMiXSB9KQogICApCiAgIHx8CiAgICgKICAgIGV2dC5NZXRhLmRhdGFzb3VyY2VfdHlwZSAhPSAiazhzLWF1ZGl0IiAmJgogICAgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5vYmplY3RSZWY/LnJlc291cmNlID09ICdwb2RzJyAmJgogICAgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5yZXF1ZXN0T2JqZWN0ICE9IG5pbCAmJgogICAgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5yZXF1ZXN0T2JqZWN0LnNwZWMgIT0gbmlsICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LnJlcXVlc3RPYmplY3Quc3BlYy52b2x1bWVzICE9IG5pbCAmJgogICAgYW55KGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQucmVxdWVzdE9iamVjdC5zcGVjLnZvbHVtZXMsIHsgLmhvc3RQYXRoICE9IG5pbCAmJiAuaG9zdFBhdGgucGF0aCBpbiBbIi9wcm9jIiwgIi92YXIvcnVuL2RvY2tlci5zb2NrIiwgIi8iLCAiL2V0YyIsICIvcm9vdCIsICIvdmFyL3J1bi9jcmlvL2NyaW8uc29jayIsICIvaG9tZS9hZG1pbiIsICIvdmFyL2xpYi9rdWJlbGV0IiwgIi92YXIvbGliL2t1YmVsZXQvcGtpIiwgIi9ldGMva3ViZXJuZXRlcyIsICIvZXRjL2t1YmVybmV0ZXMvbWFuaWZlc3RzIl0gfSkKICAgKQogICkKbGFiZWxzOgogIHNlcnZpY2U6IGs4cwogIHR5cGU6IHBvZC1ob3N0LXBhdGgKICBub3RpZmljYXRpb246IHRydWU=", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2s4cy1hdWRpdC1wb2QtaG9zdC1wYXRoLXZvbHVtZQpkZXNjcmlwdGlvbjogIkRldGVjdCBwb2RzIG1vdW50aW5nIGEgc2Vuc2l0aXZlIGhvc3QgZm9sZGVyIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnazhzLWF1ZGl0JyAmJgogICgKICAgKAogICAgZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlID09ICJrOHMtYXVkaXQiICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0Lk9iamVjdFJlZj8uUmVzb3VyY2UgPT0gJ3BvZHMnICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LlJlcXVlc3RPYmplY3QgIT0gbmlsICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LlJlcXVlc3RPYmplY3Quc3BlYyAhPSBuaWwgJiYKICAgIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQuUmVxdWVzdE9iamVjdC5zcGVjLnZvbHVtZXMgIT0gbmlsICYmCiAgICBhbnkoZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5SZXF1ZXN0T2JqZWN0LnNwZWMudm9sdW1lcywgeyAuaG9zdFBhdGggIT0gbmlsICYmIC5ob3N0UGF0aC5wYXRoIGluIFsiL3Byb2MiLCAiL3Zhci9ydW4vZG9ja2VyLnNvY2siLCAiLyIsICIvZXRjIiwgIi9yb290IiwgIi92YXIvcnVuL2NyaW8vY3Jpby5zb2NrIiwgIi9ob21lL2FkbWluIiwgIi92YXIvbGliL2t1YmVsZXQiLCAiL3Zhci9saWIva3ViZWxldC9wa2kiLCAiL2V0Yy9rdWJlcm5ldGVzIiwgIi9ldGMva3ViZXJuZXRlcy9tYW5pZmVzdHMiXSB9KQogICApCiAgIHx8CiAgICgKICAgIGV2dC5NZXRhLmRhdGFzb3VyY2VfdHlwZSAhPSAiazhzLWF1ZGl0IiAmJgogICAgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5vYmplY3RSZWY/LnJlc291cmNlID09ICdwb2RzJyAmJgogICAgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5yZXF1ZXN0T2JqZWN0ICE9IG5pbCAmJgogICAgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5yZXF1ZXN0T2JqZWN0LnNwZWMgIT0gbmlsICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LnJlcXVlc3RPYmplY3Quc3BlYy52b2x1bWVzICE9IG5pbCAmJgogICAgYW55KGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQucmVxdWVzdE9iamVjdC5zcGVjLnZvbHVtZXMsIHsgLmhvc3RQYXRoICE9IG5pbCAmJiAuaG9zdFBhdGgucGF0aCBpbiBbIi9wcm9jIiwgIi92YXIvcnVuL2RvY2tlci5zb2NrIiwgIi8iLCAiL2V0YyIsICIvcm9vdCIsICIvdmFyL3J1bi9jcmlvL2NyaW8uc29jayIsICIvaG9tZS9hZG1pbiIsICIvdmFyL2xpYi9rdWJlbGV0IiwgIi92YXIvbGliL2t1YmVsZXQvcGtpIiwgIi9ldGMva3ViZXJuZXRlcyIsICIvZXRjL2t1YmVybmV0ZXMvbWFuaWZlc3RzIl0gfSkKICAgKQogICkKbGFiZWxzOgogIG5vdGlmaWNhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE2MTAKICBiZWhhdmlvcjogIms4czphdWRpdCIKICBsYWJlbDogIkt1YmVybmV0ZXMgUG9kIFN0YXJ0IFdpdGggSG9zdCBQYXRoIgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBzZXJ2aWNlOiBrOHMK", "description": "Detect pods mounting a sensitive host folder", "author": "crowdsecurity", "labels": { - "notification": "true", + "behavior": "k8s:audit", + "classification": [ + "attack.T1610" + ], + "confidence": 3, + "label": "Kubernetes Pod Start With Host Path", + "notification": true, "service": "k8s", - "type": "pod-host-path" + "spoofable": 0 } }, "crowdsecurity/k8s-audit-privileged-pod-creation": { "path": "scenarios/crowdsecurity/k8s-audit-privileged-pod-creation.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "ba074de3c2dc77cb50b5bdf84bcc764750cd9166b279c4ac5f1e15ab01eb4308", @@ -7556,21 +9242,31 @@ "0.3": { "digest": "8350fe7aeff51b0167aaba17591008942bdeeb6c8183765bd110a657d0e27f24", "deprecated": false + }, + "0.4": { + "digest": "becd28f2a57949a529076a5800edca5cb54c4e4adb457ba43d9232659df3845b", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBwcml2aWxlZ2VkIHBvZHMgY3JlYXRpb24gaW4gYSBLOFMgY2x1c3RlciwgdXNpbmcgdGhlIGNsdXN0ZXIgYXVkaXQgbG9ncy4KClRoZSBzY2VuYXJpbyBuZWVkcyBsb2dzIGZyb20gdGhlIGBwb2RzYCByZXNvdXJjZXMgYXQgdGhlIGBSZXF1ZXN0YCBsZXZlbCBhdCBhIG1pbmltdW0uCgpObyBkZWNpc2lvbiB3aWxsIGJlIHRha2VuIGJhc2VkIG9uIHRoaXMgc2NlbmFyaW8sIGl0IGlzIG9ubHkgaW50ZW5kZWQgZm9yIG5vdGlmaWNhdGlvbiBwdXJwb3Nlcy4K", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2s4cy1hdWRpdC1wcml2aWxlZ2VkLXBvZC1jcmVhdGlvbgpkZXNjcmlwdGlvbjogIkRldGVjdCBwcml2aWxlZ2VkIHBvZCBjcmVhdGlvbiIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2s4cy1hdWRpdCcgJiYKICAoCiAgICgKICAgIGV2dC5NZXRhLmRhdGFzb3VyY2VfdHlwZSA9PSAiazhzLWF1ZGl0IiAmJgogICAgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5WZXJiID09ICdjcmVhdGUnICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0Lk9iamVjdFJlZj8uUmVzb3VyY2UgPT0gJ3BvZHMnICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LlJlcXVlc3RPYmplY3QgIT0gbmlsICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LlJlcXVlc3RPYmplY3Quc3BlYyAhPSBuaWwgJiYKICAgIGFueShldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LlJlcXVlc3RPYmplY3Quc3BlYy5jb250YWluZXJzLCB7IC5zZWN1cml0eUNvbnRleHQgIT0gbmlsICYmIC5zZWN1cml0eUNvbnRleHQucHJpdmlsZWdlZCA9PSB0cnVlIH0pCiAgICkKICAgfHwKICAgKAogICAgZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlICE9ICJrOHMtYXVkaXQiICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LnZlcmIgPT0gJ2NyZWF0ZScgJiYKICAgIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQub2JqZWN0UmVmPy5yZXNvdXJjZSA9PSAncG9kcycgJiYKICAgIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQucmVxdWVzdE9iamVjdCAhPSBuaWwgJiYKICAgIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQucmVxdWVzdE9iamVjdC5zcGVjICE9IG5pbCAmJgogICAgYW55KGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQucmVxdWVzdE9iamVjdC5zcGVjLmNvbnRhaW5lcnMsIHsgLnNlY3VyaXR5Q29udGV4dCAhPSBuaWwgJiYgLnNlY3VyaXR5Q29udGV4dC5wcml2aWxlZ2VkID09IHRydWUgfSkKICAgKQogICkKbGFiZWxzOgogc2VydmljZTogazhzCiB0eXBlOiBwcml2aWxlZ2VkLXBvZAogbm90aWZpY2F0aW9uOiB0cnVl", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2s4cy1hdWRpdC1wcml2aWxlZ2VkLXBvZC1jcmVhdGlvbgpkZXNjcmlwdGlvbjogIkRldGVjdCBwcml2aWxlZ2VkIHBvZCBjcmVhdGlvbiIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2s4cy1hdWRpdCcgJiYKICAoCiAgICgKICAgIGV2dC5NZXRhLmRhdGFzb3VyY2VfdHlwZSA9PSAiazhzLWF1ZGl0IiAmJgogICAgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5WZXJiID09ICdjcmVhdGUnICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0Lk9iamVjdFJlZj8uUmVzb3VyY2UgPT0gJ3BvZHMnICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LlJlcXVlc3RPYmplY3QgIT0gbmlsICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LlJlcXVlc3RPYmplY3Quc3BlYyAhPSBuaWwgJiYKICAgIGFueShldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LlJlcXVlc3RPYmplY3Quc3BlYy5jb250YWluZXJzLCB7IC5zZWN1cml0eUNvbnRleHQgIT0gbmlsICYmIC5zZWN1cml0eUNvbnRleHQucHJpdmlsZWdlZCA9PSB0cnVlIH0pCiAgICkKICAgfHwKICAgKAogICAgZXZ0Lk1ldGEuZGF0YXNvdXJjZV90eXBlICE9ICJrOHMtYXVkaXQiICYmCiAgICBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LnZlcmIgPT0gJ2NyZWF0ZScgJiYKICAgIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQub2JqZWN0UmVmPy5yZXNvdXJjZSA9PSAncG9kcycgJiYKICAgIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQucmVxdWVzdE9iamVjdCAhPSBuaWwgJiYKICAgIGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQucmVxdWVzdE9iamVjdC5zcGVjICE9IG5pbCAmJgogICAgYW55KGV2dC5Vbm1hcnNoYWxlZC5rOHNfYXVkaXQucmVxdWVzdE9iamVjdC5zcGVjLmNvbnRhaW5lcnMsIHsgLnNlY3VyaXR5Q29udGV4dCAhPSBuaWwgJiYgLnNlY3VyaXR5Q29udGV4dC5wcml2aWxlZ2VkID09IHRydWUgfSkKICAgKQogICkKbGFiZWxzOgogIG5vdGlmaWNhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE2MTAKICBiZWhhdmlvcjogIms4czphdWRpdCIKICBsYWJlbDogIkt1YmVybmV0ZXMgUHJpdmlsZWdlZCBQb2QgQ3JlYXRpb24iCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIHNlcnZpY2U6IGs4cwo=", "description": "Detect privileged pod creation", "author": "crowdsecurity", "labels": { - "notification": "true", + "behavior": "k8s:audit", + "classification": [ + "attack.T1610" + ], + "confidence": 3, + "label": "Kubernetes Privileged Pod Creation", + "notification": true, "service": "k8s", - "type": "privileged-pod" + "spoofable": 0 } }, "crowdsecurity/k8s-audit-service-account-access-denied": { "path": "scenarios/crowdsecurity/k8s-audit-service-account-access-denied.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "b43903791497159fe0dbe5da4aa53275ec41d92eecf6b77318e5f75ae2bf8770", @@ -7583,78 +9279,119 @@ "0.3": { "digest": "f60ca3ffd290bc64f66c86eb5325b3fe418b884230b38ece451ee5d0dad919f3", "deprecated": false + }, + "0.4": { + "digest": "e9532021eea1cb008a0307455aba3d42e537ac043bbcb8583f1dd2e563820fdb", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBzZXJ2aWNlIGFjY291bnRzIG1ha2luZyBmb3JiaWRkZW4gcmVxdWVzdHMgdG8gdGhlIEs4UyBBUEkuCgpPbmx5IGF0dGVtcHRzIGRvbmUgb24gcmVzb3VyY2VzIHRoYXQgYXJlIGxvZ2dlZCBhdCBsZWFzdCBhdCB0aGUgYE1ldGFkYXRhYCBsZXZlbCB3aWxsIGJlIHJlY29yZGVkLgoKTm8gZGVjaXNpb24gd2lsbCBiZSB0YWtlbiBiYXNlZCBvbiB0aGlzIHNjZW5hcmlvLCBpdCBpcyBvbmx5IGludGVuZGVkIGZvciBub3RpZmljYXRpb24gcHVycG9zZXMuCg==", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2s4cy1hdWRpdC1zZXJ2aWNlLWFjY291bnQtYWNjZXNzLWRlbmllZApkZXNjcmlwdGlvbjogIkRldGVjdCB1bmF1dGhvcml6ZWQgcmVxdWVzdHMgZnJvbSBzZXJ2aWNlIGFjY291bnRzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnazhzLWF1ZGl0JyAmJgogIGV2dC5NZXRhLnVzZXIgc3RhcnRzV2l0aCAic3lzdGVtOnNlcnZpY2VhY2NvdW50OiIgJiYKICAoCiAgIChldnQuTWV0YS5kYXRhc291cmNlX3R5cGUgPT0gIms4cy1hdWRpdCIgJiYgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5Bbm5vdGF0aW9uc1siYXV0aG9yaXphdGlvbi5rOHMuaW8vZGVjaXNpb24iXSA9PSAiZm9yYmlkIikKICAgfHwKICAgKGV2dC5NZXRhLmRhdGFzb3VyY2VfdHlwZSAhPSAiazhzLWF1ZGl0IiAmJiBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LmFubm90YXRpb25zWyJhdXRob3JpemF0aW9uLms4cy5pby9kZWNpc2lvbiJdID09ICJmb3JiaWQiKQogICkKbGFiZWxzOgogc2VydmljZTogazhzCiB0eXBlOiBzZXJ2aWNlLWFjY291bnQtZm9yYmlkZGVuLXJlcXVlc3QKIG5vdGlmaWNhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L2s4cy1hdWRpdC1zZXJ2aWNlLWFjY291bnQtYWNjZXNzLWRlbmllZApkZXNjcmlwdGlvbjogIkRldGVjdCB1bmF1dGhvcml6ZWQgcmVxdWVzdHMgZnJvbSBzZXJ2aWNlIGFjY291bnRzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSA9PSAnazhzLWF1ZGl0JyAmJgogIGV2dC5NZXRhLnVzZXIgc3RhcnRzV2l0aCAic3lzdGVtOnNlcnZpY2VhY2NvdW50OiIgJiYKICAoCiAgIChldnQuTWV0YS5kYXRhc291cmNlX3R5cGUgPT0gIms4cy1hdWRpdCIgJiYgZXZ0LlVubWFyc2hhbGVkLms4c19hdWRpdC5Bbm5vdGF0aW9uc1siYXV0aG9yaXphdGlvbi5rOHMuaW8vZGVjaXNpb24iXSA9PSAiZm9yYmlkIikKICAgfHwKICAgKGV2dC5NZXRhLmRhdGFzb3VyY2VfdHlwZSAhPSAiazhzLWF1ZGl0IiAmJiBldnQuVW5tYXJzaGFsZWQuazhzX2F1ZGl0LmFubm90YXRpb25zWyJhdXRob3JpemF0aW9uLms4cy5pby9kZWNpc2lvbiJdID09ICJmb3JiaWQiKQogICkKbGFiZWxzOgogIG5vdGlmaWNhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDEwNzgKICAgIC0gYXR0YWNrLlQxMDY5CiAgYmVoYXZpb3I6ICJrOHM6c2NhbiIKICBsYWJlbDogIkt1YmVybmV0ZXMgU2VydmljZSBBY2NvdW50IERlbmllZCBSZXF1ZXN0IgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBzZXJ2aWNlOiBrOHMK", "description": "Detect unauthorized requests from service accounts", "author": "crowdsecurity", "labels": { - "notification": "true", + "behavior": "k8s:scan", + "classification": [ + "attack.T1078", + "attack.T1069" + ], + "confidence": 3, + "label": "Kubernetes Service Account Denied Request", + "notification": true, "service": "k8s", - "type": "service-account-forbidden-request" + "spoofable": 0 } }, "crowdsecurity/kasm-bruteforce": { "path": "scenarios/crowdsecurity/kasm-bruteforce.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "5f4464d3102dc48cb57695252d7352ab305c6f5fd50aa1e275de28030315fa63", "deprecated": false + }, + "0.2": { + "digest": "11ae6e8e7e60c5efcfe523ea4ea357168d29e5024b28d1e0396e1e7a37cf9223", + "deprecated": false } }, "long_description": "RGV0ZWN0IEtBU00gbG9naW4gYnJ1dGVmb3JjZSA1IGF0dGVtcHRzIHdpdGggbGVha3NwZWVkIG9mIDEwIHNlY29uZHM=", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9rYXNtLWJydXRlZm9yY2UKZGVzY3JpcHRpb246ICJEZXRlY3Qga2FzbSBsb2dpbiBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5tZXRyaWNfbmFtZSBpbiBbJ2FjY291bnQubG9naW4uZmFpbGVkX2ludmFsaWRfdXNlcicsICdhY2NvdW50LmxvZ2luLmZhaWxlZF9pbnZhbGlkX3Bhc3N3b3JkJ10iCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDMKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKIHNlcnZpY2U6IGthc20KIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVl", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9rYXNtLWJydXRlZm9yY2UKZGVzY3JpcHRpb246ICJEZXRlY3Qga2FzbSBsb2dpbiBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5tZXRyaWNfbmFtZSBpbiBbJ2FjY291bnQubG9naW4uZmFpbGVkX2ludmFsaWRfdXNlcicsICdhY2NvdW50LmxvZ2luLmZhaWxlZF9pbnZhbGlkX3Bhc3N3b3JkJ10iCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDMKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImdlbmVyaWM6YnJ1dGVmb3JjZSIKICBsYWJlbDogIktBU00gQnJ1dGVmb3JjZSIKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgc2VydmljZToga2FzbQo=", "description": "Detect kasm login bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "generic:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "KASM Bruteforce", + "remediation": true, "service": "kasm", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/litespeed-admin-bf": { "path": "scenarios/crowdsecurity/litespeed-admin-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "cf7a11ef6d75de569bdd3e0d62a805a7793102e57911a1a6256327da64aed692", "deprecated": false + }, + "0.2": { + "digest": "456850e8d43f06d882e59991f0721d28f6c80220df0b80c17306e735587f1f36", + "deprecated": false } }, "long_description": "QWxlcnQgd2hlbiBhIHNpbmdsZSBJUCB0aGF0IHRyeSB0byBicnV0ZWZvcmNlIGxpdGVzcGVlZCBhZG1pbiBVSS4KCkxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDUuCg==", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9saXRlc3BlZWQtYWRtaW4tYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgYnJ1dGVmb3JjZSBhZ2FpbnN0IGxpdGVzcGVlZCBhZG1pbiBVSSIKZmlsdGVyOiAiZXZ0Lk1ldGEuc2VydmljZSA9PSAnaHR0cCcgJiYgZXZ0Lk1ldGEuc3ViX3R5cGUgPT0gJ2xpdGVzcGVlZF9hZG1pbl9hdXRoX2ZhaWwnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAiMTBzIgpibGFja2hvbGU6IDFtCmxhYmVsczoKIHNlcnZpY2U6IGh0dHAKIHR5cGU6IGJmCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9saXRlc3BlZWQtYWRtaW4tYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgYnJ1dGVmb3JjZSBhZ2FpbnN0IGxpdGVzcGVlZCBhZG1pbiBVSSIKZmlsdGVyOiAiZXZ0Lk1ldGEuc2VydmljZSA9PSAnaHR0cCcgJiYgZXZ0Lk1ldGEuc3ViX3R5cGUgPT0gJ2xpdGVzcGVlZF9hZG1pbl9hdXRoX2ZhaWwnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAiMTBzIgpibGFja2hvbGU6IDFtCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIkxpdGVTcGVlZCBBZG1pbiBCcnV0ZWZvcmNlIgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBzZXJ2aWNlOiBsaXRlc3BlZWQK", "description": "Detect bruteforce against litespeed admin UI", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "http", - "type": "bf" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "LiteSpeed Admin Bruteforce", + "remediation": true, + "service": "litespeed", + "spoofable": 0 } }, "crowdsecurity/mariadb-bf": { "path": "scenarios/crowdsecurity/mariadb-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "c6daa770b5ac5f153e6b5bc0c2eb8e50f90373e1802bea40724ebe6037a15ab4", "deprecated": false + }, + "0.2": { + "digest": "09b4708abcf47bc810fd74d8c8d1395bc5dbb732184a8231c4dda4b587da2575", + "deprecated": false } }, "long_description": "RGV0ZWN0IHNldmVyYWwgZmFpbGVkIG1hcmlhZGIgYXV0aGVudGljYXRpb25zLgoKbGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgNQo=", - "content": "IyBtYXJpYWRiIGJydXRlZm9yY2UKdHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvbWFyaWFkYi1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBtYXJpYWRiIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21hcmlhZGJfZmFpbGVkX2F1dGgnCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KbGFiZWxzOgogc2VydmljZTogbWFyaWFkYgogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUK", + "content": "IyBtYXJpYWRiIGJydXRlZm9yY2UKdHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvbWFyaWFkYi1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBtYXJpYWRiIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21hcmlhZGJfZmFpbGVkX2F1dGgnCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KbGFiZWxzOgogIHJlbWVkaWF0aW9uOiB0cnVlCiAgc2VydmljZTogbWFyaWFkYgogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImRhdGFiYXNlOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJNYXJpYURCIEJydXRlZm9yY2UiCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwo=", "description": "Detect mariadb bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "database:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "MariaDB Bruteforce", + "remediation": true, "service": "mariadb", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/modsecurity": { "path": "scenarios/crowdsecurity/modsecurity.yaml", - "version": "0.4", + "version": "0.5", "versions": { "0.1": { "digest": "447c63986f53a743d08fc16677d7f5427ed4b7efca6a0d73c47991d83582e0d0", @@ -7671,78 +9408,118 @@ "0.4": { "digest": "2e2f2591a614514acf033702c5588335136050925f88f36fb9da0bc129f30039", "deprecated": false + }, + "0.5": { + "digest": "23c32d105550893e7facd768035f57e7413c1802f52bf93b6540b5d01746a560", + "deprecated": false } }, "long_description": "VGFrZSBhIHJlbWVkaWF0aW9uIGFnYWluc3QgYW4gSVAgdGhhdCB0cmlnZ2VyIGEgbW9kc2VjdXJpdHkgcnVsZSB3aXRoIGEgYENSSVRJQ0FMYCBzZXZlcml0eS4K", - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9tb2RzZWN1cml0eQpkZXNjcmlwdGlvbjogIldlYiBleHBsb2l0YXRpb24gdmlhIG1vZHNlY3VyaXR5IgojbW9kc2VjIGZvciBuZ2lueCBvbmx5IGxvZ3MgdGhlIG51bWVyaWNhbCB2YWx1ZSBvZiB0aGUgc2V2ZXJpdHkKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnbW9kc2VjdXJpdHknICYmIChldnQuUGFyc2VkLnJ1bGVzZXZlcml0eSA9PSAnQ1JJVElDQUwnIHx8IGV2dC5QYXJzZWQucnVsZXNldmVyaXR5ID09ICcyJykKYmxhY2tob2xlOiAybQpsYWJlbHM6CiAgdHlwZTogd2ViX2F0dGFjawogIHNlcnZpY2U6IGh0dHAKICByZW1lZGlhdGlvbjogdHJ1ZQogIHNjb3BlOiBpcAo=", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS9tb2RzZWN1cml0eQpkZXNjcmlwdGlvbjogIldlYiBleHBsb2l0YXRpb24gdmlhIG1vZHNlY3VyaXR5IgojbW9kc2VjIGZvciBuZ2lueCBvbmx5IGxvZ3MgdGhlIG51bWVyaWNhbCB2YWx1ZSBvZiB0aGUgc2V2ZXJpdHkKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnbW9kc2VjdXJpdHknICYmIChldnQuUGFyc2VkLnJ1bGVzZXZlcml0eSA9PSAnQ1JJVElDQUwnIHx8IGV2dC5QYXJzZWQucnVsZXNldmVyaXR5ID09ICcyJykKYmxhY2tob2xlOiAybQpsYWJlbHM6CiAgcmVtZWRpYXRpb246IHRydWUKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1CiAgICAtIGF0dGFjay5UMTE5MAogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiTW9kc2VjdXJpdHkgQWxlcnQiCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMgogIHNlcnZpY2U6IGh0dHAK", "description": "Web exploitation via modsecurity", "author": "crowdsecurity", "labels": { - "remediation": "true", - "scope": "ip", + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 2, + "label": "Modsecurity Alert", + "remediation": true, "service": "http", - "type": "web_attack" + "spoofable": 0 } }, "crowdsecurity/mssql-bf": { "path": "scenarios/crowdsecurity/mssql-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "be8f99681f224e5176015815d11bf01b0e0012ceb24bbb264786f503d9146d81", "deprecated": false + }, + "0.2": { + "digest": "ac0fc68fb2064422e0743f1e9a0f10c13d8881a2298b6152899f2b84d293b148", + "deprecated": false } }, - "content": "IyBteXNxbCBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L21zc3FsLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG1zc3FsIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21zc3FsX2ZhaWxlZF9hdXRoJwpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IG1zc3FsCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyBteXNxbCBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L21zc3FsLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG1zc3FsIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21zc3FsX2ZhaWxlZF9hdXRoJwpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImRhdGFiYXNlOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJNU1NRTCBCcnV0ZWZvcmNlIgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBzZXJ2aWNlOiBtc3NxbAo=", "description": "Detect mssql bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "database:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "MSSQL Bruteforce", + "remediation": true, "service": "mssql", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/mysql-bf": { "path": "scenarios/crowdsecurity/mysql-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "3783ff9de7b6d19697ee121314b20b21b8c765b279a9caacc70d3c75f4ebd455", "deprecated": false + }, + "0.2": { + "digest": "0e32a1c1d87086a9a0d51208025a61f4c7f1833e50c95959a4c8a1fff86bff5a", + "deprecated": false } }, "long_description": "RGV0ZWN0IHNldmVyYWwgZmFpbGVkIG15c3FsIGF1dGhlbnRpY2F0aW9ucy4KCmxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDUK", - "content": "IyBteXNxbCBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L215c3FsLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG15c3FsIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ215c3FsX2ZhaWxlZF9hdXRoJwpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IG15c3FsCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyBteXNxbCBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L215c3FsLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG15c3FsIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ215c3FsX2ZhaWxlZF9hdXRoJwpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJkYXRhYmFzZTpicnV0ZWZvcmNlIgogIGxhYmVsOiAiTXlTUUwgQnJ1dGVmb3JjZSIKICBzZXJ2aWNlOiBteXNxbAo=", "description": "Detect mysql bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "database:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "MySQL Bruteforce", + "remediation": true, "service": "mysql", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/naxsi-exploit-vpatch": { "path": "scenarios/crowdsecurity/naxsi-exploit-vpatch.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "908ceeb2d7f5607a114a872847df34662e4c80ed07338a55f125a56985f0d095", "deprecated": false + }, + "0.2": { + "digest": "5899c88353cdb50f0be57a818488ead9e320b4e81260acd610186c855b1d6716", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBuYXhzaSBibG9ja2VkIHJlcXVlc3RzIG9uIGN1c3RvbSAoPjk5OTkpIHJ1bGVzLgoKVHJpZ2dlcnMgb24gZmlyc3QgcmVxdWVzdC4K", - "content": "IyBuYXhzaSB2cGF0Y2ggcnVsZXMgZGV0ZWN0aW9uCnR5cGU6IHRyaWdnZXIKbmFtZTogY3Jvd2RzZWN1cml0eS9uYXhzaS1leHBsb2l0LXZwYXRjaAojIGlkIGlzIGJpZ2dlciB0aGFuIDlrLCBjdXN0b20gcnVsZQpkZXNjcmlwdGlvbjogIkRldGVjdCBjdXN0b20gYmxhY2tsaXN0IHRyaWdnZXJlZCBpbiBuYXhzaSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3dhZl9uYXhzaS1sb2cnICYmIGxlbihldnQuUGFyc2VkLm5heHNpX2lkKSA+IDQiCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogNW0KbGFiZWxzOgogc2VydmljZTogaHR0cAogdHlwZTogc2NhbgogcmVtZWRpYXRpb246IHRydWUK", + "content": "IyBuYXhzaSB2cGF0Y2ggcnVsZXMgZGV0ZWN0aW9uCnR5cGU6IHRyaWdnZXIKbmFtZTogY3Jvd2RzZWN1cml0eS9uYXhzaS1leHBsb2l0LXZwYXRjaAojIGlkIGlzIGJpZ2dlciB0aGFuIDlrLCBjdXN0b20gcnVsZQpkZXNjcmlwdGlvbjogIkRldGVjdCBjdXN0b20gYmxhY2tsaXN0IHRyaWdnZXJlZCBpbiBuYXhzaSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3dhZl9uYXhzaS1sb2cnICYmIGxlbihldnQuUGFyc2VkLm5heHNpX2lkKSA+IDQiCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogNW0KbGFiZWxzOgogIHJlbWVkaWF0aW9uOiB0cnVlCiAgY29uZmlkZW5jZTogMgogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgc2VydmljZTogaHR0cAo=", "description": "Detect custom blacklist triggered in naxsi", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 2, + "remediation": true, "service": "http", - "type": "scan" + "spoofable": 0 } }, "crowdsecurity/netgear_rce": { "path": "scenarios/crowdsecurity/netgear_rce.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "da6b213c4c31c81a22e52b573428cd78a76cb9c00f810d0835f7831f8f80eb5d", @@ -7751,23 +9528,35 @@ "0.2": { "digest": "14411baac71dcd8fa5be5c9973f36b8c6f880865e1a3004674007a0bec64212d", "deprecated": false + }, + "0.3": { + "digest": "4b88489256201cb7341ffc5e9cefba6f3a695b8275096d32d409052e7c4d33ab", + "deprecated": false } }, "long_description": "IyMgTmV0Z2VhciBER04xMDAwIC8gREdOMjIwMCBSZW1vdGUgQ29tbWFuZCBFeGVjdXRpb24KCkRldGVjdHMgYXR0ZW1wdHMgb2YgZXhwbG9pdCBvZiBOZXRnZWFyIERHTjEwMDAgLyBER04yMjAwIFJlbW90ZSBDb21tYW5kIEV4ZWN1dGlvbi4KCgpSZWZlcmVuY2U6IGh0dHBzOi8vd3d3LmV4cGxvaXQtZGIuY29tL2V4cGxvaXRzLzI1OTc4Cg==", - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L25ldGdlYXJfcmNlCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IE5ldGdlYXIgUkNFIERHTjEwMDAvREdOMjIwIGV4cGxvaXRhdGlvbiBhdHRlbXB0cyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWydodHRwX2FjY2Vzcy1sb2cnLCAnaHR0cF9lcnJvci1sb2cnXSAmJiBMb3dlcihRdWVyeVVuZXNjYXBlKGV2dC5NZXRhLmh0dHBfcGF0aCkpIHN0YXJ0c1dpdGggTG93ZXIoJy9zZXR1cC5jZ2k/bmV4dF9maWxlPW5ldGdlYXIuY2ZnJnRvZG89c3lzY21kJmNtZD0nKQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCnJlZmVyZW5jZXM6IAogIC0gImh0dHBzOi8vd3d3LmV4cGxvaXQtZGIuY29tL2V4cGxvaXRzLzI1OTc4IgpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L25ldGdlYXJfcmNlCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IE5ldGdlYXIgUkNFIERHTjEwMDAvREdOMjIwIGV4cGxvaXRhdGlvbiBhdHRlbXB0cyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWydodHRwX2FjY2Vzcy1sb2cnLCAnaHR0cF9lcnJvci1sb2cnXSAmJiBMb3dlcihRdWVyeVVuZXNjYXBlKGV2dC5NZXRhLmh0dHBfcGF0aCkpIHN0YXJ0c1dpdGggTG93ZXIoJy9zZXR1cC5jZ2k/bmV4dF9maWxlPW5ldGdlYXIuY2ZnJnRvZG89c3lzY21kJmNtZD0nKQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCnJlZmVyZW5jZXM6CiAgLSAiaHR0cHM6Ly93d3cuZXhwbG9pdC1kYi5jb20vZXhwbG9pdHMvMjU5NzgiCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU5NQogICAgLSBhdHRhY2suVDExOTAKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBsYWJlbDogIk5ldGdlYXIgUkNFIgogIHNlcnZpY2U6IG5ldGdlYXIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect Netgear RCE DGN1000/DGN220 exploitation attempts", "author": "crowdsecurity", "references": [ "https://www.exploit-db.com/exploits/25978" ], "labels": { - "remediation": "true", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 3, + "label": "Netgear RCE", + "remediation": true, + "service": "netgear", + "spoofable": 0 } }, "crowdsecurity/nextcloud-bf": { "path": "scenarios/crowdsecurity/nextcloud-bf.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "4a6b24a95d286e48aec8eb59fa5fc17686a724be3c7860df538a7eafdb613f97", @@ -7776,73 +9565,117 @@ "0.2": { "digest": "6ba276c92b2d1a9b43bff6afa09f09c1d1b7fccb9b87d649eedba803689914d8", "deprecated": false + }, + "0.3": { + "digest": "75b4f296618a383fd240413fd51bae1be786872d4f1b46421c8871d43c15d128", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBicnV0ZWZvcmNlIG9uIFtOZXh0Y2xvdWRdKGh0dHBzOi8vbmV4dGNsb3VkLmNvbSkgaW5zdGFuY2UuCgogLSBsZWFrc3BlZWQgb2YgMW0sIGNhcGFjaXR5IG9mIDUgb24gc2FtZSB0YXJnZXQgdXNlcgogLSBsZWFrc3BlZWQgb2YgMW0sIGNhcGFjaXR5IG9mIDUgdW5pcXVlIGRpc3RpbmN0IHVzZXJzCiAtIGxlYWtzcGVlZCBvZiAxbSwgY2FwYWNpdHkgb2YgNSBvbiB0cnVzdCBkb21haW4gZXJyb3IK", - "content": "LS0tCnR5cGU6IGxlYWt5Cm5hbWU6IGNyb3dkc2VjdXJpdHkvbmV4dGNsb3VkLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IE5leHRjbG91ZCBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ25leHRjbG91ZF9mYWlsZWRfYXV0aCcsICduZXh0Y2xvdWRfYnJ1dGVmb3JjZV9hdHRlbXB0J10iCmxlYWtzcGVlZDogIjFtIgpjYXBhY2l0eTogNQojIGlmIHdlIGhhdmUgYnJ1dGVmb3JjZSBwcm90ZWN0aW9uIGVuYWJsZWQgaW4gbmV4dGNsb3VkLCB0aGUgc2FtZSBsb2dpbiBhdHRlbXB0CiMgY2FuIGxvZyAjIGJvdGggbG9naW4gZmFpbHVyZSBhbmQgYnJ1dGVmb3JjZSBhdHRlbXB0IGF0IHRoZSBzYW1lIHRpbWUsIHNvCiMga2VlcCB0aGVtIGluIHNlcGVyYXRlIGJ1Y2tldHMKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwICsgJy0tJyArIGV2dC5NZXRhLmxvZ190eXBlCmJsYWNraG9sZTogNW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBuZXh0Y2xvdWQKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCnR5cGU6IGxlYWt5Cm5hbWU6IGNyb3dkc2VjdXJpdHkvbmV4dGNsb3VkLWJmX3VzZXJfZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBOZXh0Y2xvdWQgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICduZXh0Y2xvdWRfZmFpbGVkX2F1dGgnIgpsZWFrc3BlZWQ6ICIxbSIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS50YXJnZXRfdXNlcgpibGFja2hvbGU6IDVtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgc2VydmljZTogbmV4dGNsb3VkCiAgdHlwZTogYnJ1dGVmb3JjZQogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L25leHRjbG91ZC1iZl9kb21haW5fZXJyb3IKZGVzY3JpcHRpb246ICJEZXRlY3QgTmV4dGNsb3VkIGRvbWFpbiBlcnJvciIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ25leHRjbG91ZF9kb21haW5fZXJyb3InIgpsZWFrc3BlZWQ6ICIxbSIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBuZXh0Y2xvdWQKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWUK", + "content": "LS0tCnR5cGU6IGxlYWt5Cm5hbWU6IGNyb3dkc2VjdXJpdHkvbmV4dGNsb3VkLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IE5leHRjbG91ZCBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ25leHRjbG91ZF9mYWlsZWRfYXV0aCcsICduZXh0Y2xvdWRfYnJ1dGVmb3JjZV9hdHRlbXB0J10iCmxlYWtzcGVlZDogIjFtIgpjYXBhY2l0eTogNQojIGlmIHdlIGhhdmUgYnJ1dGVmb3JjZSBwcm90ZWN0aW9uIGVuYWJsZWQgaW4gbmV4dGNsb3VkLCB0aGUgc2FtZSBsb2dpbiBhdHRlbXB0CiMgY2FuIGxvZyAjIGJvdGggbG9naW4gZmFpbHVyZSBhbmQgYnJ1dGVmb3JjZSBhdHRlbXB0IGF0IHRoZSBzYW1lIHRpbWUsIHNvCiMga2VlcCB0aGVtIGluIHNlcGVyYXRlIGJ1Y2tldHMKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwICsgJy0tJyArIGV2dC5NZXRhLmxvZ190eXBlCmJsYWNraG9sZTogNW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJOZXh0Q2xvdWQgQnJ1dGVmb3JjZSIKICBzZXJ2aWNlOiBuZXh0Y2xvdWQKLS0tCnR5cGU6IGxlYWt5Cm5hbWU6IGNyb3dkc2VjdXJpdHkvbmV4dGNsb3VkLWJmX3VzZXJfZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBOZXh0Y2xvdWQgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICduZXh0Y2xvdWRfZmFpbGVkX2F1dGgnIgpsZWFrc3BlZWQ6ICIxbSIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS50YXJnZXRfdXNlcgpibGFja2hvbGU6IDVtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgcmVtZWRpYXRpb246IHRydWUKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiTmV4dENsb3VkIEJydXRlZm9yY2UiCiAgc2VydmljZTogbmV4dGNsb3VkCi0tLQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L25leHRjbG91ZC1iZl9kb21haW5fZXJyb3IKZGVzY3JpcHRpb246ICJEZXRlY3QgTmV4dGNsb3VkIGRvbWFpbiBlcnJvciIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ25leHRjbG91ZF9kb21haW5fZXJyb3InIgpsZWFrc3BlZWQ6ICIxbSIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJOZXh0Q2xvdWQgQnJ1dGVmb3JjZSIKICBzZXJ2aWNlOiBuZXh0Y2xvdWQK", "description": "Detect Nextcloud bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "NextCloud Bruteforce", + "remediation": true, "service": "nextcloud", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/nginx-req-limit-exceeded": { "path": "scenarios/crowdsecurity/nginx-req-limit-exceeded.yaml", - "version": "0.1", + "version": "0.3", "versions": { "0.1": { "digest": "7e6fa2b7386d763b570025b3144c8790f68463f7c5739d8f527c9f80f15c15ce", "deprecated": false + }, + "0.2": { + "digest": "f064319bf72d0df012495cd33acc005ca934314519adc06d8175c8cfa84c2e18", + "deprecated": false + }, + "0.3": { + "digest": "d135e5fe0f486f5f5223006c53324b51b5b1130c4d71fcf51f75e13b8575cc03", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBJUHMgd2hpY2ggdmlvbGF0ZSBuZ2lueCdzIHVzZXIgc2V0IHJlcXVlc3QgbGltaXQuCgpJUCBpcyBiYW5uZWQgaWYgaXQgdmlvbGF0ZXMgbmdpbngncyB1c2VyIHNldCByZXF1ZXN0IGxpbWl0IG1vcmUgdGhhbiA1IHRpbWVzIGluIGEgbWludXRlLg==", - "content": "dHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvbmdpbngtcmVxLWxpbWl0LWV4Y2VlZGVkCmRlc2NyaXB0aW9uOiAiRGV0ZWN0cyBJUHMgd2hpY2ggdmlvbGF0ZSBuZ2lueCdzIHVzZXIgc2V0IHJlcXVlc3QgbGltaXQuIgpmaWx0ZXI6IGV2dC5NZXRhLnN1Yl90eXBlID09ICdyZXFfbGltaXRfZXhjZWVkZWQnCmxlYWtzcGVlZDogIjYwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KbGFiZWxzOgogc2VydmljZTogbmdpbngKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvbmdpbngtcmVxLWxpbWl0LWV4Y2VlZGVkCmRlc2NyaXB0aW9uOiAiRGV0ZWN0cyBJUHMgd2hpY2ggdmlvbGF0ZSBuZ2lueCdzIHVzZXIgc2V0IHJlcXVlc3QgbGltaXQuIgpmaWx0ZXI6IGV2dC5NZXRhLnN1Yl90eXBlID09ICdyZXFfbGltaXRfZXhjZWVkZWQnCmxlYWtzcGVlZDogIjYwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KbGFiZWxzOgogIHJlbWVkaWF0aW9uOiB0cnVlCiAgY29uZmlkZW5jZTogMgogIHNwb29mYWJsZTogMgogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE0OTgKICBiZWhhdmlvcjogImh0dHA6ZG9zIgogIGxhYmVsOiAiTmdpbnggcmVxdWVzdCBsaW1pdCBleGNlZWRlZCIKICBzZXJ2aWNlOiBodHRwCg==", "description": "Detects IPs which violate nginx's user set request limit.", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "nginx", - "type": "bruteforce" + "behavior": "http:dos", + "classification": [ + "attack.T1498" + ], + "confidence": 2, + "label": "Nginx request limit exceeded", + "remediation": true, + "service": "http", + "spoofable": 2 } }, "crowdsecurity/odoo-bf_user-enum": { "path": "scenarios/crowdsecurity/odoo-bf_user-enum.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "ece8333dbfb283c4b696c2963ede3636175306d65151a26bbb2ecdcd19455e53", "deprecated": false + }, + "0.2": { + "digest": "292468af8f31901e3aeaa6db5609c90be59f6b6c5dd5af9c40a22c74f1053913", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBvZG9vIGF1dGhlbnRpY2F0aW9ucyBhbmQgdXNlciBlbnVtOgoKIC0gbGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgNSBmcm9tIHNhbWUgSVAKIC0gbGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgNSBvbiBzYW1lIHRhcmdldCB1c2Vy", - "content": "IyBPZG9vIHdlYiBhdXRoIGJydXRlZm9yY2UKdHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvb2Rvby1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBicnV0ZWZvcmNlIG9uIG9kb28gd2ViIGludGVyZmFjZSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb2Rvb19mYWlsZWRfYXV0aCcKbGVha3NwZWVkOiAiMTBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvZG9vCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBPZG9vIHdlYiBhdXRoIHVzZXJfZW51bQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L29kb29fdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG9kb28gdXNlciBlbnVtIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdvZG9vX2ZhaWxlZF9hdXRoJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXIKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiBzZXJ2aWNlOiBvZG9vCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "IyBPZG9vIHdlYiBhdXRoIGJydXRlZm9yY2UKdHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvb2Rvby1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBicnV0ZWZvcmNlIG9uIG9kb28gd2ViIGludGVyZmFjZSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb2Rvb19mYWlsZWRfYXV0aCcKbGVha3NwZWVkOiAiMTBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgcmVtZWRpYXRpb246IHRydWUKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiT2RvbyBCcnV0ZWZvcmNlIgogIHNlcnZpY2U6IG9kb28KLS0tCiMgT2RvbyB3ZWIgYXV0aCB1c2VyX2VudW0KdHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9vZG9vX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBvZG9vIHVzZXIgZW51bSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb2Rvb19mYWlsZWRfYXV0aCcKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VyCmxlYWtzcGVlZDogMTBzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHJlbWVkaWF0aW9uOiB0cnVlCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIk9kb28gQnJ1dGVmb3JjZSIKICBzZXJ2aWNlOiBvZG9vCg==", "description": "Detect bruteforce on odoo web interface", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Odoo Bruteforce", + "remediation": true, "service": "odoo", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/opnsense-gui-bf": { "path": "scenarios/crowdsecurity/opnsense-gui-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "15f0d4f03f1e18a8cd5d95467a13e86ebfd717354f53ba02b4d165e6537965bf", "deprecated": false + }, + "0.2": { + "digest": "c1031635c18c69203a1e251d25da8f309182ed04221142e94e3a2ff1d8533af3", + "deprecated": false } }, "long_description": "IyMgT1BOU2Vuc2Ugd2ViIHBvcnRhbCBicnV0ZWZvcmNlIGRldGVjdGlvbgoKRGV0ZWN0cyBicnV0ZWZvcmNlIGF0dGVtcHRzIG9uIHRoZSBPUE5TZW5zZSB3ZWIgcG9ydGFsIDoKIC0gbW9yZSB0aGFuIDUgYXR0ZW1wdHMKIC0gMTAgc2Vjb25kcyBiZXR3ZWVuIGVhY2gKCgo=", - "content": "IyBvcG5zZW5zZSB3ZWIgYXV0aCBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L29wbnNlbnNlLXdlYi1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBicnV0ZWZvcmNlIG9uIG9wbnNlbnNlIHdlYiBpbnRlcmZhY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wbnNlbnNlLWd1aS1mYWlsZWQtYXV0aCcKbGVha3NwZWVkOiAiMTBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcG5zZW5zZS1ndWktYXV0aAogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUK", + "content": "IyBvcG5zZW5zZSB3ZWIgYXV0aCBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L29wbnNlbnNlLXdlYi1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBicnV0ZWZvcmNlIG9uIG9wbnNlbnNlIHdlYiBpbnRlcmZhY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wbnNlbnNlLWd1aS1mYWlsZWQtYXV0aCcKbGVha3NwZWVkOiAiMTBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgcmVtZWRpYXRpb246IHRydWUKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiT3Buc2Vuc2UgR1VJIEJydXRlZm9yY2UiCiAgc2VydmljZTogb3Buc2Vuc2UK", "description": "Detect bruteforce on opnsense web interface", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "opnsense-gui-auth", - "type": "bruteforce" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Opnsense GUI Bruteforce", + "remediation": true, + "service": "opnsense", + "spoofable": 0 } }, "crowdsecurity/palo-alto-threat": { @@ -7859,50 +9692,71 @@ "description": "Detect palo alto threat with a severity higher or equal to medium", "author": "crowdsecurity", "labels": { - "remediation": "true" + "remediation": true } }, "crowdsecurity/pgsql-bf": { "path": "scenarios/crowdsecurity/pgsql-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "d2b7d3aa914ba9204f320e15301207c0fb5ea54aae57481bcbcd410cd81629bd", "deprecated": false + }, + "0.2": { + "digest": "133fed2f8b3d0479817fcc3e0991a872ef5199adb73f5530220d10bccc6c0df0", + "deprecated": false } }, "long_description": "RGV0ZWN0IHNldmVyYWwgZmFpbGVkIHBvc3RncmVzcWwgYXV0aGVudGljYXRpb25zLgoKbGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgNQo=", - "content": "IyBwZ3NxbCBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L3Bnc3FsLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFBnU1FMIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3Bnc3FsX2ZhaWxlZF9hdXRoJwpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IHBnc3FsCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyBwZ3NxbCBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBjcm93ZHNlY3VyaXR5L3Bnc3FsLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFBnU1FMIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3Bnc3FsX2ZhaWxlZF9hdXRoJwpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IHBnc3FsCiByZW1lZGlhdGlvbjogdHJ1ZQogY29uZmlkZW5jZTogMwogc3Bvb2ZhYmxlOiAwCiBjbGFzc2lmaWNhdGlvbjoKICAtIGF0dGFjay5UMTExMAogYmVoYXZpb3I6ICJkYXRhYmFzZTpicnV0ZWZvcmNlIgogbGFiZWw6ICJQb3N0Z3JlcyBCcnV0ZWZvcmNlIgo=", "description": "Detect PgSQL bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "database:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Postgres Bruteforce", + "remediation": true, "service": "pgsql", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/pgsql-user-enum": { "path": "scenarios/crowdsecurity/pgsql-user-enum.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "b9947e219aed3c267b0fa8ca4805d840a3ebf5ee1f0bf978cebb0f711e21336d", "deprecated": false + }, + "0.2": { + "digest": "d85a0ac7af5f8d9b0e3678ff8f48c8524ce0a8a5f86ac94961d989afc2ee912a", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBhdHRlbXB0cyB0byBlbnVtZXJhdGUgcG9zdGdyZXNxbCB1c2VycwoKbGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgNQoK", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9wZ3NxbC11c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgcG9zdGdyZXNxbCB1c2VyIGVudW1lcmF0aW9uIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdwZ3NxbF9mYWlsZWRfYXV0aCcKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VyCmxlYWtzcGVlZDogMTBzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IHBnc3FsCiAgdHlwZTogYnJ1dGVmb3JjZQogIHJlbWVkaWF0aW9uOiB0cnVl", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9wZ3NxbC11c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgcG9zdGdyZXNxbCB1c2VyIGVudW1lcmF0aW9uIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdwZ3NxbF9mYWlsZWRfYXV0aCcKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VyCmxlYWtzcGVlZDogMTBzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogc2VydmljZTogcGdzcWwKIHJlbWVkaWF0aW9uOiB0cnVlCiBjb25maWRlbmNlOiAzCiBzcG9vZmFibGU6IDAKIGNsYXNzaWZpY2F0aW9uOgogIC0gYXR0YWNrLlQxMTEwCiAgLSBhdHRhY2suVDE1ODkKIGJlaGF2aW9yOiAiZGF0YWJhc2U6YnJ1dGVmb3JjZSIKIGxhYmVsOiAiUG9zdGdyZXMgQnJ1dGVmb3JjZSI=", "description": "Detect postgresql user enumeration", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "database:bruteforce", + "classification": [ + "attack.T1110", + "attack.T1589" + ], + "confidence": 3, + "label": "Postgres Bruteforce", + "remediation": true, "service": "pgsql", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/postfix-spam": { "path": "scenarios/crowdsecurity/postfix-spam.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "03876677d3fe37bdc9ad584cb015e3f0b648266450b2b494a40e1863d5a64d8a", @@ -7911,61 +9765,89 @@ "0.2": { "digest": "b36d95dc5ba9cb45c8cbb1a3d37bd19d929ed387f3d7ec386b4e9e041d0bbd8e", "deprecated": false + }, + "0.3": { + "digest": "a423cda10b76d41849ee9cb120f8a9c6aeb90afbd63fc9251966704a4878197f", + "deprecated": false } }, "long_description": "Q29udGFpbnMgbXVsdGlwbGUgc2NlbmFyaW9zOgoKLSBjcm93ZHNlY3VyaXR5L3Bvc3RmaXgtc3BhbTogcG9zdGZpeCBzY2VuYXJpbyBicnV0ZWZvcmNlIHNwYW0gYXR0ZW1wdCAobGVha3NwZWVkIG9mIDEwcyB3aXRoIGEgY2FwYWNpdHkgb2YgNSkKLSBjcm93ZHNlY3VyaXR5L3Bvc3RzY3JlZW4tcmJsOiBwb3N0c2NyZWVuIHJiIGF0dGVtcHQgYmxhY2tsaXN0IChjYXBhY2l0eSBvZiAwKQoK", - "content": "IyBwb3N0Zml4IHNwYW0KdHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9wb3N0Zml4LXNwYW0KZGVzY3JpcHRpb246ICJEZXRlY3Qgc3BhbW1lcnMiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlX2VuaCA9PSAnc3BhbS1hdHRlbXB0JyB8fCBldnQuTWV0YS5sb2dfdHlwZSA9PSAncG9zdGZpeCcgJiYgZXZ0Lk1ldGEuYWN0aW9uID09ICdyZWplY3QnIgpsZWFrc3BlZWQ6ICIxMHMiCnJlZmVyZW5jZXM6CiAgLSBodHRwczovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9TcGFtbWluZwpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IGZhbHNlCmxhYmVsczoKIHNlcnZpY2U6IHBvc3RmaXgKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIHBvc3RmaXggc3BhbQp0eXBlOiB0cmlnZ2VyCm5hbWU6IGNyb3dkc2VjdXJpdHkvcG9zdHNjcmVlbi1yYmwKZGVzY3JpcHRpb246ICJEZXRlY3Qgc3BhbW1lcnMiCmZpbHRlcjogImV2dC5NZXRhLnNlcnZpY2UgPT0gJ3Bvc3RzY3JlZW4nICYmIGV2dC5NZXRhLnByZWdyZWV0ID09ICdQUkVHUkVFVCciCmxlYWtzcGVlZDogIjEwcyIKcmVmZXJlbmNlczoKICAtIGh0dHBzOi8vZW4ud2lraXBlZGlhLm9yZy93aWtpL1NwYW1taW5nCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogZmFsc2UKbGFiZWxzOgogc2VydmljZTogcG9zdHNjcmVlbgogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUKCg==", + "content": "IyBwb3N0Zml4IHNwYW0KdHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9wb3N0Zml4LXNwYW0KZGVzY3JpcHRpb246ICJEZXRlY3Qgc3BhbW1lcnMiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlX2VuaCA9PSAnc3BhbS1hdHRlbXB0JyB8fCBldnQuTWV0YS5sb2dfdHlwZSA9PSAncG9zdGZpeCcgJiYgZXZ0Lk1ldGEuYWN0aW9uID09ICdyZWplY3QnIgpsZWFrc3BlZWQ6ICIxMHMiCnJlZmVyZW5jZXM6CiAgLSBodHRwczovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9TcGFtbWluZwpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IGZhbHNlCmxhYmVsczoKICBzZXJ2aWNlOiBwb3N0Zml4CiAgcmVtZWRpYXRpb246IHRydWUKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgYmVoYXZpb3I6ICJzbXRwOnNwYW0iCiAgbGFiZWw6ICJQb3N0Zml4IHNwYW0iCi0tLQojIHBvc3RmaXggc3BhbQp0eXBlOiB0cmlnZ2VyCm5hbWU6IGNyb3dkc2VjdXJpdHkvcG9zdHNjcmVlbi1yYmwKZGVzY3JpcHRpb246ICJEZXRlY3Qgc3BhbW1lcnMiCmZpbHRlcjogImV2dC5NZXRhLnNlcnZpY2UgPT0gJ3Bvc3RzY3JlZW4nICYmIGV2dC5NZXRhLnByZWdyZWV0ID09ICdQUkVHUkVFVCciCnJlZmVyZW5jZXM6CiAgLSBodHRwczovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9TcGFtbWluZwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IGZhbHNlCmxhYmVsczoKICBzZXJ2aWNlOiBwb3N0c2NyZWVuCiAgcmVtZWRpYXRpb246IHRydWUKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgYmVoYXZpb3I6ICJzbXRwOnNwYW0iCiAgbGFiZWw6ICJQb3N0Zml4IHNwYW0iCg==", "description": "Detect spammers", "author": "crowdsecurity", "references": [ "https://en.wikipedia.org/wiki/Spamming" ], "labels": { - "remediation": "true", + "behavior": "smtp:spam", + "confidence": 3, + "label": "Postfix spam", + "remediation": true, "service": "postfix", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/proftpd-bf": { "path": "scenarios/crowdsecurity/proftpd-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "f241fba9f1ffeb3cdf376bb7cfee0ecf804ba5d8709cfb5defbc973a11c751a5", "deprecated": false + }, + "0.2": { + "digest": "a77e311aad794a2f70e838e1b3b4017448af74511e9acc6b154052294fa87b38", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBwcm9mdHBkIGF1dGhlbnRpY2F0aW9ucyA6CgogLSBsZWFrc3BlZWQgb2YgMTBzLCBjYXBhY2l0eSBvZiA1IG9uIHNhbWUgdGFyZ2V0IHVzZXI=", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9wcm9mdHBkLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHByb2Z0cGQgYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2Z0cF9mYWlsZWRfYXV0aCciCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKIHNlcnZpY2U6IGZ0cAogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUKCg==", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9wcm9mdHBkLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHByb2Z0cGQgYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2Z0cF9mYWlsZWRfYXV0aCciCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKIHNlcnZpY2U6IHByb2Z0cGQKIHJlbWVkaWF0aW9uOiB0cnVlCiBjb25maWRlbmNlOiAzCiBzcG9vZmFibGU6IDAKIGNsYXNzaWZpY2F0aW9uOgogIC0gYXR0YWNrLlQxMTEwCiBiZWhhdmlvcjogImZ0cDpicnV0ZWZvcmNlIgogbGFiZWw6ICJQcm9mdHBkIEJydXRlZm9yY2UiCg==", "description": "Detect proftpd bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "ftp", - "type": "bruteforce" + "behavior": "ftp:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Proftpd Bruteforce", + "remediation": true, + "service": "proftpd", + "spoofable": 0 } }, "crowdsecurity/proftpd-bf_user-enum": { "path": "scenarios/crowdsecurity/proftpd-bf_user-enum.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "7e3b3f8d050805afce54785fe1e9eba40a6a040faf9e19e8ba40d466c3b14814", "deprecated": false + }, + "0.2": { + "digest": "79eb461691ff5555246915d3fdc668239ce988ea02e8b2ce62cf34d80bfdb3d6", + "deprecated": false } }, - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9wcm9mdHBkLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBwcm9mdHBkIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdmdHBfZmFpbGVkX2F1dGgnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudGFyZ2V0X3VzZXIKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiBzZXJ2aWNlOiBmdHAKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVl", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9wcm9mdHBkLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBwcm9mdHBkIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdmdHBfZmFpbGVkX2F1dGgnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudGFyZ2V0X3VzZXIKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiBzZXJ2aWNlOiBwcm9mdHBkCiByZW1lZGlhdGlvbjogdHJ1ZQogY29uZmlkZW5jZTogMwogc3Bvb2ZhYmxlOiAwCiBjbGFzc2lmaWNhdGlvbjoKICAtIGF0dGFjay5UMTExMAogIC0gYXR0YWNrLlQxMTkwCiBiZWhhdmlvcjogImZ0cDpicnV0ZWZvcmNlIgogbGFiZWw6ICJQcm9mdHBkIEJydXRlZm9yY2UiCg==", "description": "Detect proftpd user enum bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "ftp", - "type": "bruteforce" + "behavior": "ftp:bruteforce", + "classification": [ + "attack.T1110", + "attack.T1190" + ], + "confidence": 3, + "label": "Proftpd Bruteforce", + "remediation": true, + "service": "proftpd", + "spoofable": 0 } }, "crowdsecurity/pulse-secure-sslvpn-cve-2019-11510": { "path": "scenarios/crowdsecurity/pulse-secure-sslvpn-cve-2019-11510.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "bab1d5aa6ee0f6677d73c70438324006f4ed0780de90891a8586030319dc1d08", @@ -7974,38 +9856,60 @@ "0.2": { "digest": "9226dd76fd3e818b3a6d4a1770437e1a41a2014e082cde2a788244b50fb83889", "deprecated": false + }, + "0.3": { + "digest": "7807f49e188dc01411c027897f4b608fb5b58d621a175b6ba934b76b214664da", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L3B1bHNlLXNlY3VyZS1zc2x2cG4tY3ZlLTIwMTktMTE1MTAKZGVzY3JpcHRpb246ICJEZXRlY3QgY3ZlLTIwMTktMTE1MTAgZXhwbG9pdGF0aW9uIGF0dGVtcHMiCmZpbHRlcjogfAogIGV2dC5NZXRhLmxvZ190eXBlIGluIFsiaHR0cF9hY2Nlc3MtbG9nIiwgImh0dHBfZXJyb3ItbG9nIl0gYW5kIAogICAgKFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgbWF0Y2hlcyBVcHBlcignL2RhbmEtbmEvLi4vZGFuYS9odG1sNWFjYy9ndWFjYW1vbGUvLi4vLi4vLi4vLi4vLi4vLi4vLi4vW14/XStcXD8vZGFuYS9odG1sNWFjYy9ndWFjYW1vbGUvJykKICAgIG9yCiAgICBVcHBlcihldnQuTWV0YS5odHRwX3BhdGgpIG1hdGNoZXMgVXBwZXIoJy9kYW5hLW5hLyUyRSUyRS9kYW5hL2h0bWw1YWNjL2d1YWNhbW9sZS8lMkUlMkUvJTJFJTJFLyUyRSUyRS8lMkUlMkUvJTJFJTJFLyUyRSUyRS8lMkUlMkUvW14/XStcXD8vZGFuYS9odG1sNWFjYy9ndWFjYW1vbGUvJykpCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHR5cGU6IGV4cGxvaXQKICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L3B1bHNlLXNlY3VyZS1zc2x2cG4tY3ZlLTIwMTktMTE1MTAKZGVzY3JpcHRpb246ICJEZXRlY3QgY3ZlLTIwMTktMTE1MTAgZXhwbG9pdGF0aW9uIGF0dGVtcHMiCmZpbHRlcjogfAogIGV2dC5NZXRhLmxvZ190eXBlIGluIFsiaHR0cF9hY2Nlc3MtbG9nIiwgImh0dHBfZXJyb3ItbG9nIl0gYW5kIAogICAgKFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgbWF0Y2hlcyBVcHBlcignL2RhbmEtbmEvLi4vZGFuYS9odG1sNWFjYy9ndWFjYW1vbGUvLi4vLi4vLi4vLi4vLi4vLi4vLi4vW14/XStcXD8vZGFuYS9odG1sNWFjYy9ndWFjYW1vbGUvJykKICAgIG9yCiAgICBVcHBlcihldnQuTWV0YS5odHRwX3BhdGgpIG1hdGNoZXMgVXBwZXIoJy9kYW5hLW5hLyUyRSUyRS9kYW5hL2h0bWw1YWNjL2d1YWNhbW9sZS8lMkUlMkUvJTJFJTJFLyUyRSUyRS8lMkUlMkUvJTJFJTJFLyUyRSUyRS8lMkUlMkUvW14/XStcXD8vZGFuYS9odG1sNWFjYy9ndWFjYW1vbGUvJykpCmdyb3VwYnk6ICJldnQuTWV0YS5zb3VyY2VfaXAiCmJsYWNraG9sZTogMm0KbGFiZWxzOgogIHJlbWVkaWF0aW9uOiB0cnVlCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExOTAKICAgIC0gY3ZlLkNWRS0yMDE5LTExNTEwCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJQdWxzZSBTZWN1cmUgQ1ZFLTIwMTktMTE1MTAiCiAgc2VydmljZTogcHVsc2Utc2VjdXJlCg==", "description": "Detect cve-2019-11510 exploitation attemps", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1190", + "cve.CVE-2019-11510" + ], + "confidence": 3, + "label": "Pulse Secure CVE-2019-11510", + "remediation": true, + "service": "pulse-secure", + "spoofable": 0 } }, "crowdsecurity/smb-bf": { "path": "scenarios/crowdsecurity/smb-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "ee7fea38f0a67bde1aae3979cf0579da03da5adf4e69826f12a82c74b812e9d6", "deprecated": false + }, + "0.2": { + "digest": "a751e12a752fe652203deeb380e276a38258252296e26c27f6ccaeff038357f9", + "deprecated": false } }, "long_description": "dHJhY2tzIGZhaWxlZCBzYW1iYSBhdXRoZW50aWNhdGlvbnMuCg==", - "content": "IyBzbWIgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L3NtYi1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBzbWIgYnJ1dGVmb3JjZSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnc21iX2ZhaWxlZF9hdXRoJwpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IHNtYgogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWU=", + "content": "IyBzbWIgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L3NtYi1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBzbWIgYnJ1dGVmb3JjZSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnc21iX2ZhaWxlZF9hdXRoJwpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IHNtYgogcmVtZWRpYXRpb246IHRydWUKIGNvbmZpZGVuY2U6IDMKIHNwb29mYWJsZTogMAogY2xhc3NpZmljYXRpb246CiAgLSBhdHRhY2suVDExMTAKIGJlaGF2aW9yOiAic21iOmJydXRlZm9yY2UiCiBsYWJlbDogIlNNQiBCcnV0ZWZvcmNlIg==", "description": "Detect smb bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "smb:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "SMB Bruteforce", + "remediation": true, "service": "smb", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/spring4shell_cve-2022-22965": { "path": "scenarios/crowdsecurity/spring4shell_cve-2022-22965.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "b16993a7d1fe816230f0fef23e11736019a67a7fa64c5a5cc25e15589764cdcf", @@ -8014,42 +9918,64 @@ "0.2": { "digest": "4e03166936f61abd0711167960b06bff7dbffb37b0642ab2a6cba6eb9da9ee98", "deprecated": false + }, + "0.3": { + "digest": "c304e9bd45fb6dc79782d2e12f5e4cf646bd984178a0414ecd6c59162ba15cee", + "deprecated": false } }, "long_description": "RGV0ZWN0IHByb2JpbmcgZm9yIGN2ZS0yMDIyLTIyOTY1IGFrYSAnc3ByaW5nNHNoZWxsJy4KCkFzIHVzdWFsLCBzbWFydCBhdHRhY2tlcnMgbWlnaHQgYnlwYXNzIHRoZSBzaWduYXR1cmUuIFRoZSBwYXR0ZXJuIGl0c2VsZiBpcyBpbnNwaXJlZCBieSA6CiAtIFtTcHJpbmcgRnJhbWV3b3JrIFJDRSAoQ1ZFLTIwMjItMjI5NjUpIE5tYXAgKE5TRSkgQ2hlY2tlcl0oaHR0cHM6Ly9naXRodWIuY29tL2FsdDNreC9DVkUtMjAyMi0yMjk2NSkKIC0gW1JhbmRvcmldKGh0dHBzOi8vdHdpdHRlci5jb20vUmFuZG9yaUF0dGFjay9zdGF0dXMvMTUwOTI5ODQ5MDEwNjU5MzI4MykKIC0gW1phcCBEZXRlY3Rpb25dKGh0dHBzOi8vd3d3LnphcHJveHkub3JnL2Jsb2cvMjAyMi0wNC0wNC1zcHJpbmc0c2hlbGwtZGV0ZWN0aW9uLXdpdGgtemFwLykKCg==", - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L3NwcmluZzRzaGVsbF9jdmUtMjAyMi0yMjk2NQpkZXNjcmlwdGlvbjogIkRldGVjdCBjdmUtMjAyMi0yMjk2NSBwcm9iaW5nIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZAogICAgKFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgJ0NMQVNTLk1PRFVMRS5DTEFTU0xPQURFUi4nKQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCmxhYmVsczoKICB0eXBlOiBleHBsb2l0CiAgcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L3NwcmluZzRzaGVsbF9jdmUtMjAyMi0yMjk2NQpkZXNjcmlwdGlvbjogIkRldGVjdCBjdmUtMjAyMi0yMjk2NSBwcm9iaW5nIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbImh0dHBfYWNjZXNzLWxvZyIsICJodHRwX2Vycm9yLWxvZyJdIGFuZAogICAgKFVwcGVyKGV2dC5NZXRhLmh0dHBfcGF0aCkgY29udGFpbnMgJ0NMQVNTLk1PRFVMRS5DTEFTU0xPQURFUi4nKQpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTkwCiAgICAtIGN2ZS5DVkUtMjAyMi0yMjk2NQogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiU3ByaW5nNHNoZWxsIENWRS0yMDIyLTIyOTY1IgogIHNlcnZpY2U6IHNwcmluZwo=", "description": "Detect cve-2022-22965 probing", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1190", + "cve.CVE-2022-22965" + ], + "confidence": 3, + "label": "Spring4shell CVE-2022-22965", + "remediation": true, + "service": "spring", + "spoofable": 0 } }, "crowdsecurity/ssh-bf": { "path": "scenarios/crowdsecurity/ssh-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f", "deprecated": false + }, + "0.2": { + "digest": "94b1d6f04e9119ea1adb7fc70017fd108cede97bddbaf50b0b2bebdcc887ea28", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBzc2ggYXV0aGVudGljYXRpb25zIDoKCiAtIGxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDUgb24gc2FtZSB0YXJnZXQgdXNlcgogLSBsZWFrc3BlZWQgb2YgMTBzLCBjYXBhY2l0eSBvZiA1IHVuaXF1ZSBkaXN0aW5jdCB1c2VycwogCg==", - "content": "IyBzc2ggYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L3NzaC1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBzc2ggYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3NzaF9mYWlsZWQtYXV0aCciCmxlYWtzcGVlZDogIjEwcyIKcmVmZXJlbmNlczoKICAtIGh0dHA6Ly93aWtpcGVkaWEuY29tL3NzaC1iZi1pcy1iYWQKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKIHNlcnZpY2U6IHNzaAogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUKLS0tCiMgc3NoIHVzZXItZW51bQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L3NzaC1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3Qgc3NoIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdzc2hfZmFpbGVkLWF1dGgnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudGFyZ2V0X3VzZXIKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiBzZXJ2aWNlOiBzc2gKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCgo=", + "content": "IyBzc2ggYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L3NzaC1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBzc2ggYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3NzaF9mYWlsZWQtYXV0aCciCmxlYWtzcGVlZDogIjEwcyIKcmVmZXJlbmNlczoKICAtIGh0dHA6Ly93aWtpcGVkaWEuY29tL3NzaC1iZi1pcy1iYWQKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBzc2gKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiU1NIIEJydXRlZm9yY2UiCiAgYmVoYXZpb3I6ICJzc2g6YnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBzc2ggdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6IGNyb3dkc2VjdXJpdHkvc3NoLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBzc2ggdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3NzaF9mYWlsZWQtYXV0aCcKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS50YXJnZXRfdXNlcgpsZWFrc3BlZWQ6IDEwcwpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBzc2gKICByZW1lZGlhdGlvbjogdHJ1ZQogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgYmVoYXZpb3I6ICJzc2g6YnJ1dGVmb3JjZSIKICBsYWJlbDogIlNTSCBCcnV0ZWZvcmNlIgo=", "description": "Detect ssh bruteforce", "author": "crowdsecurity", "references": [ "http://wikipedia.com/ssh-bf-is-bad" ], "labels": { - "remediation": "true", + "behavior": "ssh:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "SSH Bruteforce", + "remediation": true, "service": "ssh", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/ssh-slow-bf": { "path": "scenarios/crowdsecurity/ssh-slow-bf.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "1b910bf7af59dab8dfbba8a735aafb3e4871d1237b29d56f53d7c0eece0381cf", @@ -8058,24 +9984,34 @@ "0.2": { "digest": "48665e6f7f4f0af7a47c7e81b0550c86f111e79c0a80d90290e560846beb4008", "deprecated": false + }, + "0.3": { + "digest": "313b1dc11a05f8beb6718cdeefe79866122eca26394efe2b814d5d2e15c28f4d", + "deprecated": false } }, "long_description": "RGV0ZWN0IHNsb3cgc3NoIGJydXRlZm9yY2UgYXV0aGVudGljYXRpb25zIDoKCiAtIGxlYWtzcGVlZCBvZiA2MHMsIGNhcGFjaXR5IG9mIDEwIG9uIHNhbWUgdGFyZ2V0IHVzZXIKIC0gbGVha3NwZWVkIG9mIDYwcywgY2FwYWNpdHkgb2YgMTAgdW5pcXVlIGRpc3RpbmN0IHVzZXJzCiAK", - "content": "IyBzc2ggYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L3NzaC1zbG93LWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHNsb3cgc3NoIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdzc2hfZmFpbGVkLWF1dGgnIgpsZWFrc3BlZWQ6ICI2MHMiCnJlZmVyZW5jZXM6CiAgLSBodHRwOi8vd2lraXBlZGlhLmNvbS9zc2gtYmYtaXMtYmFkCmNhcGFjaXR5OiAxMApncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogc2VydmljZTogc3NoCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBzc2ggdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6IGNyb3dkc2VjdXJpdHkvc3NoLXNsb3ctYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHNsb3cgc3NoIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdzc2hfZmFpbGVkLWF1dGgnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudGFyZ2V0X3VzZXIKbGVha3NwZWVkOiA2MHMKY2FwYWNpdHk6IDEwCmJsYWNraG9sZTogMW0KbGFiZWxzOgogc2VydmljZTogc3NoCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQoK", + "content": "IyBzc2ggYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L3NzaC1zbG93LWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHNsb3cgc3NoIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdzc2hfZmFpbGVkLWF1dGgnIgpsZWFrc3BlZWQ6ICI2MHMiCnJlZmVyZW5jZXM6CiAgLSBodHRwOi8vd2lraXBlZGlhLmNvbS9zc2gtYmYtaXMtYmFkCmNhcGFjaXR5OiAxMApncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IHNzaAogIHJlbWVkaWF0aW9uOiB0cnVlCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogInNzaDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiU1NIIEJydXRlZm9yY2UiCi0tLQojIHNzaCB1c2VyLWVudW0KdHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS9zc2gtc2xvdy1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3Qgc2xvdyBzc2ggdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3NzaF9mYWlsZWQtYXV0aCcKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS50YXJnZXRfdXNlcgpsZWFrc3BlZWQ6IDYwcwpjYXBhY2l0eTogMTAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogc3NoCiAgcmVtZWRpYXRpb246IHRydWUKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAic3NoOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJTU0ggQnJ1dGVmb3JjZSIK", "description": "Detect slow ssh bruteforce", "author": "crowdsecurity", "references": [ "http://wikipedia.com/ssh-bf-is-bad" ], "labels": { - "remediation": "true", + "behavior": "ssh:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "SSH Bruteforce", + "remediation": true, "service": "ssh", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/suricata-alerts": { "path": "scenarios/crowdsecurity/suricata-alerts.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "dca94f89e6df928e3d8924f9e1a012bf9c20bb9f8370c6e2c588d93da4e02e27", @@ -8088,81 +10024,123 @@ "0.3": { "digest": "ccef8952af2cb7931773dfee72eb8f7f65c476b7c5d4c8b5bfd3553b301992ac", "deprecated": false + }, + "0.4": { + "digest": "f91dbdceb8b96904b6b87c9d23544df6021b5bb72b43b93a754afbf6bc19c89b", + "deprecated": false } }, "long_description": "IyMgU3VyaWNhdGEgc2NlbmFyaW9zCgpBdXRvbWF0aWNhbGx5IHJlYWN0IHRvIGhpZ2ggc2V2ZXJpdHkgYWxlcnRzIGdlbmVyYXRlZCBieSB5b3VyIFN1cmljYXRhIDoKIC0gdHJpZ2dlciBiYW4gb24gKk1ham9yKiAoc2V2ZXJpdHk6MSkgcnVsZXMKIC0gdHJpZ2dlciBiYW4gb24gPjIgKipkaXN0aW5jdCoqIHJ1bGVzIG9mIHNldmVyaXR5IDIKCgo=", - "content": "IyBmb3IgbWF4ICgxKSBwcmlvcml0eSA6IGtpbGwgb24gc2lnaHQKdHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L3N1cmljYXRhLW1ham9yLXNldmVyaXR5CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGV4cGxvaXQgYXR0ZW1wdHMgdmlhIGVtZXJnaW5nIHRocmVhdCBydWxlcyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3N1cmljYXRhX2FsZXJ0JyAmJiBldnQuUGFyc2VkLnByb3RvID09ICdUQ1AnICYmIGV2dC5NZXRhLnN1cmljYXRhX3J1bGVfc2V2ZXJpdHkgPT0gJzEnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogc2VydmljZTogc3VyaWNhdGEKIHR5cGU6IGV4cGxvaXQKIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIGZvciBsb3dlciAoMikgcHJpb3JpdHkgOiB3YWl0IGZvciA+PTMgZGlmZmVyZW50IHNpZ25hdHVyZXMgYmVpbmcgdHJpZ2dlcmVkCiMgd2UgaW50ZW50aW9uYWxseSBhdm9pZCBzY2VuYXJpb3Mgb24gcHJpb3JpdHkgMyBhbmQgc3VjaCB0aGF0IGFyZSB0b28gc2Vuc2l0aXZlIHRvIGZhbHNlIHBvc2l0aXZlcwp0eXBlOiBsZWFreQpjYXBhY2l0eTogMgpsZWFrc3BlZWQ6IDIwcwpkaXN0aW5jdDogZXZ0Lk1ldGEuc3VyaWNhdGFfYWxlcnRfc2lnbmF0dXJlX2lkCm5hbWU6IGNyb3dkc2VjdXJpdHkvc3VyaWNhdGEtaGlnaC1tZWRpdW0tc2V2ZXJpdHkKZGVzY3JpcHRpb246ICJEZXRlY3QgZXhwbG9pdCBhdHRlbXB0cyB2aWEgZW1lcmdpbmcgdGhyZWF0IHJ1bGVzIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnc3VyaWNhdGFfYWxlcnQnICYmIGV2dC5QYXJzZWQucHJvdG8gPT0gJ1RDUCcgJiYgZXZ0Lk1ldGEuc3VyaWNhdGFfcnVsZV9zZXZlcml0eSA9PSAnMiciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiBzZXJ2aWNlOiBzdXJpY2F0YQogdHlwZTogZXhwbG9pdAo=", + "content": "IyBmb3IgbWF4ICgxKSBwcmlvcml0eSA6IGtpbGwgb24gc2lnaHQKdHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L3N1cmljYXRhLW1ham9yLXNldmVyaXR5CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGV4cGxvaXQgYXR0ZW1wdHMgdmlhIGVtZXJnaW5nIHRocmVhdCBydWxlcyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3N1cmljYXRhX2FsZXJ0JyAmJiBldnQuUGFyc2VkLnByb3RvID09ICdUQ1AnICYmIGV2dC5NZXRhLnN1cmljYXRhX3J1bGVfc2V2ZXJpdHkgPT0gJzEnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IHN1cmljYXRhCiAgcmVtZWRpYXRpb246IHRydWUKICBjb25maWRlbmNlOiAyCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTE5MAogICAgLSBhdHRhY2suVDE1OTUKICBiZWhhdmlvcjogImdlbmVyaWM6ZXhwbG9pdCIKICBsYWJlbDogIlN1cmljYXRhIFNldmVyaXR5IDEgRXZlbnQiCgotLS0KIyBmb3IgbG93ZXIgKDIpIHByaW9yaXR5IDogd2FpdCBmb3IgPj0zIGRpZmZlcmVudCBzaWduYXR1cmVzIGJlaW5nIHRyaWdnZXJlZAojIHdlIGludGVudGlvbmFsbHkgYXZvaWQgc2NlbmFyaW9zIG9uIHByaW9yaXR5IDMgYW5kIHN1Y2ggdGhhdCBhcmUgdG9vIHNlbnNpdGl2ZSB0byBmYWxzZSBwb3NpdGl2ZXMKdHlwZTogbGVha3kKY2FwYWNpdHk6IDIKbGVha3NwZWVkOiAyMHMKZGlzdGluY3Q6IGV2dC5NZXRhLnN1cmljYXRhX2FsZXJ0X3NpZ25hdHVyZV9pZApuYW1lOiBjcm93ZHNlY3VyaXR5L3N1cmljYXRhLWhpZ2gtbWVkaXVtLXNldmVyaXR5CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGV4cGxvaXQgYXR0ZW1wdHMgdmlhIGVtZXJnaW5nIHRocmVhdCBydWxlcyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3N1cmljYXRhX2FsZXJ0JyAmJiBldnQuUGFyc2VkLnByb3RvID09ICdUQ1AnICYmIGV2dC5NZXRhLnN1cmljYXRhX3J1bGVfc2V2ZXJpdHkgPT0gJzInIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IHN1cmljYXRhCiAgY29uZmlkZW5jZTogMgogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExOTAKICAgIC0gYXR0YWNrLlQxNTk1CiAgYmVoYXZpb3I6ICJnZW5lcmljOmV4cGxvaXQiCiAgbGFiZWw6ICJTdXJpY2F0YSBTZXZlcml0eSAyIEV2ZW50Igo=", "description": "Detect exploit attempts via emerging threat rules", "author": "crowdsecurity", "references": [ "http://rules.emergingthreats.net/" ], "labels": { - "remediation": "true", + "behavior": "generic:exploit", + "classification": [ + "attack.T1190", + "attack.T1595" + ], + "confidence": 2, + "label": "Suricata Severity 1 Event", + "remediation": true, "service": "suricata", - "type": "exploit" + "spoofable": 0 } }, "crowdsecurity/synology-dsm-bf": { "path": "scenarios/crowdsecurity/synology-dsm-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "8d70f3ab754d69ce9c10fb668bf3fb6bf9f02dca26e577c6c8b0c10731b0c442", "deprecated": false + }, + "0.2": { + "digest": "8e89ba870ba373ddc4bc2f745cb08dcf6666035a17bfa5043906158c160f93af", + "deprecated": false } }, "long_description": "IyMgRGV0ZWN0IFN5bm9sb2d5IERTTSBicnV0ZWZvcmNlIGF0dGFjay4KCiMjIyBSdWxlCmxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDUK", - "content": "IyBTeW5vbG9neSBEU00gYXV0aC5sb2cgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L3N5bm9sb2d5LWRzbS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBTeW5vbG9neSBEU00gd2ViIGF1dGggYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3N5bm9sb2d5LWRzbV9mYWlsZWRfYXV0aCciCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKIHNlcnZpY2U6IHN5bm9sb2d5LWRzbQogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUK", + "content": "IyBTeW5vbG9neSBEU00gYXV0aC5sb2cgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L3N5bm9sb2d5LWRzbS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBTeW5vbG9neSBEU00gd2ViIGF1dGggYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3N5bm9sb2d5LWRzbV9mYWlsZWRfYXV0aCciCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKIHNlcnZpY2U6IHN5bm9sb2d5X2RzbQogcmVtZWRpYXRpb246IHRydWUKIGNvbmZpZGVuY2U6IDMKIHNwb29mYWJsZTogMAogY2xhc3NpZmljYXRpb246CiAgLSBhdHRhY2suVDExMTAKIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogbGFiZWw6ICJTeW5vbG9neSBEU00gQnJ1dGVmb3JjZSI=", "description": "Detect Synology DSM web auth bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "synology-dsm", - "type": "bruteforce" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Synology DSM Bruteforce", + "remediation": true, + "service": "synology_dsm", + "spoofable": 0 } }, "crowdsecurity/teamspeak3-bf": { "path": "scenarios/crowdsecurity/teamspeak3-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "6a6f6a1c73fed4a1ccb9745e42614bc693b975f2eabb31b7c9ac2ede9568b166", "deprecated": false + }, + "0.2": { + "digest": "fe7bc25db10780c851f053e8b388b734a7c8d929412b730d3256ab700f56368d", + "deprecated": false } }, "long_description": "IyMgRGV0ZWN0IHRlYW1zcGVhazMgYnJ1dGVmb3JjZSBhdHRhY2suCgojIyMgUnVsZQoKbGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgMgo=", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS90ZWFtc3BlYWszLWJmCmRlc2NyaXB0aW9uOiAiZGV0ZWN0IHRlYW1zcGVhazMgc2VydmVyIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3RzM19mYWlsX2F1dGgnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogMgpsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogNW0KbGFiZWxzOgogc2VydmljZTogdGVhbXNwZWFrMwogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS90ZWFtc3BlYWszLWJmCmRlc2NyaXB0aW9uOiAiZGV0ZWN0IHRlYW1zcGVhazMgc2VydmVyIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3RzM19mYWlsX2F1dGgnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogMgpsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogNW0KbGFiZWxzOgogIHNlcnZpY2U6IHRlYW1zcGVhazMKICB0eXBlOiBicnV0ZWZvcmNlCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiZ2VuZXJpYzpicnV0ZWZvcmNlIgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDIKICBsYWJlbDogIlRlYW1TcGVhazMgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "detect teamspeak3 server bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "generic:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 2, + "label": "TeamSpeak3 Bruteforce", + "remediation": true, "service": "teamspeak3", + "spoofable": 0, "type": "bruteforce" } }, "crowdsecurity/telnet-bf": { "path": "scenarios/crowdsecurity/telnet-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "fd1769c247b352916a0400c33668b315a6d7a0ab8e672f339b00d9de2df71229", "deprecated": false + }, + "0.2": { + "digest": "3e21b4bdaba0abd031f17f4ee8c0e661695e463681892b71ff6333b92673c4a1", + "deprecated": false } }, "long_description": "IyMgRGV0ZWN0IFRlbG5ldCBicnV0ZWZvcmNlIGF0dGFjay4KCiMjIyBSdWxlCmxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDU=", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS90ZWxuZXQtYmYKZGVzY3JpcHRpb246ICJkZXRlY3QgdGVsbmV0IGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3RlbG5ldF9uZXdfc2Vzc2lvbicKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmNhcGFjaXR5OiA1CmxlYWtzcGVlZDogIjEwcyIKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiB0ZWxuZXQKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVl", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS90ZWxuZXQtYmYKZGVzY3JpcHRpb246ICJkZXRlY3QgdGVsbmV0IGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3RlbG5ldF9uZXdfc2Vzc2lvbicKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmNhcGFjaXR5OiA1CmxlYWtzcGVlZDogIjEwcyIKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogdGVsbmV0CiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogInRlbG5ldDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiVGVsbmV0IEJydXRlZm9yY2UiCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "detect telnet bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "telnet:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Telnet Bruteforce", + "remediation": true, "service": "telnet", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/thehive-bf": { "path": "scenarios/crowdsecurity/thehive-bf.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "6a8e5ab92bdc2087dffb2702d9990a7c974654ce88db63a3b7f4a40b3af75790", @@ -8171,21 +10149,31 @@ "0.2": { "digest": "a082bd5622ebf06280de10cdd126699b8d53f8ca002085e4113d3ea174597e9a", "deprecated": false + }, + "0.3": { + "digest": "ef76556198a2c9c72636092cfac1ca8a604f905a372e923fa57fcc467e5e66fe", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBUaGVoaXZlIGF1dGhlbnRpY2F0aW9uczoKCiAtIGxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDUgZnJvbSBzYW1lIElQ", - "content": "dHlwZTogbGVha3kKZGVidWc6IGZhbHNlCm5hbWU6IGNyb3dkc2VjdXJpdHkvdGhlaGl2ZS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBicnV0ZWZvcmNlIG9uIFRoZWhpdmUgd2ViIGludGVyZmFjZSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAndGhlaGl2ZV9mYWlsZWRfYXV0aCcKbGVha3NwZWVkOiAiMTBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiB0aGVoaXZlCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogbGVha3kKZGVidWc6IGZhbHNlCm5hbWU6IGNyb3dkc2VjdXJpdHkvdGhlaGl2ZS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBicnV0ZWZvcmNlIG9uIFRoZWhpdmUgd2ViIGludGVyZmFjZSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAndGhlaGl2ZV9mYWlsZWRfYXV0aCcKbGVha3NwZWVkOiAiMTBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJUaGUgSGl2ZSBCcnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect bruteforce on Thehive web interface", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "thehive", - "type": "bruteforce" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "The Hive Bruteforce", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "crowdsecurity/thinkphp-cve-2018-20062": { "path": "scenarios/crowdsecurity/thinkphp-cve-2018-20062.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "bf76bbd0e78be17642a4ea0d8c080ae72b43075fa74ba77990aac602285c1857", @@ -8198,19 +10186,32 @@ "0.3": { "digest": "1cc85df2f1e642e83ec20e0197777795b82ff076842c6b169a8a7b1e4687de3a", "deprecated": false + }, + "0.4": { + "digest": "a7d01cde79e669479f49160d5c122898ee88e14ac07d27d232b9b14ac839d5d5", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS90aGlua3BocC1jdmUtMjAxOC0yMDA2MgpkZXNjcmlwdGlvbjogIkRldGVjdCBUaGlua1BIUCBDVkUtMjAxOC0yMDA2MiBleHBsb2l0YXRpb24gYXR0ZW1wcyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWyJodHRwX2FjY2Vzcy1sb2ciLCAiaHR0cF9lcnJvci1sb2ciXSBhbmQgYW55KEZpbGUoInRoaW5rcGhwX2N2ZV8yMDE4LTIwMDYyLnR4dCIpLCB7VXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBtYXRjaGVzIFVwcGVyKCMpfSkKZGF0YToKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9jcm93ZHNlY3VyaXR5L3NlYy1saXN0cy9tYXN0ZXIvd2ViL3RoaW5rcGhwX2N2ZV8yMDE4LTIwMDYyLnR4dAogICAgZGVzdF9maWxlOiB0aGlua3BocF9jdmVfMjAxOC0yMDA2Mi50eHQKICAgIHR5cGU6IHN0cmluZwpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCmxhYmVsczoKICB0eXBlOiBleHBsb2l0CiAgcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMAojZGVidWc6IHRydWUKbmFtZTogY3Jvd2RzZWN1cml0eS90aGlua3BocC1jdmUtMjAxOC0yMDA2MgpkZXNjcmlwdGlvbjogIkRldGVjdCBUaGlua1BIUCBDVkUtMjAxOC0yMDA2MiBleHBsb2l0YXRpb24gYXR0ZW1wcyIKZmlsdGVyOiB8CiAgZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWyJodHRwX2FjY2Vzcy1sb2ciLCAiaHR0cF9lcnJvci1sb2ciXSBhbmQgYW55KEZpbGUoInRoaW5rcGhwX2N2ZV8yMDE4LTIwMDYyLnR4dCIpLCB7VXBwZXIoZXZ0Lk1ldGEuaHR0cF9wYXRoKSBtYXRjaGVzIFVwcGVyKCMpfSkKZGF0YToKICAtIHNvdXJjZV91cmw6IGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9jcm93ZHNlY3VyaXR5L3NlYy1saXN0cy9tYXN0ZXIvd2ViL3RoaW5rcGhwX2N2ZV8yMDE4LTIwMDYyLnR4dAogICAgZGVzdF9maWxlOiB0aGlua3BocF9jdmVfMjAxOC0yMDA2Mi50eHQKICAgIHR5cGU6IHN0cmluZwpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTE5MAogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gY3ZlLkNWRS0yMDE4LTIwMDYyCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJUaGlua1BIUCBDVkUtMjAxOC0yMDA2MiIKICByZW1lZGlhdGlvbjogdHJ1ZQogIHNlcnZpY2U6IHRoaW5rcGhwCg==", "description": "Detect ThinkPHP CVE-2018-20062 exploitation attemps", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1190", + "attack.T1595", + "cve.CVE-2018-20062" + ], + "confidence": 3, + "label": "ThinkPHP CVE-2018-20062", + "remediation": true, + "service": "thinkphp", + "spoofable": 0 } }, "crowdsecurity/vmware-cve-2022-22954": { "path": "scenarios/crowdsecurity/vmware-cve-2022-22954.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "a5d994d73edec1ea334d09cd057193163a32527797f9556774f167bda1593616", @@ -8219,131 +10220,212 @@ "0.2": { "digest": "d26a37b84b843dba6a0266d54f754438b875fa8bc62de6ddd7d9d2d5d1eba07c", "deprecated": false + }, + "0.3": { + "digest": "4970a46baaef676bd66166bbeedd764df53cc0b81f6a15812e5b231953b6314a", + "deprecated": false } }, "long_description": "RGV0ZWN0IGV4cGxvaXRhdGlvbiBvZiBWbXdhcmUgQ1ZFLTIwMjItMjI5NTQKClJlZjogaHR0cHM6Ly93d3cudm13YXJlLmNvbS9zZWN1cml0eS9hZHZpc29yaWVzL1ZNU0EtMjAyMi0wMDExLmh0bWwKUG9jOiBodHRwczovL2dpdGh1Yi5jb20vc2hlcmxvY2tzZWN1cml0eS9WTXdhcmUtQ1ZFLTIwMjItMjI5NTQ=", - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L3Ztd2FyZS1jdmUtMjAyMi0yMjk1NApkZXNjcmlwdGlvbjogIkRldGVjdCBWbXdhcmUgQ1ZFLTIwMjItMjI5NTQgZXhwbG9pdGF0aW9uIGF0dGVtcHRzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2h0dHBfYWNjZXNzLWxvZycsICdodHRwX2Vycm9yLWxvZyddICYmIFVwcGVyKFF1ZXJ5VW5lc2NhcGUoZXZ0Lk1ldGEuaHR0cF9wYXRoKSkgc3RhcnRzV2l0aCBVcHBlcignL2NhdGFsb2ctcG9ydGFsL3VpL29hdXRoL3ZlcmlmeT9lcnJvcj0mZGV2aWNlVWRpZD0keyJmcmVlbWFya2VyLnRlbXBsYXRlLnV0aWxpdHkuRXhlY3V0ZSI/bmV3KCkoJykKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKYmxhY2tob2xlOiAybQpsYWJlbHM6CiAgdHlwZTogZXhwbG9pdAogIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L3Ztd2FyZS1jdmUtMjAyMi0yMjk1NApkZXNjcmlwdGlvbjogIkRldGVjdCBWbXdhcmUgQ1ZFLTIwMjItMjI5NTQgZXhwbG9pdGF0aW9uIGF0dGVtcHRzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2h0dHBfYWNjZXNzLWxvZycsICdodHRwX2Vycm9yLWxvZyddICYmIFVwcGVyKFF1ZXJ5VW5lc2NhcGUoZXZ0Lk1ldGEuaHR0cF9wYXRoKSkgc3RhcnRzV2l0aCBVcHBlcignL2NhdGFsb2ctcG9ydGFsL3VpL29hdXRoL3ZlcmlmeT9lcnJvcj0mZGV2aWNlVWRpZD0keyJmcmVlbWFya2VyLnRlbXBsYXRlLnV0aWxpdHkuRXhlY3V0ZSI/bmV3KCkoJykKZ3JvdXBieTogImV2dC5NZXRhLnNvdXJjZV9pcCIKYmxhY2tob2xlOiAybQpsYWJlbHM6CiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExOTAKICAgIC0gYXR0YWNrLlQxNTk1CiAgICAtIGN2ZS5DVkUtMjAyMi0yMjk1NAogIGJlaGF2aW9yOiAidm0tbWFuYWdlbWVudDpleHBsb2l0IgogIGxhYmVsOiAiVk1XQVJFIENWRS0yMDIyLTIyOTU0IgogIHJlbWVkaWF0aW9uOiB0cnVlCiAgc2VydmljZTogdm13YXJlCg==", "description": "Detect Vmware CVE-2022-22954 exploitation attempts", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "exploit" + "behavior": "vm-management:exploit", + "classification": [ + "attack.T1190", + "attack.T1595", + "cve.CVE-2022-22954" + ], + "confidence": 3, + "label": "VMWARE CVE-2022-22954", + "remediation": true, + "service": "vmware", + "spoofable": 0 } }, "crowdsecurity/vmware-vcenter-vmsa-2021-0027": { "path": "scenarios/crowdsecurity/vmware-vcenter-vmsa-2021-0027.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "4d497542fa056c82b0089b7849ce686544b8ae9775f6dffddd6ac5074ec5964b", "deprecated": false + }, + "0.2": { + "digest": "f4d75dc60a53e0a98cf3af39207c52de14a7aeb4571eb15234e881aea5793064", + "deprecated": false } }, "long_description": "RGV0ZWN0IGV4cGxvaXRhdGlvbiBvZiBWTVNBLTIwMjEtMDAyNwoKUmVmOiBodHRwczovL3d3dy52bXdhcmUuY29tL3NlY3VyaXR5L2Fkdmlzb3JpZXMvVk1TQS0yMDIxLTAwMjcuaHRtbAo=", - "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L3Ztd2FyZS12Y2VudGVyLXZtc2EtMjAyMS0wMDI3CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFZNU0EtMjAyMS0wMDI3IGV4cGxvaXRhdGlvbiBhdHRlbXBzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2h0dHBfYWNjZXNzLWxvZycsICdodHRwX2Vycm9yLWxvZyddICYmIGV2dC5NZXRhLmh0dHBfcGF0aCBtYXRjaGVzICcvdWkvdmNhdi1ib290c3RyYXAvcmVzdC92Y2F2LXByb3ZpZGVycy9wcm92aWRlci1sb2dvXFw/dXJsPShmaWxlfGh0dHApJwpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCmxhYmVsczoKICB0eXBlOiBleHBsb2l0CiAgcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogdHJpZ2dlcgpmb3JtYXQ6IDIuMApuYW1lOiBjcm93ZHNlY3VyaXR5L3Ztd2FyZS12Y2VudGVyLXZtc2EtMjAyMS0wMDI3CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFZNU0EtMjAyMS0wMDI3IGV4cGxvaXRhdGlvbiBhdHRlbXBzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2h0dHBfYWNjZXNzLWxvZycsICdodHRwX2Vycm9yLWxvZyddICYmIGV2dC5NZXRhLmh0dHBfcGF0aCBtYXRjaGVzICcvdWkvdmNhdi1ib290c3RyYXAvcmVzdC92Y2F2LXByb3ZpZGVycy9wcm92aWRlci1sb2dvXFw/dXJsPShmaWxlfGh0dHApJwpncm91cGJ5OiAiZXZ0Lk1ldGEuc291cmNlX2lwIgpibGFja2hvbGU6IDJtCmxhYmVsczoKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTE5MAogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gY3ZlLkNWRS0yMDIxLTAwMjcKICBiZWhhdmlvcjogInZtLW1hbmFnZW1lbnQ6ZXhwbG9pdCIKICBsYWJlbDogIlZNV0FSRSBWQ2VudGVyIFZNU0EgQ1ZFLTIwMjEtMDAyNyIKICByZW1lZGlhdGlvbjogdHJ1ZQogIHNlcnZpY2U6IHZtd2FyZQo=", "description": "Detect VMSA-2021-0027 exploitation attemps", "author": "crowdsecurity", "labels": { - "remediation": "true", - "type": "exploit" + "behavior": "vm-management:exploit", + "classification": [ + "attack.T1190", + "attack.T1595", + "cve.CVE-2021-0027" + ], + "confidence": 3, + "label": "VMWARE VCenter VMSA CVE-2021-0027", + "remediation": true, + "service": "vmware", + "spoofable": 0 } }, "crowdsecurity/vsftpd-bf": { "path": "scenarios/crowdsecurity/vsftpd-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1", "deprecated": false + }, + "0.2": { + "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91", + "deprecated": false } }, "long_description": "IyMgRGV0ZWN0IEZUUCBicnV0ZWZvcmNlIGF0dGFjay4KCiMjIyBSdWxlCmxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDU=", - "content": "dHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvdnNmdHBkLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEZUUCBicnV0ZWZvcmNlICh2c2Z0cGQpIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdmdHBfZmFpbGVkX2F1dGgnCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KbGFiZWxzOgogc2VydmljZTogZnRwCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGNyb3dkc2VjdXJpdHkvdnNmdHBkLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEZUUCBicnV0ZWZvcmNlICh2c2Z0cGQpIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdmdHBfZmFpbGVkX2F1dGgnCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KbGFiZWxzOgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJmdHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIlZTRlRQRCBCcnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCiAgc2VydmljZTogdnNmdHBkCg==", "description": "Detect FTP bruteforce (vsftpd)", "author": "crowdsecurity", "labels": { - "remediation": "true", - "service": "ftp", - "type": "bruteforce" + "behavior": "ftp:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "VSFTPD Bruteforce", + "remediation": true, + "service": "vsftpd", + "spoofable": 0 } }, "crowdsecurity/windows-CVE-2022-30190-msdt": { "path": "scenarios/crowdsecurity/windows-CVE-2022-30190-msdt.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "6cac369ca1553245cf9a837275492822387a43a0a4f138560dfdda208def1103", "deprecated": false + }, + "0.2": { + "digest": "2e41d1c94e7af7e2cdb8eb0c22152a44f320b9e7ef00b6604b3f77977e86f3ed", + "deprecated": false } }, "long_description": "VGhpcyBzY2VuYXJpbyBkZXRlY3RzIHNvbWUgYXR0ZW1wdHMgYXQgZXhwbG9pdGluZyBbQ1ZFLTIwMjItMzAxOTBdKGh0dHBzOi8vbXNyYy1ibG9nLm1pY3Jvc29mdC5jb20vMjAyMi8wNS8zMC9ndWlkYW5jZS1mb3ItY3ZlLTIwMjItMzAxOTAtbWljcm9zb2Z0LXN1cHBvcnQtZGlhZ25vc3RpYy10b29sLXZ1bG5lcmFiaWxpdHkvKSBvbiBXaW5kb3dzLgoKSXQgZG9lcyBzbyBieSBwYXJzaW5nIHN5c21vbiBsb2dzLCBtb3JlIHNwZWNpZmljYWxseSB0aGUgb25lIHdpdGggZXZlbnQgSUQgMSAocHJvY2VzcyBjcmVhdGlvbikuCgpUaGlzIG1lYW5zIHRoYXQgeW91IG5lZWQgYSB3b3JraW5nIHN5c21vbiBpbnN0YWxsYXRpb24gdG8gYmUgYWJsZSB0byB1c2UgdGhpcyBzY2VuYXJpby4g", - "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTMwMTkwLW1zZHQKZGVzY3JpcHRpb246ICJEZXRlY3QgQ1ZFLTIwMjItMzAxOTAgZnJvbSBzeXNtb24gZXZlbnRzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5zZXJ2aWNlID09ICdzeXNtb24nICYmIGV2dC5QYXJzZWQuRXZlbnRJRCA9PSAnMScgJiYgCiAgVXBwZXIoZXZ0LlBhcnNlZC5JbWFnZSkgZW5kc1dpdGggJ01TRFQuRVhFJyAmJiAKICBVcHBlcihldnQuUGFyc2VkLlBhcmVudEltYWdlKSBlbmRzV2l0aCAnV0lOV09SRC5FWEUnICYmCiAgKFVwcGVyKGV2dC5QYXJzZWQuQ29tbWFuZExpbmUpIGNvbnRhaW5zICdQQ1dESUFHTk9TVElDJyAmJiBVcHBlcihldnQuUGFyc2VkLkNvbW1hbmRMaW5lKSBjb250YWlucyAnSVRfUkVCUk9XU0VGT1JGSUxFJyAmJiBVcHBlcihldnQuUGFyc2VkLkNvbW1hbmRMaW5lKSBjb250YWlucyAnSVRfQlJPV1NFRk9SRklMRScpCmxhYmVsczoKIHR5cGU6IHJjZQogbm90aWZpY2F0aW9uOiB0cnVlCiBvczogd2luZG93cwpzY29wZToKICB0eXBlOiB1c2VyX2FjY291bnQKICBleHByZXNzaW9uOiBldnQuUGFyc2VkLlVzZXIK", + "content": "dHlwZTogdHJpZ2dlcgpuYW1lOiBjcm93ZHNlY3VyaXR5L0NWRS0yMDIyLTMwMTkwLW1zZHQKZGVzY3JpcHRpb246ICJEZXRlY3QgQ1ZFLTIwMjItMzAxOTAgZnJvbSBzeXNtb24gZXZlbnRzIgpmaWx0ZXI6IHwKICBldnQuTWV0YS5zZXJ2aWNlID09ICdzeXNtb24nICYmIGV2dC5QYXJzZWQuRXZlbnRJRCA9PSAnMScgJiYgCiAgVXBwZXIoZXZ0LlBhcnNlZC5JbWFnZSkgZW5kc1dpdGggJ01TRFQuRVhFJyAmJiAKICBVcHBlcihldnQuUGFyc2VkLlBhcmVudEltYWdlKSBlbmRzV2l0aCAnV0lOV09SRC5FWEUnICYmCiAgKFVwcGVyKGV2dC5QYXJzZWQuQ29tbWFuZExpbmUpIGNvbnRhaW5zICdQQ1dESUFHTk9TVElDJyAmJiBVcHBlcihldnQuUGFyc2VkLkNvbW1hbmRMaW5lKSBjb250YWlucyAnSVRfUkVCUk9XU0VGT1JGSUxFJyAmJiBVcHBlcihldnQuUGFyc2VkLkNvbW1hbmRMaW5lKSBjb250YWlucyAnSVRfQlJPV1NFRk9SRklMRScpCmxhYmVsczoKICB0eXBlOiByY2UKICBub3RpZmljYXRpb246IHRydWUKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTA1OQogICAgLSBhdHRhY2suVDEyMDMKICAgIC0gY3ZlLkNWRS0yMDIyLTMwMTkwCiAgYmVoYXZpb3JzOiAid2luZG93czpyY2UiCiAgbGFiZWw6ICJDVkUtMjAyMi0zMDE5MCIKICBzZXJ2aWNlOiB3aW5kb3dzCnNjb3BlOgogIHR5cGU6IHVzZXJfYWNjb3VudAogIGV4cHJlc3Npb246IGV2dC5QYXJzZWQuVXNlcgo=", "description": "Detect CVE-2022-30190 from sysmon events", "author": "crowdsecurity", "labels": { - "notification": "true", - "os": "windows", + "behaviors": "windows:rce", + "classification": [ + "attack.T1059", + "attack.T1203", + "cve.CVE-2022-30190" + ], + "confidence": 3, + "label": "CVE-2022-30190", + "notification": true, + "service": "windows", + "spoofable": 0, "type": "rce" } }, "crowdsecurity/windows-bf": { "path": "scenarios/crowdsecurity/windows-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "8bab4995597e6a72e87131cd681ed6023c90cc805c3ee824bfbce1725e67fdd8", "deprecated": false + }, + "0.2": { + "digest": "d90b8a59f018321a1571744836a05c7a1d1214902bede5b3122f0c66339ce155", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBCRiBhZ2FpbnN0IHNlcnZpY2VzIHVzaW5nIHdpbmRvd3MgYXV0aGVudGljYXRpb24gKFJEUCwgU01CLCBPV0EsIC4uLikuCgpCdWNrZXRzIGhhdmUgYSBjYXBhY2l0eSBvZiA1IGFuZCBhIGxlYWtzcGVlZCBvZiAxMHMu", - "content": "IyB3aW5kb3dzIGF1dGggYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L3dpbmRvd3MtYmYKZGVzY3JpcHRpb246ICJEZXRlY3Qgd2luZG93cyBhdXRoIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICd3aW5kb3dzX2ZhaWxlZF9hdXRoJyIKbGVha3NwZWVkOiAiMTBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogc2VydmljZTogd2luZG93cwogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUK", + "content": "IyB3aW5kb3dzIGF1dGggYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L3dpbmRvd3MtYmYKZGVzY3JpcHRpb246ICJEZXRlY3Qgd2luZG93cyBhdXRoIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICd3aW5kb3dzX2ZhaWxlZF9hdXRoJyIKbGVha3NwZWVkOiAiMTBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJ3aW5kb3dzOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJXaW5kb3dzIEJydXRlZm9yY2UiCiAgcmVtZWRpYXRpb246IHRydWUKICBzZXJ2aWNlOiB3aW5kb3dzCg==", "description": "Detect windows auth bruteforce", "author": "crowdsecurity", "labels": { - "remediation": "true", + "behavior": "windows:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Windows Bruteforce", + "remediation": true, "service": "windows", - "type": "bruteforce" + "spoofable": 0 } }, "crowdsecurity/wireguard-auth": { "path": "scenarios/crowdsecurity/wireguard-auth.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "63d0813873be54c7fe419127eae9981713dadfca5e3514583d1ade1f20633d04", "deprecated": false + }, + "0.2": { + "digest": "e2620820c7b1b14d80075ba0613da2c75462bd10597d9236cf434eba5386ad4e", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBicnV0ZWZvcmNlIGF0dGVtcHRzIGFnYWluc3QgYSB3aXJlZ3VhcmQgc2VydmVyLiBJdCB3aWxsIHBhcnNlIHRoZSB3aXJlZ3VhcmQgbG9nIGZpbGUgYW5kIGNvdW50IHRoZSBudW1iZXIgb2YgZmFpbGVkIGxvZ2luIGF0dGVtcHRzIHBlciBJUCBhZGRyZXNzLiBJZiB0aGUgbnVtYmVyIG9mIGZhaWxlZCBsb2dpbiBhdHRlbXB0cyBleGNlZWRzIHRoZSB0aHJlc2hvbGQsIHRoZSBJUCBhZGRyZXNzIHdpbGwgdHJpZ2dlciBhbiBhbGVydC4=", - "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS93aXJlZ3VhcmQtYXV0aApkZXNjcmlwdGlvbjogIkRldGVjdHMgcmVqZWN0ZWQgY29ubmVjdGlvbnMgYXR0ZW1wdHMgYW5kIHVuYXV0aG9yaXplZCBwYWNrZXRzIHRocm91Z2ggd2lyZWd1YXJkIHR1bm5lbHMiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICd3aXJlZ3VhcmRfZmFpbGVkX2F1dGgnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAiMzBzIgpjYXBhY2l0eTogMwpibGFja2hvbGU6IDFtCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKbmFtZTogY3Jvd2RzZWN1cml0eS93aXJlZ3VhcmQtYXV0aApkZXNjcmlwdGlvbjogIkRldGVjdHMgcmVqZWN0ZWQgY29ubmVjdGlvbnMgYXR0ZW1wdHMgYW5kIHVuYXV0aG9yaXplZCBwYWNrZXRzIHRocm91Z2ggd2lyZWd1YXJkIHR1bm5lbHMiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICd3aXJlZ3VhcmRfZmFpbGVkX2F1dGgnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAiMzBzIgpjYXBhY2l0eTogMwpibGFja2hvbGU6IDFtCmxhYmVsczoKICByZW1lZGlhdGlvbjogdHJ1ZQogIHNlcnZpY2U6IHdpcmVndWFyZAogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgbGFiZWw6ICJXaXJlZ3VhcmQgQnJ1dGVmb3JjZSIKICBiZWhhdmlvcjogImdlbmVyaWM6YnJ1dGVmb3JjZSIK", "description": "Detects rejected connections attempts and unauthorized packets through wireguard tunnels", "author": "crowdsecurity", "labels": { - "remediation": "true" + "behavior": "generic:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Wireguard Bruteforce", + "remediation": true, + "service": "wireguard", + "spoofable": 0 } }, "firewallservices/lemonldap-ng-bf": { "path": "scenarios/firewallservices/lemonldap-ng-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "92ffa388cc0c79431a9014d6a384a84e7571d5e3445ff60d29792eb5d36307da", "deprecated": false + }, + "0.2": { + "digest": "d27d2e0536ff663a0d5821598cf063be7c382946117116cf6335bf18258488a0", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBMZW1vbmxkYXA6Ok5HIGF1dGhlbnRpY2F0aW9ucyA6CgogLSBsZWFrc3BlZWQgb2YgMzBzLCBjYXBhY2l0eSBvZiA1IG9uIHNhbWUgdGFyZ2V0IHVzZXIKIC0gbGVha3NwZWVkIG9mIDJtLCBjYXBhY2l0eSBvZiA1IHVuaXF1ZSBkaXN0aW5jdCB1c2Vycwo=", - "content": "IyBMZW1vbmxkYXA6Ok5HIGJydXRmb3JjZQp0eXBlOiBsZWFreQojZGVidWc6IHRydWUKbmFtZTogZmlyZXdhbGxzZXJ2aWNlcy9sZW1vbmxkYXAtbmctYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgTGVtb25sZGFwOjpORyBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLnNlcnZpY2UgPT0gJ2xsbmcnIGFuZCBldnQuTWV0YS5sb2dfdHlwZSA9PSAnbGxuZ19hdXRoX2ZhaWwnCmxlYWtzcGVlZDogMzBzCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgc2VydmljZTogbGxuZwogIHR5cGU6IGJydXRlZm9yY2UKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBMZW1vbmxkYXA6Ok5HIHVzZXIgZW51bWVyYXRpb24KdHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGZpcmV3YWxsc2VydmljZXMvbGVtb25sZGFwLW5nLXVzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBMZW1vbmxkYXA6Ok5HIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLnNlcnZpY2UgPT0gJ2xsbmcnIGFuZCBldnQuTWV0YS5sb2dfdHlwZSA9PSAnbGxuZ19hdXRoX2ZhaWwnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcgpsZWFrc3BlZWQ6IDJtCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGxsbmcKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWUKCg==", + "content": "IyBMZW1vbmxkYXA6Ok5HIGJydXRmb3JjZQp0eXBlOiBsZWFreQojZGVidWc6IHRydWUKbmFtZTogZmlyZXdhbGxzZXJ2aWNlcy9sZW1vbmxkYXAtbmctYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgTGVtb25sZGFwOjpORyBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLnNlcnZpY2UgPT0gJ2xsbmcnIGFuZCBldnQuTWV0YS5sb2dfdHlwZSA9PSAnbGxuZ19hdXRoX2ZhaWwnCmxlYWtzcGVlZDogMzBzCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgc2VydmljZTogbGRhcAogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJsZGFwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJMZW1vbkxEQVAgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQoKLS0tCiMgTGVtb25sZGFwOjpORyB1c2VyIGVudW1lcmF0aW9uCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBmaXJld2FsbHNlcnZpY2VzL2xlbW9ubGRhcC1uZy11c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgTGVtb25sZGFwOjpORyB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiBldnQuTWV0YS5zZXJ2aWNlID09ICdsbG5nJyBhbmQgZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2xsbmdfYXV0aF9mYWlsJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXIKbGVha3NwZWVkOiAybQpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBsZGFwCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICAgIC0gYXR0YWNrLlQxNTk1CiAgYmVoYXZpb3I6ICJsZGFwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJMZW1vbkxEQVAgVXNlciBFbnVtIEJydXRlZm9yY2UiCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect Lemonldap::NG bruteforce", "author": "firewallservices", "labels": { - "remediation": "true", - "service": "llng", - "type": "bruteforce" + "behavior": "ldap:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "LemonLDAP Bruteforce", + "remediation": true, + "service": "ldap", + "spoofable": 0 } }, "firewallservices/pf-scan-multi_ports": { "path": "scenarios/firewallservices/pf-scan-multi_ports.yaml", - "version": "0.3", + "version": "0.4", "versions": { "0.1": { "digest": "d650a9e64532d14a46dcf5bfc952b0a0eb1825efdb07a179069d9c7f8f185d78", @@ -8356,711 +10438,1136 @@ "0.3": { "digest": "d650a9e64532d14a46dcf5bfc952b0a0eb1825efdb07a179069d9c7f8f185d78", "deprecated": false + }, + "0.4": { + "digest": "a8017247b648a5b731414ea6e7923b12d8da86ae0be535b96aa122ac65653b1f", + "deprecated": false } }, "long_description": "RGV0ZWN0cyBUQ1AgcG9ydCBzY2FuIDogZGV0ZWN0cyBpZiBhIHNpbmdsZSBJUCBhdHRlbXB0cyBjb25uZWN0aW9uIHRvIG1hbnkgZGlmZmVyZW50IHBvcnRzLgoKTGVha3NwZWVkIG9mIDVzLCBjYXBhY2l0eSBvZiAxNS4K", - "content": "dHlwZTogbGVha3kKbmFtZTogZmlyZXdhbGxzZXJ2aWNlcy9wZi1zY2FuLW11bHRpX3BvcnRzCmRlc2NyaXB0aW9uOiAiYmFuIElQcyB0aGF0IGFyZSBzY2FubmluZyB1cyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3BmX2Ryb3AnICYmIGV2dC5NZXRhLnNlcnZpY2UgPT0gJ3RjcCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0LlBhcnNlZC5kc3RfcG9ydApjYXBhY2l0eTogMTUKbGVha3NwZWVkOiA1cwpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiB0Y3AKICB0eXBlOiBzY2FuCiAgcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogbGVha3kKbmFtZTogZmlyZXdhbGxzZXJ2aWNlcy9wZi1zY2FuLW11bHRpX3BvcnRzCmRlc2NyaXB0aW9uOiAiYmFuIElQcyB0aGF0IGFyZSBzY2FubmluZyB1cyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3BmX2Ryb3AnICYmIGV2dC5NZXRhLnNlcnZpY2UgPT0gJ3RjcCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0LlBhcnNlZC5kc3RfcG9ydApjYXBhY2l0eTogMTUKbGVha3NwZWVkOiA1cwpibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiB0Y3AKICBjb25maWRlbmNlOiAxCiAgc3Bvb2ZhYmxlOiAzCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU5NS4wMDEKICAgIC0gYXR0YWNrLlQxMDE4CiAgICAtIGF0dGFjay5UMTA0NgogIGJlaGF2aW9yOiAidGNwOnNjYW4iCiAgbGFiZWw6ICJQRiBTY2FuIE11bHRpIFBvcnRzIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "ban IPs that are scanning us", "author": "firewallservices", "labels": { - "remediation": "true", + "behavior": "tcp:scan", + "classification": [ + "attack.T1595.001", + "attack.T1018", + "attack.T1046" + ], + "confidence": 1, + "label": "PF Scan Multi Ports", + "remediation": true, "service": "tcp", - "type": "scan" + "spoofable": 3 } }, "firewallservices/zimbra-bf": { "path": "scenarios/firewallservices/zimbra-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "20cd0d65ecb94e81c785bbc8117d3cf12333bf0b32f600d14949be7ce21f3a4c", "deprecated": false + }, + "0.2": { + "digest": "f7c711ae8b784fb37120952db8b47815c35c917dc6be49e6818d7a97b1aea379", + "deprecated": false } }, "long_description": "RGV0ZWN0IHZhcmlvdXMgYXV0aGVudGljYXRpb24gZmFpbHVyZXMgb24gWmltYnJhCi0gT24gdGhlIHdlYiBsb2dpbiBwYWdlCi0gT24gdGhlIFNNVFAgc2VydmVyIChTTVRQUyBhbmQgU1VCTUlTU0lPTikKLSBPbiB0aGUgSU1BUCBzZXJ2ZXIKClRoaXMgc2NlbmFyaW8gdXNlcyB0d28gbGVha3kgYnVja2V0czoKLSBsZWFrc3BlZWQgb2YgMzBzLCBjYXBhY2l0eSBvZiA1IChwZXIgY2xpZW50IElQKQotIGxlYWtzcGVlZCBvZiAybSwgY2FwYWNpdHkgb2YgNSwgb24gdW5pcSB0YXJnZXQgdXNlciAocGVyIGNsaWVudCBJUCkK", - "content": "IyBaaW1icmEgYnJ1dGZvcmNlCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBmaXJld2FsbHNlcnZpY2VzL3ppbWJyYS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBaaW1icmEgYnJ1dGVmb3JjZSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnemltYnJhX2F1dGhfZmFpbCcKbGVha3NwZWVkOiAzMHMKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiB6aW1icmEKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgWmltYnJhIHVzZXIgZW51bWVyYXRpb24KdHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGZpcmV3YWxsc2VydmljZXMvemltYnJhLXVzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBaaW1icmEgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3ppbWJyYV9hdXRoX2ZhaWwnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcgpsZWFrc3BlZWQ6IDJtCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IHppbWJyYQogIHR5cGU6IGJydXRlZm9yY2UKICByZW1lZGlhdGlvbjogdHJ1ZQoK", + "content": "IyBaaW1icmEgYnJ1dGZvcmNlCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBmaXJld2FsbHNlcnZpY2VzL3ppbWJyYS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBaaW1icmEgYnJ1dGVmb3JjZSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnemltYnJhX2F1dGhfZmFpbCcKbGVha3NwZWVkOiAzMHMKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiB6aW1icmEKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAicG9wMy9pbWFwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJaaW1icmEgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBaaW1icmEgdXNlciBlbnVtZXJhdGlvbgp0eXBlOiBsZWFreQojZGVidWc6IHRydWUKbmFtZTogZmlyZXdhbGxzZXJ2aWNlcy96aW1icmEtdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFppbWJyYSB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnemltYnJhX2F1dGhfZmFpbCcKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VyCmxlYWtzcGVlZDogMm0KY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogemltYnJhCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1ODkuMDAyCiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAicG9wMy9pbWFwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJaaW1icmEgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect Zimbra bruteforce", "author": "firewallservices", "labels": { - "remediation": "true", + "behavior": "pop3/imap:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Zimbra Bruteforce", + "remediation": true, "service": "zimbra", - "type": "bruteforce" + "spoofable": 0 + } + }, + "firix/authentik-bf": { + "path": "scenarios/firix/authentik-bf.yaml", + "version": "0.1", + "versions": { + "0.1": { + "digest": "f2d5cf9e9fa750c2e3372aebeaf35fe13d56b7e0089dc01a744b6687d1872f3b", + "deprecated": false + } + }, + "long_description": "RGV0ZWN0IGZhaWxlZCBhdXRoZW50aWsgYXV0aGVudGljYXRpb25zOgoKIC0gbGVha3NwZWVkIG9mIDIwcywgY2FwYWNpdHkgb2YgNSBvbiBzYW1lIHRhcmdldCB1c2VyCiAtIGxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDUgdW5pcXVlIGRpc3RpbmN0IHVzZXJzCg==", + "content": "IyBBdXRoZW50aWsgQkYgc2Nhbgp0eXBlOiBsZWFreQpuYW1lOiBmaXJpeC9hdXRoZW50aWstYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgYXV0aGVudGlrIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWydhdXRoZW50aWtfZmFpbGVkX2F1dGgnLCAnYXV0aGVudGlrX2ludmFsaWRfdXNlcm5hbWUnXQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAyMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogYXV0aGVudGlrCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBsYWJlbDogIkF1dGhlbnRpayBCcnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIEF1dGhlbnRpayB1c2VyLWVudW0KdHlwZTogbGVha3kKbmFtZTogZmlyaXgvYXV0aGVudGlrLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBhdXRoZW50aWsgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWydhdXRoZW50aWtfZmFpbGVkX2F1dGgnLCAnYXV0aGVudGlrX2ludmFsaWRfdXNlcm5hbWUnXQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXJuYW1lCmxlYWtzcGVlZDogMTBzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGF1dGhlbnRpawogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgICAtIGF0dGFjay5UMTExMAogIGxhYmVsOiAiQXV0aGVudGlrIFVzZXIgRW51bWVyYXRpb24iCiAgcmVtZWRpYXRpb246IHRydWUgCg==", + "description": "Detect authentik bruteforce", + "author": "firix", + "labels": { + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Authentik Bruteforce", + "remediation": true, + "service": "authentik", + "spoofable": 0 } }, "fulljackz/proxmox-bf": { "path": "scenarios/fulljackz/proxmox-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "0e9371bccf18fdd2195b68c9506182d0958ef4e8a31289d34106fda4b58ccd17", "deprecated": false + }, + "0.2": { + "digest": "b0d36f0ced0f2b05e56c0655a1730181a653796133e0770a72ea5cf71db5cb9e", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBwcm94bW94IGF1dGhlbnRpY2F0aW9ucyA6CgogLSBsZWFrc3BlZWQgb2YgMTBzLCBjYXBhY2l0eSBvZiA1IG9uIHNhbWUgdGFyZ2V0IHVzZXIKIC0gbGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgNSB1bmlxdWUgZGlzdGluY3QgdXNlcnMK", - "content": "IyBQcm94bW94IGF1dGhlbnQgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBmdWxsamFja3ovcHJveG1veC1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBwcm94bW94IGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdwdmVfZmFpbGVkLWF1dGgnIgpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiBzZXJ2aWNlOiBwdmVkYWVtb24KIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIFByb3htb3ggYmFkIHVzZXIKdHlwZTogbGVha3kKbmFtZTogZnVsbGphY2t6L3Byb3htb3gtYmYtdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHByb3htb3ggd3JvbmcgdXNlcm5hbWUiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdwdmVfZmFpbGVkLWF1dGgnIgpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEuc291cmNlX3VzZXIKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogc2VydmljZTogcHZlZGFlbW9uCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyBQcm94bW94IGF1dGhlbnQgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBmdWxsamFja3ovcHJveG1veC1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBwcm94bW94IGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdwdmVfZmFpbGVkLWF1dGgnIgpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQoKbGFiZWxzOgogIHNlcnZpY2U6IHZtLW1hbmFnZW1lbnQKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAidm0tbWFuYWdlbWVudDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiUHZlRGFlbW9uIEJydXRlZm9yY2UiCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgUHJveG1veCBiYWQgdXNlcgp0eXBlOiBsZWFreQpuYW1lOiBmdWxsamFja3ovcHJveG1veC1iZi11c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgcHJveG1veCB3cm9uZyB1c2VybmFtZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3B2ZV9mYWlsZWQtYXV0aCciCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS5zb3VyY2VfdXNlcgpibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgc2VydmljZTogdm0tbWFuYWdlbWVudAogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAidm0tbWFuYWdlbWVudDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiUHZlRGFlbW9uIFVzZXIgRW51bSBCcnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect proxmox bruteforce", "author": "fulljackz", "labels": { - "remediation": "true", - "service": "pvedaemon", - "type": "bruteforce" + "behavior": "vm-management:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "PveDaemon Bruteforce", + "remediation": true, + "service": "vm-management", + "spoofable": 0 } }, "fulljackz/pureftpd-bf": { "path": "scenarios/fulljackz/pureftpd-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "b3d2ff52ddeff8e7bc547565b7d797c7420f4f5dc4cd00181f4a2be28dd56be7", "deprecated": false + }, + "0.2": { + "digest": "36c442c20c6124c19a31fc4e57d2d65e9d1dfd63b59aebda95c3f0846ff9ed16", + "deprecated": false } }, - "content": "IyBQdXJlZnRwZCBhdXRoZW50IGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogZnVsbGphY2t6L3B1cmVmdHBkLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHB1cmVmdHBkIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdwZnRwZF9mYWlsZWQtYXV0aCciCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKIHNlcnZpY2U6ICdwdXJlZnRwZCcKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "IyBQdXJlZnRwZCBhdXRoZW50IGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogZnVsbGphY2t6L3B1cmVmdHBkLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHB1cmVmdHBkIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdwZnRwZF9mYWlsZWQtYXV0aCciCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBmdHAKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiZnRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJQdXJlRlRQRCBCcnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect pureftpd bruteforce", "author": "fulljackz", "labels": { - "remediation": "true", - "service": "pureftpd", - "type": "bruteforce" + "behavior": "ftp:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "PureFTPD Bruteforce", + "remediation": true, + "service": "ftp", + "spoofable": 0 } }, "gauth-fr/immich-bf": { "path": "scenarios/gauth-fr/immich-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "ac8169ad4527ba503533131e47f7ffe26f5c49ac2ffda361217e45c77125c887", "deprecated": false + }, + "0.2": { + "digest": "55a427ed10a711e624975181bdf80a2050238107245f0f0cf954a8d0a91f7244", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBJbW1pY2ggYXV0aGVudGljYXRpb25zOgoKIC0gbGVha3NwZWVkIG9mIDIwcywgY2FwYWNpdHkgb2YgNSBvbiBzYW1lIHRhcmdldCB1c2VyCiAtIGxlYWtzcGVlZCBvZiAxbSwgY2FwYWNpdHkgb2YgNSB1bmlxdWUgZGlzdGluY3QgdXNlcnM=", - "content": "IyBpbW1pY2ggQkYgc2NhbgpuYW1lOiBnYXV0aC1mci9pbW1pY2gtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgaW1taWNoIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdpbW1pY2hfZmFpbGVkX2F1dGgnIgojZGVidWc6IHRydWUKdHlwZTogbGVha3kKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmxlYWtzcGVlZDogIjIwcyIKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogaW1taWNoCiAgdHlwZTogYnJ1dGVmb3JjZQogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIGltbWljaCB1c2VyLWVudW0KdHlwZTogbGVha3kKbmFtZTogIGdhdXRoLWZyL2ltbWljaC1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgaW1taWNoIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnaW1taWNoX2ZhaWxlZF9hdXRoJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VyCmxlYWtzcGVlZDogMTBzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogc2VydmljZTogaW1taWNoCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyBpbW1pY2ggQkYgc2NhbgpuYW1lOiBnYXV0aC1mci9pbW1pY2gtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgaW1taWNoIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdpbW1pY2hfZmFpbGVkX2F1dGgnIgojZGVidWc6IHRydWUKdHlwZTogbGVha3kKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmxlYWtzcGVlZDogIjIwcyIKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogaW1taWNoCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBsYWJlbDogIkltbWljaCBCcnV0ZWZvcmNlIgogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIGltbWljaCB1c2VyLWVudW0KdHlwZTogbGVha3kKbmFtZTogZ2F1dGgtZnIvaW1taWNoLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBpbW1pY2ggdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdpbW1pY2hfZmFpbGVkX2F1dGgnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXIKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogaW1taWNoCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1ODkKICBsYWJlbDogIkltbWljaCBCcnV0ZWZvcmNlIgogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect immich bruteforce", "author": "gauth-fr", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Immich Bruteforce", + "remediation": true, "service": "immich", - "type": "bruteforce" + "spoofable": 0 } }, "hitech95/mail-generic-bf": { "path": "scenarios/hitech95/mail-generic-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "f4dd689cd76dbad62fc1188d106ee58d67e9637398e25f1ee6c4dd56039491c1", "deprecated": false + }, + "0.2": { + "digest": "6240b1295617a293ce14a9e5ccea082a0df0d55259ca01653d423eb6a290c72a", + "deprecated": false } }, "long_description": "QWxlcnQgd2hlbiBhIHNpbmdsZSBJUCB0aGF0IHRyeSB0byBicnV0ZWZvcmNlIGVtYWlsIChTTVRQLCBJTUFQLCBQT1ApIGF1dGguCgogLSBsZWFrc3BlZWQgb2YgMTBzLCBjYXBhY2l0eSBvZiA1IG9uIHNhbWUgaXAKIC0gbGVha3NwZWVkIG9mIDMwcywgY2FwYWNpdHkgb2YgMyBvbiBzYW1lIHRhcmdldCB1c2VyCg==", - "content": "IyBHbG9iYWwgYnJvdXRlZm9yY2UKdHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGhpdGVjaDk1L2VtYWlsLWdlbmVyaWMtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgZ2VuZXJpYyBlbWFpbCBicnV0ZSBmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21haWxfYXV0aCcgJiYgZXZ0Lk1ldGEuc3ViX3R5cGUgPT0gJ2F1dGhfZmFpbCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogNQpsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogMW0KbGFiZWxzOgogc2VydmljZTogZW1haWwKIHR5cGU6IGJmCiByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBQZXIgdXNlciBicm91dGVmb3JjZQp0eXBlOiBsZWFreQojZGVidWc6IHRydWUKbmFtZTogaGl0ZWNoOTUvZW1haWwtdXNlci1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBzcGVjaWZpYyB1c2VyIGVtYWlsIGJydXRlIGZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnbWFpbF9hdXRoJyAmJiBldnQuTWV0YS5zdWJfdHlwZSA9PSAnYXV0aF9mYWlsJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VybmFtZQpjYXBhY2l0eTogMwpsZWFrc3BlZWQ6ICIzMHMiCmJsYWNraG9sZTogMW0KbGFiZWxzOgogc2VydmljZTogZW1haWwKIHR5cGU6IGJmCiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "IyBHbG9iYWwgYnJvdXRlZm9yY2UKdHlwZTogbGVha3kKI2RlYnVnOiB0cnVlCm5hbWU6IGhpdGVjaDk1L2VtYWlsLWdlbmVyaWMtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgZ2VuZXJpYyBlbWFpbCBicnV0ZSBmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21haWxfYXV0aCcgJiYgZXZ0Lk1ldGEuc3ViX3R5cGUgPT0gJ2F1dGhfZmFpbCciCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApjYXBhY2l0eTogNQpsZWFrc3BlZWQ6ICIxMHMiCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IHBvcDMvaW1hcAogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJwb3AzL2ltYXA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIlBPUDMvSU1BUCBCcnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIFBlciB1c2VyIGJyb3V0ZWZvcmNlCnR5cGU6IGxlYWt5CiNkZWJ1ZzogdHJ1ZQpuYW1lOiBoaXRlY2g5NS9lbWFpbC11c2VyLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHNwZWNpZmljIHVzZXIgZW1haWwgYnJ1dGUgZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdtYWlsX2F1dGgnICYmIGV2dC5NZXRhLnN1Yl90eXBlID09ICdhdXRoX2ZhaWwnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXJuYW1lCmNhcGFjaXR5OiAzCmxlYWtzcGVlZDogIjMwcyIKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogcG9wMy9pbWFwCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1ODkuMDAyCiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAicG9wMy9pbWFwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJNYWlsIFVzZXIgRW51bSBCcnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect generic email brute force", "author": "hitech95", "labels": { - "remediation": "true", - "service": "email", - "type": "bf" + "behavior": "pop3/imap:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "POP3/IMAP Bruteforce", + "remediation": true, + "service": "pop3/imap", + "spoofable": 0 } }, "inherent-io/keycloak-bf": { "path": "scenarios/inherent-io/keycloak-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "e49641024ac18c51c5f562e9f1c4a60ec31e0ef0525f5754537bc7ac8a425ddb", "deprecated": false + }, + "0.2": { + "digest": "ae82c46c8629fc58402e4b86bed8b8099c04484fb9acf5d29b5d293690056a15", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBLZXljbG9hayBhdXRoZW50aWNhdGlvbnMgOgoKIC0gbGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgNSBvbiBzYW1lIHRhcmdldCB1c2VyCiAtIGxlYWtzcGVlZCBvZiAxMHMsIGNhcGFjaXR5IG9mIDUgdW5pcXVlIGRpc3RpbmN0IHVzZXJzCg==", - "content": "dHlwZTogbGVha3kKbmFtZTogaW5oZXJlbnQtaW8va2V5Y2xvYWstYmYKZGVzY3JpcHRpb246ICJEZXRlY3Qga2V5Y2xvYWsgYnJ1dGVmb3JjZSIKZmlsdGVyOiBldnQuTWV0YS5lcnJvciBpbiBbJ3VzZXJfbm90X2ZvdW5kJywgJ2ludmFsaWRfdXNlcl9jcmVkZW50aWFscyddCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKIHNlcnZpY2U6IGtleWNsb2FrCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQotLS0KdHlwZTogbGVha3kKbmFtZTogaW5oZXJlbnQtaW8va2V5Y2xvYWstdXNlci1lbnVtLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGtleWNsb2FrIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmVycm9yIGluIFsndXNlcl9ub3RfZm91bmQnLCAnaW52YWxpZF91c2VyX2NyZWRlbnRpYWxzJ10KbGVha3NwZWVkOiAiMTBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXJuYW1lCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKIHNlcnZpY2U6IGtleWNsb2FrCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "dHlwZTogbGVha3kKbmFtZTogaW5oZXJlbnQtaW8va2V5Y2xvYWstYmYKZGVzY3JpcHRpb246ICJEZXRlY3Qga2V5Y2xvYWsgYnJ1dGVmb3JjZSIKZmlsdGVyOiBldnQuTWV0YS5lcnJvciBpbiBbJ3VzZXJfbm90X2ZvdW5kJywgJ2ludmFsaWRfdXNlcl9jcmVkZW50aWFscyddCmxlYWtzcGVlZDogIjEwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBrZXljbG9hawogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgbGFiZWw6ICJLZXljbG9hayBCcnV0ZWZvcmNlIgogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQp0eXBlOiBsZWFreQpuYW1lOiBpbmhlcmVudC1pby9rZXljbG9hay11c2VyLWVudW0tYmYKZGVzY3JpcHRpb246ICJEZXRlY3Qga2V5Y2xvYWsgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEuZXJyb3IgaW4gWyd1c2VyX25vdF9mb3VuZCcsICdpbnZhbGlkX3VzZXJfY3JlZGVudGlhbHMnXQpsZWFrc3BlZWQ6ICIxMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcm5hbWUKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IGtleWNsb2FrCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1ODkKICBsYWJlbDogIktleWNsb2FrIEJydXRlZm9yY2UiCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect keycloak bruteforce", "author": "inherent-io", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Keycloak Bruteforce", + "remediation": true, "service": "keycloak", - "type": "bruteforce" + "spoofable": 0 } }, "inherent-io/keycloak-slow-bf": { "path": "scenarios/inherent-io/keycloak-slow-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "14928e0df7050fa79b4e332f228afc71e287c2a67fefd2c77aab19de99fad70a", "deprecated": false + }, + "0.2": { + "digest": "001444d0fbb4395b81e6caf835e8d7c5dde0fd3818c0b7b70d79264ab6453b04", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBLZXljbG9hayBhdXRoZW50aWNhdGlvbnMgOgoKIC0gbGVha3NwZWVkIG9mIDYwcywgY2FwYWNpdHkgb2YgMTAgb24gc2FtZSB0YXJnZXQgdXNlcgogLSBsZWFrc3BlZWQgb2YgNjBzLCBjYXBhY2l0eSBvZiAxMCB1bmlxdWUgZGlzdGluY3QgdXNlcnMK", - "content": "dHlwZTogbGVha3kKbmFtZTogaW5oZXJlbnQtaW8va2V5Y2xvYWstc2xvdy1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBrZXljbG9hayBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5lcnJvciBpbiBbJ3VzZXJfbm90X2ZvdW5kJywgJ2ludmFsaWRfdXNlcl9jcmVkZW50aWFscyddIgpsZWFrc3BlZWQ6ICI2MHMiCmNhcGFjaXR5OiAxMApncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogc2VydmljZToga2V5Y2xvYWsKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQp0eXBlOiBsZWFreQpuYW1lOiBpbmhlcmVudC1pby9rZXljbG9hay11c2VyLWVudW0tc2xvdy1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBrZXljbG9hayB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEuZXJyb3IgaW4gWyd1c2VyX25vdF9mb3VuZCcsICdpbnZhbGlkX3VzZXJfY3JlZGVudGlhbHMnXSIKbGVha3NwZWVkOiAiNjBzIgpjYXBhY2l0eTogMTAKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VybmFtZQpibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiBzZXJ2aWNlOiBrZXljbG9hawogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUK", + "content": "dHlwZTogbGVha3kKbmFtZTogaW5oZXJlbnQtaW8va2V5Y2xvYWstc2xvdy1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBrZXljbG9hayBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5lcnJvciBpbiBbJ3VzZXJfbm90X2ZvdW5kJywgJ2ludmFsaWRfdXNlcl9jcmVkZW50aWFscyddIgpsZWFrc3BlZWQ6ICI2MHMiCmNhcGFjaXR5OiAxMApncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IGtleWNsb2FrCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBsYWJlbDogIktleWNsb2FrIEJydXRlZm9yY2UiCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCnR5cGU6IGxlYWt5Cm5hbWU6IGluaGVyZW50LWlvL2tleWNsb2FrLXVzZXItZW51bS1zbG93LWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGtleWNsb2FrIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5lcnJvciBpbiBbJ3VzZXJfbm90X2ZvdW5kJywgJ2ludmFsaWRfdXNlcl9jcmVkZW50aWFscyddIgpsZWFrc3BlZWQ6ICI2MHMiCmNhcGFjaXR5OiAxMApncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXJuYW1lCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBrZXljbG9hawogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgbGFiZWw6ICJLZXljbG9hayBCcnV0ZWZvcmNlIgogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect keycloak bruteforce", "author": "inherent-io", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Keycloak Bruteforce", + "remediation": true, "service": "keycloak", - "type": "bruteforce" + "spoofable": 0 } }, "jusabatier/apereo-cas-bf": { "path": "scenarios/jusabatier/apereo-cas-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "d1bf29f3d7bbf0a7bee0a9e0dddc953c9f0cad2ac4f5d6dcefe7d8ae3dc833a6", "deprecated": false + }, + "0.2": { + "digest": "828c0aeff9e1dd41f90b2fb1f83d4d8fb1bd6812045e30f19f772cb4879dbca1", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBDQVMgYXV0aGVudGljYXRpb25zIDoKCiogbGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgNSBvbiBzYW1lIHRhcmdldCB1c2VyCiogbGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgNSB1bmlxdWUgZGlzdGluY3QgdXNlcnMK", - "content": "IyBjYXMgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBqdXNhYmF0aWVyL2FwZXJlby1jYXMtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgQ0FTIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdjYXNfZmFpbGVkLWF1dGgnIgpsZWFrc3BlZWQ6ICIxMHMiCnJlZmVyZW5jZXM6CiAgLSBodHRwOi8vd2lraXBlZGlhLmNvbS9jYXMtYmYtaXMtYmFkCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiBzZXJ2aWNlOiBjYXMKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIGNhcyB1c2VyLWVudW0KdHlwZTogbGVha3kKbmFtZToganVzYWJhdGllci9hcGVyZW8tY2FzLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBDQVMgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2Nhc19mYWlsZWQtYXV0aCcKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS50YXJnZXRfdXNlcgpsZWFrc3BlZWQ6IDEwcwpjYXBhY2l0eTogNQpibGFja2hvbGU6IDFtCmxhYmVsczoKIHNlcnZpY2U6IGNhcwogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUK", + "content": "IyBjYXMgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBqdXNhYmF0aWVyL2FwZXJlby1jYXMtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgQ0FTIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdjYXNfZmFpbGVkLWF1dGgnIgpsZWFrc3BlZWQ6ICIxMHMiCnJlZmVyZW5jZXM6CiAgLSBodHRwOi8vd2lraXBlZGlhLmNvbS9jYXMtYmYtaXMtYmFkCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJDQVMgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBjYXMgdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6IGp1c2FiYXRpZXIvYXBlcmVvLWNhcy1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgQ0FTIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdjYXNfZmFpbGVkLWF1dGgnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudGFyZ2V0X3VzZXIKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiQ0FTIFVzZXIgRW51bSBCcnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect CAS bruteforce", "author": "jusabatier", "references": [ "http://wikipedia.com/cas-bf-is-bad" ], "labels": { - "remediation": "true", - "service": "cas", - "type": "bruteforce" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "CAS Bruteforce", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "jusabatier/apereo-cas-slow-bf": { "path": "scenarios/jusabatier/apereo-cas-slow-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "4bcde74a3f00abede206b5821669531c8ebfbf80b79530414050bfd3ccbfc6f9", "deprecated": false + }, + "0.2": { + "digest": "272deed2d9f9f5e4a49364246a92c1cd826daa49d77717de71b9e5688059f87e", + "deprecated": false } }, "long_description": "RGV0ZWN0IHNsb3cgQ0FTIGJydXRlZm9yY2UgYXV0aGVudGljYXRpb25zIDoKCiogbGVha3NwZWVkIG9mIDYwcywgY2FwYWNpdHkgb2YgMTAgb24gc2FtZSB0YXJnZXQgdXNlcgoqIGxlYWtzcGVlZCBvZiA2MHMsIGNhcGFjaXR5IG9mIDEwIHVuaXF1ZSBkaXN0aW5jdCB1c2Vycwo=", - "content": "IyBDQVMgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBqdXNhYmF0aWVyL2Nhcy1zbG93LWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHNsb3cgQ0FTIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdjYXNfZmFpbGVkLWF1dGgnIgpsZWFrc3BlZWQ6ICI2MHMiCnJlZmVyZW5jZXM6CiAgLSBodHRwOi8vd2lraXBlZGlhLmNvbS9jYXMtYmYtaXMtYmFkCmNhcGFjaXR5OiAxMApncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogc2VydmljZTogY2FzCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBjYXMgdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6IGp1c2FiYXRpZXIvY2FzLXNsb3ctYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHNsb3cgQ0FTIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdjYXNfZmFpbGVkLWF1dGgnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudGFyZ2V0X3VzZXIKbGVha3NwZWVkOiA2MHMKY2FwYWNpdHk6IDEwCmJsYWNraG9sZTogMW0KbGFiZWxzOgogc2VydmljZTogY2FzCiB0eXBlOiBicnV0ZWZvcmNlCiByZW1lZGlhdGlvbjogdHJ1ZQo=", + "content": "IyBDQVMgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBqdXNhYmF0aWVyL2Nhcy1zbG93LWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHNsb3cgQ0FTIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdjYXNfZmFpbGVkLWF1dGgnIgpsZWFrc3BlZWQ6ICI2MHMiCnJlZmVyZW5jZXM6CiAgLSBodHRwOi8vd2lraXBlZGlhLmNvbS9jYXMtYmYtaXMtYmFkCmNhcGFjaXR5OiAxMApncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiQ0FTIFNsb3cgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBjYXMgdXNlci1lbnVtCnR5cGU6IGxlYWt5Cm5hbWU6IGp1c2FiYXRpZXIvY2FzLXNsb3ctYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHNsb3cgQ0FTIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdjYXNfZmFpbGVkLWF1dGgnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudGFyZ2V0X3VzZXIKbGVha3NwZWVkOiA2MHMKY2FwYWNpdHk6IDEwCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU4OQogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIkNBUyBTbG93IFVzZXIgRW51bSBCcnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect slow CAS bruteforce", "author": "jusabatier", "references": [ "http://wikipedia.com/cas-bf-is-bad" ], "labels": { - "remediation": "true", - "service": "cas", - "type": "bruteforce" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "CAS Slow Bruteforce", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "jusabatier/cas-slow-bf": { "path": "scenarios/jusabatier/cas-slow-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "6279c83e01b94e7d87271e16118d6b06be9662873c941884a12038fa7adc76c1", "deprecated": false + }, + "0.2": { + "digest": "49a43e695621ca9c777d8825d67a7354da4012d94320740c39adf786d76b9028", + "deprecated": false } }, - "content": "IyBDQVMgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBqdXNhYmF0aWVyL2FwZXJlby1jYXMtc2xvdy1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBzbG93IENBUyBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnY2FzX2ZhaWxlZC1hdXRoJyIKbGVha3NwZWVkOiAiNjBzIgpyZWZlcmVuY2VzOgogIC0gaHR0cDovL3dpa2lwZWRpYS5jb20vY2FzLWJmLWlzLWJhZApjYXBhY2l0eTogMTAKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKIHNlcnZpY2U6IGNhcwogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUKLS0tCiMgY2FzIHVzZXItZW51bQp0eXBlOiBsZWFreQpuYW1lOiBqdXNhYmF0aWVyL2FwZXJlby1jYXMtc2xvdy1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3Qgc2xvdyBDQVMgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2Nhc19mYWlsZWQtYXV0aCcKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS50YXJnZXRfdXNlcgpsZWFrc3BlZWQ6IDYwcwpjYXBhY2l0eTogMTAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiBzZXJ2aWNlOiBjYXMKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "IyBDQVMgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBqdXNhYmF0aWVyL2FwZXJlby1jYXMtc2xvdy1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBzbG93IENBUyBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnY2FzX2ZhaWxlZC1hdXRoJyIKbGVha3NwZWVkOiAiNjBzIgpyZWZlcmVuY2VzOgogIC0gaHR0cDovL3dpa2lwZWRpYS5jb20vY2FzLWJmLWlzLWJhZApjYXBhY2l0eTogMTAKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBodHRwCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICAgIC0gYXR0YWNrLlQxNTk1CiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJBcGVyZW8gQ0FTIEJydXRlZm9yY2UiCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgY2FzIHVzZXItZW51bQp0eXBlOiBsZWFreQpuYW1lOiBqdXNhYmF0aWVyL2FwZXJlby1jYXMtc2xvdy1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3Qgc2xvdyBDQVMgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2Nhc19mYWlsZWQtYXV0aCcKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS50YXJnZXRfdXNlcgpsZWFrc3BlZWQ6IDYwcwpjYXBhY2l0eTogMTAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgICAtIGF0dGFjay5UMTU5NQogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiQXBlcmVvIENBUyBTbG93IFVzZXIgRW51bSBCcnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect slow CAS bruteforce", "author": "jusabatier", "references": [ "http://wikipedia.com/cas-bf-is-bad" ], "labels": { - "remediation": "true", - "service": "cas", - "type": "bruteforce" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110", + "attack.T1595" + ], + "confidence": 3, + "label": "Apereo CAS Bruteforce", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "lourys/pterodactyl-wings-bf": { "path": "scenarios/lourys/pterodactyl-wings-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "05da99b5df02bed22d6627edd06897404a53ed13f9033b79cdf7b9cc21538cbe", "deprecated": false + }, + "0.2": { + "digest": "4837e97a679e794ebd2d2a90028a2c649748a5ffbf1a27c286b799214bc40222", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBwdGVyb2RhY3R5bCB3aW5ncyBhdXRoZW50aWNhdGlvbnM6CgpJbnZhbGlkIGZvcm1hdDoKLSBsZWFrc3BlZWQgb2YgMTVzLCBjYXBhY2l0eSBvZiAxIG9uIHNhbWUgdGFyZ2V0IHVzZXIKLSBsZWFrc3BlZWQgb2YgMTVzLCBjYXBhY2l0eSBvZiAxIHVuaXF1ZSBkaXN0aW5jdCB1c2VycwoKSW52YWxpZCB1c2VybmFtZS9wYXNzd29yZDoKLSBsZWFrc3BlZWQgb2YgMTVzLCBjYXBhY2l0eSBvZiAz", - "content": "IyMjIyMjIyMjIyMjIyMjIyMjIyMKIyMgSW52YWxpZCBmb3JtYXQgIyMKIyMjIyMjIyMjIyMjIyMjIyMjIyMKdHlwZTogbGVha3kKbmFtZTogbG91cnlzL3B0ZXJvZGFjdHlsLXdpbmdzLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGludmFsaWRfZm9ybWF0IHNzaCBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAncHRlcm9kYWN0bHlfd2luZ3NfaW52YWxpZF9mb3JtYXQnIgpsZWFrc3BlZWQ6ICIxNXMiCmNhcGFjaXR5OiAxCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDE1bQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogc2VydmljZTogcHRlcm9kYWN0eWwKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQp0eXBlOiBsZWFreQpuYW1lOiBsb3VyeXMvcHRlcm9kYWN0eWwtd2luZ3MtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgaW52YWxpZF9mb3JtYXQgc3NoIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdwdGVyb2RhY3RseV93aW5nc19pbnZhbGlkX2Zvcm1hdCcKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS50YXJnZXRfdXNlcgpsZWFrc3BlZWQ6IDE1cwpjYXBhY2l0eTogMQpibGFja2hvbGU6IDE1bQpsYWJlbHM6CiBzZXJ2aWNlOiBwdGVyb2RhY3R5bAogdHlwZTogYnJ1dGVmb3JjZQogcmVtZWRpYXRpb246IHRydWUKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyMgSW52YWxpZCB1c2VybmFtZS9wYXNzd29yZCAjIwojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCi0tLQp0eXBlOiBsZWFreQpuYW1lOiBsb3VyeXMvcHRlcm9kYWN0eWwtd2luZ3MtYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgaW52YWxpZF91c2VybmFtZV9vcl9wYXNzd29yZCBzc2ggYnJ1dGVmb3JjZSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAncHRlcm9kYWN0bHlfd2luZ3NfaW52YWxpZF91c2VybmFtZV9vcl9wYXNzd29yZCcKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmxlYWtzcGVlZDogMTBzCmNhcGFjaXR5OiA1CmJsYWNraG9sZTogMW0KbGFiZWxzOgogc2VydmljZTogcHRlcm9kYWN0eWwKIHR5cGU6IGJydXRlZm9yY2UKIHJlbWVkaWF0aW9uOiB0cnVlCgo=", + "content": "IyMjIyMjIyMjIyMjIyMjIyMjIyMKIyMgSW52YWxpZCBmb3JtYXQgIyMKIyMjIyMjIyMjIyMjIyMjIyMjIyMKdHlwZTogbGVha3kKbmFtZTogbG91cnlzL3B0ZXJvZGFjdHlsLXdpbmdzLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGludmFsaWRfZm9ybWF0IHNzaCBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAncHRlcm9kYWN0bHlfd2luZ3NfaW52YWxpZF9mb3JtYXQnIgpsZWFrc3BlZWQ6ICIxNXMiCmNhcGFjaXR5OiAxCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDE1bQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IHB0ZXJvZGFjdHlsCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDEKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIlB0ZXJvZGFjdHlsIFdpbmcgYnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KdHlwZTogbGVha3kKbmFtZTogbG91cnlzL3B0ZXJvZGFjdHlsLXdpbmdzLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGludmFsaWRfZm9ybWF0IHNzaCB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAncHRlcm9kYWN0bHlfd2luZ3NfaW52YWxpZF9mb3JtYXQnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudGFyZ2V0X3VzZXIKbGVha3NwZWVkOiAxNXMKY2FwYWNpdHk6IDEKYmxhY2tob2xlOiAxNW0KbGFiZWxzOgogIHNlcnZpY2U6IHB0ZXJvZGFjdHlsCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTA4NwogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDEKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIlB0ZXJvZGFjdHlsIFdpbmcgYnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQoKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIyBJbnZhbGlkIHVzZXJuYW1lL3Bhc3N3b3JkICMjCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKLS0tCnR5cGU6IGxlYWt5Cm5hbWU6IGxvdXJ5cy9wdGVyb2RhY3R5bC13aW5ncy1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBpbnZhbGlkX3VzZXJuYW1lX29yX3Bhc3N3b3JkIHNzaCBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdwdGVyb2RhY3RseV93aW5nc19pbnZhbGlkX3VzZXJuYW1lX29yX3Bhc3N3b3JkJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKbGVha3NwZWVkOiAxMHMKY2FwYWNpdHk6IDUKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogcHRlcm9kYWN0eWwKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiUHRlcm9kYWN0eWwgV2luZyBicnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect invalid_format ssh bruteforce", "author": "lourys", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 1, + "label": "Pterodactyl Wing bruteforce", + "remediation": true, "service": "pterodactyl", - "type": "bruteforce" + "spoofable": 0 } }, "ltsich/http-w00tw00t": { "path": "scenarios/ltsich/http-w00tw00t.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "f0cba1520658a1016e9d1952473fa9e78175deef2117d2b921e7d994a6e7a549", "deprecated": false + }, + "0.2": { + "digest": "6327526c8c38490c33a5441ad144d35ad3bfc49b309194b2c437a178cf95908b", + "deprecated": false } }, "long_description": "dHJpZ2dlciBzY2VuYXJpbyB0byBkZXRlY3QgdzAwdHcwMHQgcGF0dGVybiB1c2VkIGJ5IGh0dHAgdnVsbmVyYWJpbGl0eSBzY2FubmVyLCBzZWUgW3RoaXMgcmVzc291cmNlXShodHRwczovL2lzYy5zYW5zLmVkdS9mb3J1bXMvZGlhcnkvdzAwdHcwMHQvOTAwLykKCj4gQ29udHJpYnV0ZWQgYnkgaHR0cHM6Ly9naXRodWIuY29tL0x0U2ljaAo=", - "content": "I2NvbnRyaWJ1dGVkIGJ5IGx0c2ljaAp0eXBlOiB0cmlnZ2VyCm5hbWU6IGx0c2ljaC9odHRwLXcwMHR3MDB0CmRlc2NyaXB0aW9uOiAiZGV0ZWN0IHcwMHR3MDB0IgpkZWJ1ZzogZmFsc2UKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2h0dHBfYWNjZXNzLWxvZycgJiYgZXZ0LlBhcnNlZC5maWxlX25hbWUgY29udGFpbnMgJ3cwMHR3MDB0LmF0LklTQy5TQU5TLkRGaW5kJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KbGFiZWxzOgogc2VydmljZTogaHR0cAogdHlwZTogc2NhbgogcmVtZWRpYXRpb246IHRydWUK", + "content": "I2NvbnRyaWJ1dGVkIGJ5IGx0c2ljaAp0eXBlOiB0cmlnZ2VyCm5hbWU6IGx0c2ljaC9odHRwLXcwMHR3MDB0CmRlc2NyaXB0aW9uOiAiZGV0ZWN0IHcwMHR3MDB0IgpkZWJ1ZzogZmFsc2UKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2h0dHBfYWNjZXNzLWxvZycgJiYgZXZ0LlBhcnNlZC5maWxlX25hbWUgY29udGFpbnMgJ3cwMHR3MDB0LmF0LklTQy5TQU5TLkRGaW5kJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1CiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGJlaGF2aW9yOiAiaHR0cDpzY2FuIgogIGxhYmVsOiAidzAwdCB3MDB0IFNjYW5uZXIiCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "detect w00tw00t", "author": "ltsich", "labels": { - "remediation": "true", + "behavior": "http:scan", + "classification": [ + "attack.T1595" + ], + "confidence": 3, + "label": "w00t w00t Scanner", + "remediation": true, "service": "http", - "type": "scan" + "spoofable": 0 } }, "mstilkerich/bind9-refused": { "path": "scenarios/mstilkerich/bind9-refused.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "16ff798ce0bde3b31c91eed4d3b022b70ccbe723579ab80ac889880058a50d20", "deprecated": false + }, + "0.2": { + "digest": "a7567674f1b50c578195fa8e6a95c99e9573598c63720c8ae3b585ff492aa91e", + "deprecated": false } }, "long_description": "RGV0ZWN0IEFYRlIgcmVxdWVzdHMgYW5kIEROUyBxdWVyaWVzIHJlamVjdGVkIGJ5IGJpbmQ5IHNlY3VyaXR5IHBvbGljeToKIC0gbGVha3NwZWVkIG9mIDEwcywgY2FwYWNpdHkgb2YgNSBvbiBzb3VyY2UgaXAK", - "content": "dHlwZTogbGVha3kKbmFtZTogbXN0aWxrZXJpY2gvYmluZDktcmVmdXNlZApkZXNjcmlwdGlvbjogIkFjdCBvbiBxdWVyaWVzIC8gem9uZSB0cmFuc2ZlcnMgZGVuaWVkIGJ5IGJpbmQ5IHBvbGljeSIKZGVidWc6IGZhbHNlCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdiaW5kOV9kZW5pZWQnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAxMHMKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogYmluZDkKICB0eXBlOiBzY2FuCiAgIyByZW1lZGlhdGlvbiBsYWJlbCwgaWYgc2V0IHRvIHRydWUgaW5kaWNhdGUgSVAgc2hvdWxkIGJlIGJhbm5lZAogIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "dHlwZTogbGVha3kKbmFtZTogbXN0aWxrZXJpY2gvYmluZDktcmVmdXNlZApkZXNjcmlwdGlvbjogIkFjdCBvbiBxdWVyaWVzIC8gem9uZSB0cmFuc2ZlcnMgZGVuaWVkIGJ5IGJpbmQ5IHBvbGljeSIKZGVidWc6IGZhbHNlCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdiaW5kOV9kZW5pZWQnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKY2FwYWNpdHk6IDUKbGVha3NwZWVkOiAxMHMKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogZG9tYWluCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU5MC4wMDIKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgYmVoYXZpb3I6ICJnZW5lcmljOnNjYW4iCiAgbGFiZWw6ICJEb21haW4gdHJhbnNmZXIgYXR0ZW1wdCIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Act on queries / zone transfers denied by bind9 policy", "author": "mstilkerich", "labels": { - "remediation": "true", - "service": "bind9", - "type": "scan" + "behavior": "generic:scan", + "classification": [ + "attack.T1590.002" + ], + "confidence": 3, + "label": "Domain transfer attempt", + "remediation": true, + "service": "domain", + "spoofable": 0 } }, "mwinters-stuff/mailu-admin-bf": { "path": "scenarios/mwinters-stuff/mailu-admin-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "f5f64aea87e23bec59055bd1d701aa190de5c77edb2b8b23baf98176ff544515", "deprecated": false + }, + "0.2": { + "digest": "67f3eb683565052c8d13cb3cac78d34e79895310a97a3bc487a4db016627f386", + "deprecated": false } }, "long_description": "RGV0ZWN0cyB0aGUgYnJ1dGUgZm9yY2UgYXR0YWNrcyBvbiB0aGUgbWFpbHUgYWRtaW4gY29udGFpbmVyLg==", - "content": "IyBtYWlsdS1hZG1pbiBicnV0ZWZvcmNlCnR5cGU6IHRyaWdnZXIKIyBkZWJ1ZzogdHJ1ZQpuYW1lOiBtd2ludGVycy1zdHVmZi9tYWlsdS1hZG1pbi1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBtYWlsdSBhZG1pbiBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdtYWlsdV9hZG1pbl9hdXRoX2F0dGVtcHQnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCiMgcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBtYWlsdS1hZG1pbgogIHR5cGU6IGJydXRlZm9yY2UKICByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "IyBtYWlsdS1hZG1pbiBicnV0ZWZvcmNlCnR5cGU6IHRyaWdnZXIKIyBkZWJ1ZzogdHJ1ZQpuYW1lOiBtd2ludGVycy1zdHVmZi9tYWlsdS1hZG1pbi1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBtYWlsdSBhZG1pbiBicnV0ZWZvcmNlIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdtYWlsdV9hZG1pbl9hdXRoX2F0dGVtcHQnCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCiMgcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBodHRwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMC4wMDEKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJNYWlsdSB3ZWIgYWRtaW4gYXV0aGVudGljYXRpb24gYXR0ZW1wdCIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect mailu admin bruteforce", "author": "mwinters-stuff", "labels": { - "remediation": "true", - "service": "mailu-admin", - "type": "bruteforce" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110.001" + ], + "confidence": 3, + "label": "Mailu web admin authentication attempt", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-bot-protection": { "path": "scenarios/openappsec/openappsec-bot-protection.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "359fa8bc8cbcba17f082b9dd0ff714bee45f7b4f1428a81bddfc98d7d379e8be", "deprecated": false + }, + "0.2": { + "digest": "131dcf6809a4df02095cb2f1ad9cf85372b4b318823a63ef1a817a440652c91b", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWJvdC1wcm90ZWN0aW9uCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG9wZW5hcHBzZWMgJ3ByZXZlbnQnIHNlY3VyaXR5QWN0aW9ucyBvbiAnQm90IFByb3RlY3Rpb24nIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ2JvdCBwcm90ZWN0aW9uJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWJvdC1wcm90ZWN0aW9uCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG9wZW5hcHBzZWMgJ3ByZXZlbnQnIHNlY3VyaXR5QWN0aW9ucyBvbiAnQm90IFByb3RlY3Rpb24nIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ2JvdCBwcm90ZWN0aW9uJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMgogIGJlaGF2aW9yOiAiaHR0cDpzcGFtIgogIGxhYmVsOiAiT3BlbmFwcHNlYyAnQm90IFByb3RlY3Rpb24nIGRldGVjdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect openappsec 'prevent' securityActions on 'Bot Protection' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:spam", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 2, + "label": "Openappsec 'Bot Protection' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-cross-site-redirect": { "path": "scenarios/openappsec/openappsec-cross-site-redirect.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "1d6a3d6144b9c31b384161674f4d6aa9f19ac200c5e8f608539a8d0f4a316f6b", "deprecated": false + }, + "0.2": { + "digest": "883d8ef5392e68b80b4ee7ebb9ac34f087069f077a46fbe48433871c0ed9dc8f", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWNyb3NzLXNpdGUtcmVkaXJlY3QKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdDcm9zcyBTaXRlIFJlZGlyZWN0JyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdjcm9zcyBzaXRlIHJlZGlyZWN0Jwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWNyb3NzLXNpdGUtcmVkaXJlY3QKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdDcm9zcyBTaXRlIFJlZGlyZWN0JyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdjcm9zcyBzaXRlIHJlZGlyZWN0Jwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1NjYKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAyCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJPcGVuYXBwc2VjICdjcm9zcyBzaXRlIHJlZGlyZWN0JyBkZXRlY3Rpb24iCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect openappsec 'prevent' securityActions on 'Cross Site Redirect' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1566" + ], + "confidence": 2, + "label": "Openappsec 'cross site redirect' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-csrf": { "path": "scenarios/openappsec/openappsec-csrf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "0ba2cee3113519c489e5a59ca436a776acb6039a6feae4b96ac1ae9b80bc17ff", "deprecated": false + }, + "0.2": { + "digest": "9a0e799668d2feac96fbdee3195657c5f53d42036bb9c356639b662045a1a122", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWNzcmYKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdDcm9zcyBTaXRlIFJlcXVlc3QgRm9yZ2VyeScgZXZlbnRzICh3aGVuIHdhZiBibG9ja3MgbWFsaWNpb3VzIHJlcXVlc3QpIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdvcGVuYXBwc2VjX3NlY3VyaXR5X2xvZycgYW5kIExvd2VyKGV2dC5NZXRhLnNlY3VyaXR5X2FjdGlvbikgaW4gWydwcmV2ZW50JywgJ2RldGVjdCddIGFuZCBMb3dlcihldnQuTWV0YS5pbmNpZGVudF90eXBlKSBjb250YWlucyAnY3Jvc3Mgc2l0ZSByZXF1ZXN0IGZvcmdlcnknCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IG9wZW5hcHBzZWMKIHR5cGU6IGV4cGxvaXQKIHJlbWVkaWF0aW9uOiB0cnVl", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWNzcmYKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdDcm9zcyBTaXRlIFJlcXVlc3QgRm9yZ2VyeScgZXZlbnRzICh3aGVuIHdhZiBibG9ja3MgbWFsaWNpb3VzIHJlcXVlc3QpIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdvcGVuYXBwc2VjX3NlY3VyaXR5X2xvZycgYW5kIExvd2VyKGV2dC5NZXRhLnNlY3VyaXR5X2FjdGlvbikgaW4gWydwcmV2ZW50JywgJ2RldGVjdCddIGFuZCBMb3dlcihldnQuTWV0YS5pbmNpZGVudF90eXBlKSBjb250YWlucyAnY3Jvc3Mgc2l0ZSByZXF1ZXN0IGZvcmdlcnknCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKICBzZXJ2aWNlOiBodHRwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTE4OQogIGNvbmZpZGVuY2U6IDIKICBzcG9vZmFibGU6IDAKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBsYWJlbDogIk9wZW5hcHBzZWMgJ2Nyb3NzIHNpdGUgcmVxdWVzdCBmb3JnZXJ5JyBkZXRlY3Rpb24iCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect openappsec 'prevent' securityActions on 'Cross Site Request Forgery' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1189" + ], + "confidence": 2, + "label": "Openappsec 'cross site request forgery' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-error-disclosure": { "path": "scenarios/openappsec/openappsec-error-disclosure.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "f80c4a142337e7282fcd356b7fd8163d9bd5931ef0f118b33a03529042599d23", "deprecated": false + }, + "0.2": { + "digest": "fc81a79b1c8063f5b63381c211294e3793e8072fc871e208b1fcc62800904d34", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWVycm9yLWRpc2Nsb3N1cmUKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdFcnJvciBEaXNjbG9zdXJlJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdlcnJvciBkaXNjbG9zdXJlJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWVycm9yLWRpc2Nsb3N1cmUKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdFcnJvciBEaXNjbG9zdXJlJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdlcnJvciBkaXNjbG9zdXJlJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgc3Bvb2ZhYmxlOiAxCiAgY29uZmlkZW5jZTogMQogIGJlaGF2aW9yOiAiaHR0cDpzY2FuIgogIGxhYmVsOiAiT3BlbmFwcHNlYyAnZXJyb3IgZGlzY2xvc3VyZScgZGV0ZWN0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect openappsec 'prevent' securityActions on 'Error Disclosure' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:scan", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 1, + "label": "Openappsec 'error disclosure' detection", + "remediation": true, + "service": "http", + "spoofable": 1 } }, "openappsec/openappsec-error-limit": { "path": "scenarios/openappsec/openappsec-error-limit.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "dadb5af9a8635ad6e0194fd8a879b8ef7a8b17f24f4eb451096274a2fc173a6e", "deprecated": false + }, + "0.2": { + "digest": "890e27e4725874b45aa18a0df5e1e83a7621bdb2bb3a9c073ba085844d8a8012", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWVycm9yLWxpbWl0CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG9wZW5hcHBzZWMgJ3ByZXZlbnQnIHNlY3VyaXR5QWN0aW9ucyBvbiAnRXJyb3IgTGltaXQnIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ2Vycm9yIGxpbWl0Jwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWVycm9yLWxpbWl0CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG9wZW5hcHBzZWMgJ3ByZXZlbnQnIHNlY3VyaXR5QWN0aW9ucyBvbiAnRXJyb3IgTGltaXQnIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ2Vycm9yIGxpbWl0Jwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgc3Bvb2ZhYmxlOiAxCiAgY29uZmlkZW5jZTogMQogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiT3BlbmFwcHNlYyAnZXJyb3IgbGltaXQnIGRldGVjdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect openappsec 'prevent' securityActions on 'Error Limit' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 1, + "label": "Openappsec 'error limit' detection", + "remediation": true, + "service": "http", + "spoofable": 1 } }, "openappsec/openappsec-evasion-techniques": { "path": "scenarios/openappsec/openappsec-evasion-techniques.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "65dba84b391cef5817a1d6ce4e15335f9dfb9494ee95818c43dcf56069b39800", "deprecated": false + }, + "0.2": { + "digest": "d3561fcdcec8f943aa5bbeb7d5b8c80b782c71ad70b6891f570b050e70954956", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWV2YXNpb24tdGVjaG5pcXVlcwpkZXNjcmlwdGlvbjogIkRldGVjdCBvcGVuYXBwc2VjICdwcmV2ZW50JyBzZWN1cml0eUFjdGlvbnMgb24gJ0V2YXNpb24gVGVjaG5pcXVlcycgZXZlbnRzICh3aGVuIHdhZiBibG9ja3MgbWFsaWNpb3VzIHJlcXVlc3QpIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdvcGVuYXBwc2VjX3NlY3VyaXR5X2xvZycgYW5kIExvd2VyKGV2dC5NZXRhLnNlY3VyaXR5X2FjdGlvbikgaW4gWydwcmV2ZW50JywgJ2RldGVjdCddIGFuZCBMb3dlcihldnQuTWV0YS5pbmNpZGVudF90eXBlKSBjb250YWlucyAnZXZhc2lvbiB0ZWNobmlxdWVzJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWV2YXNpb24tdGVjaG5pcXVlcwpkZXNjcmlwdGlvbjogIkRldGVjdCBvcGVuYXBwc2VjICdwcmV2ZW50JyBzZWN1cml0eUFjdGlvbnMgb24gJ0V2YXNpb24gVGVjaG5pcXVlcycgZXZlbnRzICh3aGVuIHdhZiBibG9ja3MgbWFsaWNpb3VzIHJlcXVlc3QpIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdvcGVuYXBwc2VjX3NlY3VyaXR5X2xvZycgYW5kIExvd2VyKGV2dC5NZXRhLnNlY3VyaXR5X2FjdGlvbikgaW4gWydwcmV2ZW50JywgJ2RldGVjdCddIGFuZCBMb3dlcihldnQuTWV0YS5pbmNpZGVudF90eXBlKSBjb250YWlucyAnZXZhc2lvbiB0ZWNobmlxdWVzJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMQogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiT3BlbmFwcHNlYyAnRXZhc2lvbiBUZWNobmlxdWVzJyBkZXRlY3Rpb24iCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect openappsec 'prevent' securityActions on 'Evasion Techniques' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 1, + "label": "Openappsec 'Evasion Techniques' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-general": { "path": "scenarios/openappsec/openappsec-general.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "957a11028e7acc2818e6211a8e694fcc23456e158de5c4a68b839a497d61bc08", "deprecated": false + }, + "0.2": { + "digest": "dab3b58b3a506b4b562b7ef3963a14076c9bc48ef29426bd30a0e19bb7cbecdb", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWdlbmVyYWwKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdHZW5lcmFsJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdnZW5lcmFsJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWdlbmVyYWwKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdHZW5lcmFsJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdnZW5lcmFsJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMQogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiT3BlbmFwcHNlYyAnZ2VuZXJhbCcgZGV0ZWN0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect openappsec 'prevent' securityActions on 'General' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 1, + "label": "Openappsec 'general' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-http-limit-violation": { "path": "scenarios/openappsec/openappsec-http-limit-violation.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "fb6955f977a48384eaf944a3fa22f197ceb7cd997dc6d871ac8adb0af23b4642", "deprecated": false + }, + "0.2": { + "digest": "2050cb2b8128ea8ce53cdc4fa1e43500ef9f11305ee4856a11801044e9f5644e", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWh0dHAtbGltaXQtdmlvbGF0aW9uCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG9wZW5hcHBzZWMgJ3ByZXZlbnQnIHNlY3VyaXR5QWN0aW9ucyBvbiAnSHR0cCBsaW1pdCB2aW9sYXRpb24nIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ2h0dHAgbGltaXQgdmlvbGF0aW9uJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWh0dHAtbGltaXQtdmlvbGF0aW9uCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG9wZW5hcHBzZWMgJ3ByZXZlbnQnIHNlY3VyaXR5QWN0aW9ucyBvbiAnSHR0cCBsaW1pdCB2aW9sYXRpb24nIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ2h0dHAgbGltaXQgdmlvbGF0aW9uJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMQogIGJlaGF2aW9yOiAiaHR0cDpzcGFtIgogIGxhYmVsOiAiT3BlbmFwcHNlYyAnaHR0cCBsaW1pdCB2aW9sYXRpb24nIGRldGVjdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect openappsec 'prevent' securityActions on 'Http limit violation' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:spam", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 1, + "label": "Openappsec 'http limit violation' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-http-method-violation": { "path": "scenarios/openappsec/openappsec-http-method-violation.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "1111724d5182ee0e33d275633b9e5230bfab7956f06cda6348593f6eace2df6f", "deprecated": false + }, + "0.2": { + "digest": "f4ca829b97b0ee227fd90be71be8fd475eb63f791452ca634ff233e3085530a3", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWh0dHAtbWV0aG9kLXZpb2xhdGlvbgpkZXNjcmlwdGlvbjogIkRldGVjdCBvcGVuYXBwc2VjICdwcmV2ZW50JyBzZWN1cml0eUFjdGlvbnMgb24gJ0lsbGVnYWwgaHR0cCBtZXRob2QgdmlvbGF0aW9uJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdpbGxlZ2FsIGh0dHAgbWV0aG9kIHZpb2xhdGlvbicKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KbGFiZWxzOgogc2VydmljZTogb3BlbmFwcHNlYwogdHlwZTogZXhwbG9pdAogcmVtZWRpYXRpb246IHRydWU=", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWh0dHAtbWV0aG9kLXZpb2xhdGlvbgpkZXNjcmlwdGlvbjogIkRldGVjdCBvcGVuYXBwc2VjICdwcmV2ZW50JyBzZWN1cml0eUFjdGlvbnMgb24gJ0lsbGVnYWwgaHR0cCBtZXRob2QgdmlvbGF0aW9uJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdpbGxlZ2FsIGh0dHAgbWV0aG9kIHZpb2xhdGlvbicKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTk1CiAgICAtIGF0dGFjay5UMTE5MAogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBsYWJlbDogIk9wZW5hcHBzZWMgJ2lsbGVnYWwgaHR0cCBtZXRob2QgdmlvbGF0aW9uJyBkZXRlY3Rpb24iCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect openappsec 'prevent' securityActions on 'Illegal http method violation' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 3, + "label": "Openappsec 'illegal http method violation' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-ldap-injection": { "path": "scenarios/openappsec/openappsec-ldap-injection.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "37056e311beb6d0213db74c273774e30a978d490dc3af7c15db3ec5df20ca752", "deprecated": false + }, + "0.2": { + "digest": "042aff245e25ab509b7f578848a97cd2131abe492636126006e323d63b1dd0b3", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgpkZWJ1ZzogZmFsc2UKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWxkYXAtaW5qZWN0aW9uCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG9wZW5hcHBzZWMgJ3ByZXZlbnQnIHNlY3VyaXR5QWN0aW9ucyBvbiAnTERBUCBJbmplY3Rpb24nIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ2xkYXAgaW5qZWN0aW9uJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgpkZWJ1ZzogZmFsc2UKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLWxkYXAtaW5qZWN0aW9uCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG9wZW5hcHBzZWMgJ3ByZXZlbnQnIHNlY3VyaXR5QWN0aW9ucyBvbiAnTERBUCBJbmplY3Rpb24nIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ2xkYXAgaW5qZWN0aW9uJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMgogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiT3BlbmFwcHNlYyAnbGRhcCBpbmplY3Rpb24nIGRldGVjdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect openappsec 'prevent' securityActions on 'LDAP Injection' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 2, + "label": "Openappsec 'ldap injection' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-open-redirect": { "path": "scenarios/openappsec/openappsec-open-redirect.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "1fa3254fa19e895e3209d06518d8947ccc895979f425d76c023030b8a2e098ec", "deprecated": false + }, + "0.2": { + "digest": "bffcbad62ab71fb63aeba4405fcef5a2d623d9bf98032103ab859837ea478a9b", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLW9wZW4tcmVkaXJlY3QKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdPcGVuIFJlZGlyZWN0JyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdvcGVuIHJlZGlyZWN0Jwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLW9wZW4tcmVkaXJlY3QKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdPcGVuIFJlZGlyZWN0JyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdvcGVuIHJlZGlyZWN0Jwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExODkKICAgIC0gYXR0YWNrLlQxNTY2CiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMgogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiT3BlbmFwcHNlYyAnb3BlbiByZWRpcmVjdCcgZGV0ZWN0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect openappsec 'prevent' securityActions on 'Open Redirect' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1189", + "attack.T1566" + ], + "confidence": 2, + "label": "Openappsec 'open redirect' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-path-traversal": { "path": "scenarios/openappsec/openappsec-path-traversal.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "21763dd00a0bc8970f94dc79a2d0ae5bab8684bc5af503f2d2a6335b0cea68a8", "deprecated": false + }, + "0.2": { + "digest": "4cb2b83be3ef0204a5acfa8f7b125fb74c2a017cd202af60d3c1ce3d903ee60c", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXBhdGgtdHJhdmVyc2FsCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG9wZW5hcHBzZWMgJ3ByZXZlbnQnIHNlY3VyaXR5QWN0aW9ucyBvbiAnUGF0aCBUcmF2ZXJzYWwnIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ3BhdGggdHJhdmVyc2FsJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXBhdGgtdHJhdmVyc2FsCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG9wZW5hcHBzZWMgJ3ByZXZlbnQnIHNlY3VyaXR5QWN0aW9ucyBvbiAnUGF0aCBUcmF2ZXJzYWwnIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ3BhdGggdHJhdmVyc2FsJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMgogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiT3BlbmFwcHNlYyAncGF0aCB0cmF2ZXJzYWwnIGRldGVjdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect openappsec 'prevent' securityActions on 'Path Traversal' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 2, + "label": "Openappsec 'path traversal' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-probing": { "path": "scenarios/openappsec/openappsec-probing.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "6add1b1101bbb54c961329ec9b14b160b98b4c24661a7448c8e4469ffb167973", "deprecated": false + }, + "0.2": { + "digest": "9de0d6dcba782e7bd114951fe8933710c79743ec858878c53b8d658436967e12", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXByb2JpbmcKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdWdWxuZXJhYmlsaXR5IFNjYW5uaW5nJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICd2dWxuZXJhYmlsaXR5IHNjYW5uaW5nJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXByb2JpbmcKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdWdWxuZXJhYmlsaXR5IFNjYW5uaW5nJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICd2dWxuZXJhYmlsaXR5IHNjYW5uaW5nJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMgogIGJlaGF2aW9yOiAiaHR0cDpzY2FuIgogIGxhYmVsOiAiT3BlbmFwcHNlYyAncHJvYmluZycgZGV0ZWN0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect openappsec 'prevent' securityActions on 'Vulnerability Scanning' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:scan", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 2, + "label": "Openappsec 'probing' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-rce": { "path": "scenarios/openappsec/openappsec-rce.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "fc5691b14b1d2e38f1fef9f430107a8b31d7825e503ef33c6b11ac9f34c37f62", "deprecated": false + }, + "0.2": { + "digest": "a6a032e95fb4d61eb3c19ff5ee263b97f12e72052e9b41222de3758263d5d2cd", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgpkZWJ1ZzogZmFsc2UKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXJjZQpkZXNjcmlwdGlvbjogIkRldGVjdCBvcGVuYXBwc2VjICdwcmV2ZW50JyBzZWN1cml0eUFjdGlvbnMgb24gJ1JlbW90ZSBDb2RlIEV4ZWN1dGlvbicgZXZlbnRzICh3aGVuIHdhZiBibG9ja3MgbWFsaWNpb3VzIHJlcXVlc3QpIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdvcGVuYXBwc2VjX3NlY3VyaXR5X2xvZycgYW5kIExvd2VyKGV2dC5NZXRhLnNlY3VyaXR5X2FjdGlvbikgaW4gWydwcmV2ZW50JywgJ2RldGVjdCddIGFuZCBMb3dlcihldnQuTWV0YS5pbmNpZGVudF90eXBlKSBjb250YWlucyAncmVtb3RlIGNvZGUgZXhlY3V0aW9uJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgpkZWJ1ZzogZmFsc2UKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXJjZQpkZXNjcmlwdGlvbjogIkRldGVjdCBvcGVuYXBwc2VjICdwcmV2ZW50JyBzZWN1cml0eUFjdGlvbnMgb24gJ1JlbW90ZSBDb2RlIEV4ZWN1dGlvbicgZXZlbnRzICh3aGVuIHdhZiBibG9ja3MgbWFsaWNpb3VzIHJlcXVlc3QpIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdvcGVuYXBwc2VjX3NlY3VyaXR5X2xvZycgYW5kIExvd2VyKGV2dC5NZXRhLnNlY3VyaXR5X2FjdGlvbikgaW4gWydwcmV2ZW50JywgJ2RldGVjdCddIGFuZCBMb3dlcihldnQuTWV0YS5pbmNpZGVudF90eXBlKSBjb250YWlucyAncmVtb3RlIGNvZGUgZXhlY3V0aW9uJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMgogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiT3BlbmFwcHNlYyAncmNlJyBkZXRlY3Rpb24iCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect openappsec 'prevent' securityActions on 'Remote Code Execution' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 2, + "label": "Openappsec 'rce' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-request-rate-limit": { "path": "scenarios/openappsec/openappsec-request-rate-limit.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "8e915688ead3b21a9660ad94521098df7e152ef74822d96df0d29d09b3625377", "deprecated": false + }, + "0.2": { + "digest": "98c6638dda03c0b6ffb29bcb5b09571890eae5c764a0d7ab3c9678d0458680f6", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXJlcXVlc3QtcmF0ZS1saW1pdApkZXNjcmlwdGlvbjogIkRldGVjdCBvcGVuYXBwc2VjICdwcmV2ZW50JyBzZWN1cml0eUFjdGlvbnMgb24gJ1JlcXVlc3QgUmF0ZSBMaW1pdCcgZXZlbnRzICh3aGVuIHdhZiBibG9ja3MgbWFsaWNpb3VzIHJlcXVlc3QpIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdvcGVuYXBwc2VjX3NlY3VyaXR5X2xvZycgYW5kIExvd2VyKGV2dC5NZXRhLnNlY3VyaXR5X2FjdGlvbikgaW4gWydwcmV2ZW50JywgJ2RldGVjdCddIGFuZCBMb3dlcihldnQuTWV0YS5pbmNpZGVudF90eXBlKSBjb250YWlucyAncmVxdWVzdCByYXRlIGxpbWl0Jwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXJlcXVlc3QtcmF0ZS1saW1pdApkZXNjcmlwdGlvbjogIkRldGVjdCBvcGVuYXBwc2VjICdwcmV2ZW50JyBzZWN1cml0eUFjdGlvbnMgb24gJ1JlcXVlc3QgUmF0ZSBMaW1pdCcgZXZlbnRzICh3aGVuIHdhZiBibG9ja3MgbWFsaWNpb3VzIHJlcXVlc3QpIgpmaWx0ZXI6IGV2dC5NZXRhLmxvZ190eXBlID09ICdvcGVuYXBwc2VjX3NlY3VyaXR5X2xvZycgYW5kIExvd2VyKGV2dC5NZXRhLnNlY3VyaXR5X2FjdGlvbikgaW4gWydwcmV2ZW50JywgJ2RldGVjdCddIGFuZCBMb3dlcihldnQuTWV0YS5pbmNpZGVudF90eXBlKSBjb250YWlucyAncmVxdWVzdCByYXRlIGxpbWl0Jwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE0OTgKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAyCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJPcGVuYXBwc2VjICdyZXF1ZXN0IHJhdGUgbGltaXQnIGRldGVjdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect openappsec 'prevent' securityActions on 'Request Rate Limit' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:bruteforce", + "classification": [ + "attack.T1498" + ], + "confidence": 2, + "label": "Openappsec 'request rate limit' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-schema-validation": { "path": "scenarios/openappsec/openappsec-schema-validation.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "5db74f61a78169a46c9e57c8d9b29cfff2ae4f5f89b2a0acffa6a54a1bebdf57", "deprecated": false + }, + "0.2": { + "digest": "ed81a89e2acacea4ced7ba6461a4449b2c52cce41ea004e8e699f259000c0b95", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXNjaGVtYS12YWxpZGF0aW9uCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG9wZW5hcHBzZWMgJ3ByZXZlbnQnIHNlY3VyaXR5QWN0aW9ucyBvbiAnU2NoZW1hIFZhbGlkYXRpb24nIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ3NjaGVtYSB2YWxpZGF0aW9uJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXNjaGVtYS12YWxpZGF0aW9uCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG9wZW5hcHBzZWMgJ3ByZXZlbnQnIHNlY3VyaXR5QWN0aW9ucyBvbiAnU2NoZW1hIFZhbGlkYXRpb24nIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ3NjaGVtYSB2YWxpZGF0aW9uJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExOTAKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAxCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJPcGVuYXBwc2VjICdzY2hlbWEgdmFsaWRhdGlvbnMnIGRldGVjdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect openappsec 'prevent' securityActions on 'Schema Validation' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1190" + ], + "confidence": 1, + "label": "Openappsec 'schema validations' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-sql-injection": { "path": "scenarios/openappsec/openappsec-sql-injection.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "1b9c623f1c1a7b7147154264aca614b2aadcdb8fe6d25a1362caee43e5644912", "deprecated": false + }, + "0.2": { + "digest": "ef6a4c2887b8080047e8aae572272424d3d7e44ddc9c3dda913d5cbb616e1bec", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXNxbC1pbmplY3Rpb24KZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdTUUwgSW5qZWN0aW9uJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdzcWwgaW5qZWN0aW9uJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXNxbC1pbmplY3Rpb24KZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdTUUwgSW5qZWN0aW9uJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdzcWwgaW5qZWN0aW9uJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMgogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiT3BlbmFwcHNlYyAnU1FMIEluamVjdGlvbicgZGV0ZWN0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect openappsec 'prevent' securityActions on 'SQL Injection' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 2, + "label": "Openappsec 'SQL Injection' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-url-instead-of-file": { "path": "scenarios/openappsec/openappsec-url-instead-of-file.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "370c0b576759dcc3fe7f2fe1809723eb761598c94cc8432cc2781d4691f0b296", "deprecated": false + }, + "0.2": { + "digest": "13f6f3de0158e49291738a0c83ab27c48f4d9c97ff9a2c53d97a92fbe0b2c510", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXVybC1pbnN0ZWFkLW9mLWZpbGUKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdVUkwgaW5zdGVhZCBvZiBmaWxlJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICd1cmwgaW5zdGVhZCBvZiBmaWxlJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiBzZXJ2aWNlOiBvcGVuYXBwc2VjCiB0eXBlOiBleHBsb2l0CiByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXVybC1pbnN0ZWFkLW9mLWZpbGUKZGVzY3JpcHRpb246ICJEZXRlY3Qgb3BlbmFwcHNlYyAncHJldmVudCcgc2VjdXJpdHlBY3Rpb25zIG9uICdVUkwgaW5zdGVhZCBvZiBmaWxlJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICd1cmwgaW5zdGVhZCBvZiBmaWxlJwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiA1bQpsYWJlbHM6CiAgc2VydmljZTogaHR0cAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1OTUKICAgIC0gYXR0YWNrLlQxMTkwCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMgogIGJlaGF2aW9yOiAiaHR0cDpleHBsb2l0IgogIGxhYmVsOiAiT3BlbmFwcHNlYyAndXJsIGluc3RlYWQgb2YgZmlsZScgZGV0ZWN0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect openappsec 'prevent' securityActions on 'URL instead of file' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 2, + "label": "Openappsec 'url instead of file' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-xss": { "path": "scenarios/openappsec/openappsec-xss.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "43cb006041497512db66ac2dbff9ebe799d524685f5a57e4c0e8721ff4d19de7", "deprecated": false + }, + "0.2": { + "digest": "4162af0592925a3de3c136c16e42a1ecc7b94d293867779092a252c371483c8a", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXhzcwpkZXNjcmlwdGlvbjogIkRldGVjdCBvcGVuYXBwc2VjICdwcmV2ZW50JyBzZWN1cml0eUFjdGlvbnMgb24gJ0Nyb3NzIFNpdGUgU2NyaXB0aW5nJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdjcm9zcyBzaXRlIHNjcmlwdGluZycKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KbGFiZWxzOgogc2VydmljZTogb3BlbmFwcHNlYwogdHlwZTogZXhwbG9pdAogcmVtZWRpYXRpb246IHRydWU=", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXhzcwpkZXNjcmlwdGlvbjogIkRldGVjdCBvcGVuYXBwc2VjICdwcmV2ZW50JyBzZWN1cml0eUFjdGlvbnMgb24gJ0Nyb3NzIFNpdGUgU2NyaXB0aW5nJyBldmVudHMgKHdoZW4gd2FmIGJsb2NrcyBtYWxpY2lvdXMgcmVxdWVzdCkiCmZpbHRlcjogZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ29wZW5hcHBzZWNfc2VjdXJpdHlfbG9nJyBhbmQgTG93ZXIoZXZ0Lk1ldGEuc2VjdXJpdHlfYWN0aW9uKSBpbiBbJ3ByZXZlbnQnLCAnZGV0ZWN0J10gYW5kIExvd2VyKGV2dC5NZXRhLmluY2lkZW50X3R5cGUpIGNvbnRhaW5zICdjcm9zcyBzaXRlIHNjcmlwdGluZycKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogNW0KbGFiZWxzOgogIHNlcnZpY2U6IGh0dHAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTg5CiAgICAtIGF0dGFjay5UMTU5NQogICAgLSBhdHRhY2suVDExOTAKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAyCiAgYmVoYXZpb3I6ICJodHRwOmV4cGxvaXQiCiAgbGFiZWw6ICJPcGVuYXBwc2VjICdYU1MnIGRldGVjdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect openappsec 'prevent' securityActions on 'Cross Site Scripting' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1189", + "attack.T1595", + "attack.T1190" + ], + "confidence": 2, + "label": "Openappsec 'XSS' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "openappsec/openappsec-xxe": { "path": "scenarios/openappsec/openappsec-xxe.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "d7d63f2b84a74fa26697fd74d78f9fc187a54ace8b0dc1e1ae28aacf055892a5", "deprecated": false + }, + "0.2": { + "digest": "6bcf9558fb7681b4293a7b1d5a705b9f5fd49d2ea6c332354251eba271203195", + "deprecated": false } }, - "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXh4ZQpkZXNjcmlwdGlvbjogIkRldGVjdCBvcGVuYXBwc2VjICdwcmV2ZW50JyBzZWN1cml0eUFjdGlvbnMgb24gJ1hNTCBFeHRlcm5hbCBFbnRpdHknIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ3htbCBleHRlcm5hbCBlbnRpdHknCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKIHNlcnZpY2U6IG9wZW5hcHBzZWMKIHR5cGU6IGV4cGxvaXQKIHJlbWVkaWF0aW9uOiB0cnVl", + "content": "dHlwZTogdHJpZ2dlcgojZGVidWc6IHRydWUKbmFtZTogb3BlbmFwcHNlYy9vcGVuYXBwc2VjLXh4ZQpkZXNjcmlwdGlvbjogIkRldGVjdCBvcGVuYXBwc2VjICdwcmV2ZW50JyBzZWN1cml0eUFjdGlvbnMgb24gJ1hNTCBFeHRlcm5hbCBFbnRpdHknIGV2ZW50cyAod2hlbiB3YWYgYmxvY2tzIG1hbGljaW91cyByZXF1ZXN0KSIKZmlsdGVyOiBldnQuTWV0YS5sb2dfdHlwZSA9PSAnb3BlbmFwcHNlY19zZWN1cml0eV9sb2cnIGFuZCBMb3dlcihldnQuTWV0YS5zZWN1cml0eV9hY3Rpb24pIGluIFsncHJldmVudCcsICdkZXRlY3QnXSBhbmQgTG93ZXIoZXZ0Lk1ldGEuaW5jaWRlbnRfdHlwZSkgY29udGFpbnMgJ3htbCBleHRlcm5hbCBlbnRpdHknCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDVtCmxhYmVsczoKICBjb25maWRlbmNlOiAyCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU5NQogICAgLSBhdHRhY2suVDExOTAKICBiZWhhdmlvcjogImh0dHA6ZXhwbG9pdCIKICBsYWJlbDogIk9wZW5hcHBzZWMgJ1hNTCBFeHRlcm5hbCBFbnRpdHknIGRldGVjdGlvbiIKICByZW1lZGlhdGlvbjogdHJ1ZQogIHNlcnZpY2U6IGh0dHAK", "description": "Detect openappsec 'prevent' securityActions on 'XML External Entity' events (when waf blocks malicious request)", "author": "openappsec", "labels": { - "remediation": "true", - "service": "openappsec", - "type": "exploit" + "behavior": "http:exploit", + "classification": [ + "attack.T1595", + "attack.T1190" + ], + "confidence": 2, + "label": "Openappsec 'XML External Entity' detection", + "remediation": true, + "service": "http", + "spoofable": 0 } }, "schiz0phr3ne/prowlarr-bf": { "path": "scenarios/schiz0phr3ne/prowlarr-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "feac3b8dda8d9841c36edd56c9e4504d4be3f3cf6027e67c00fb8f2f6b6784ee", "deprecated": false + }, + "0.2": { + "digest": "97580733f96cea718dea67b07f9a3f1e27091623f38290c04c2dcbb81d63394d", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBQcm93bGFyciBhdXRoZW50aWNhdGlvbnM6CgotIGxlYWtzcGVlZCBvZiAxNXMsIGNhcGFjaXR5IG9mIDUgb24gc291cmNlIGlwCi0gbGVha3NwZWVkIG9mIDMwcywgY2FwYWNpdHkgb2YgNSBvbiBzb3VyY2UgaXAgYW5kIHVuaXF1ZSBkaXN0aW5jdCB1c2Vycwo=", - "content": "IyBQcm93bGFyciBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IHNjaGl6MHBocjNuZS9wcm93bGFyci1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBQcm93bGFyciBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3Byb3dsYXJyX2ZhaWxlZF9hdXRoZW50aWNhdGlvbiddIgpsZWFrc3BlZWQ6ICIxNXMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgc2VydmljZTogcHJvd2xhcnIKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgUHJvd2xhcnIgdXNlciBlbnVtIGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogc2NoaXowcGhyM25lL3Byb3dsYXJyLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBQcm93bGFyciB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWydwcm93bGFycl9mYWlsZWRfYXV0aGVudGljYXRpb24nXSIKbGVha3NwZWVkOiAiMzBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXJuYW1lCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBwcm93bGFycgogIHR5cGU6IGJydXRlZm9yY2UKICByZW1lZGlhdGlvbjogdHJ1ZSAK", + "content": "IyBQcm93bGFyciBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IHNjaGl6MHBocjNuZS9wcm93bGFyci1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBQcm93bGFyciBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3Byb3dsYXJyX2ZhaWxlZF9hdXRoZW50aWNhdGlvbiddIgpsZWFrc3BlZWQ6ICIxNXMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgc2VydmljZTogcHJvd2xhcnIKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiaHR0cDpicnV0ZWZvcmNlIgogIGxhYmVsOiAiUHJvd2xhcnIgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBQcm93bGFyciB1c2VyIGVudW0gYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBzY2hpejBwaHIzbmUvcHJvd2xhcnItYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFByb3dsYXJyIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3Byb3dsYXJyX2ZhaWxlZF9hdXRoZW50aWNhdGlvbiddIgpsZWFrc3BlZWQ6ICIzMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcm5hbWUKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IHByb3dsYXJyCiAgY29uZmlkZW5jZTogMwogIHNwb29mYWJsZTogMAogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1ODkKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJQcm93bGFyciBVc2VyIEVudW1lcmF0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect Prowlarr bruteforce", "author": "schiz0phr3ne", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Prowlarr Bruteforce", + "remediation": true, "service": "prowlarr", - "type": "bruteforce" + "spoofable": 0 } }, "schiz0phr3ne/radarr-bf": { "path": "scenarios/schiz0phr3ne/radarr-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "e4917c28697b2e60f6324f0daa7c844154a852ba7db95080575fb428a1596786", "deprecated": false + }, + "0.2": { + "digest": "00abe1e708f2f2f19ad43a44f004fb6f2f0b6c46238196412545a2e17d32a1b8", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBSYWRhcnIgYXV0aGVudGljYXRpb25zOgoKLSBsZWFrc3BlZWQgb2YgMTVzLCBjYXBhY2l0eSBvZiA1IG9uIHNvdXJjZSBpcAotIGxlYWtzcGVlZCBvZiAzMHMsIGNhcGFjaXR5IG9mIDUgb24gc291cmNlIGlwIGFuZCB1bmlxdWUgZGlzdGluY3QgdXNlcnMK", - "content": "IyBSYWRhcnIgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBzY2hpejBwaHIzbmUvcmFkYXJyLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFJhZGFyciBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3JhZGFycl9mYWlsZWRfYXV0aGVudGljYXRpb24nXSIKbGVha3NwZWVkOiAiMTVzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IHJhZGFycgogIHR5cGU6IGJydXRlZm9yY2UKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBSYWRhcnIgdXNlciBlbnVtIGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogc2NoaXowcGhyM25lL3JhZGFyci1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgUmFkYXJyIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3JhZGFycl9mYWlsZWRfYXV0aGVudGljYXRpb24nXSIKbGVha3NwZWVkOiAiMzBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXJuYW1lCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiByYWRhcnIKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWUgCg==", + "content": "IyBSYWRhcnIgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBzY2hpejBwaHIzbmUvcmFkYXJyLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFJhZGFyciBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3JhZGFycl9mYWlsZWRfYXV0aGVudGljYXRpb24nXSIKbGVha3NwZWVkOiAiMTVzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IHJhZGFycgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJSYWRhcnIgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBSYWRhcnIgdXNlciBlbnVtIGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogc2NoaXowcGhyM25lL3JhZGFyci1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgUmFkYXJyIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3JhZGFycl9mYWlsZWRfYXV0aGVudGljYXRpb24nXSIKbGVha3NwZWVkOiAiMzBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXJuYW1lCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiByYWRhcnIKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU4OQogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIlJhZGFyciBVc2VyIEVudW1lcmF0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect Radarr bruteforce", "author": "schiz0phr3ne", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Radarr Bruteforce", + "remediation": true, "service": "radarr", - "type": "bruteforce" + "spoofable": 0 } }, "schiz0phr3ne/sonarr-bf": { "path": "scenarios/schiz0phr3ne/sonarr-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "110d81a708fdb4d201495e61619d2d36acb24d8e8b8a6e55e2210517618aaff1", "deprecated": false + }, + "0.2": { + "digest": "0bbff63af5b5b9c8179c29111f500b068a45787e519a4c497a7bd10b397f5ea2", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBTb25hcnIgYXV0aGVudGljYXRpb25zOgoKLSBsZWFrc3BlZWQgb2YgMTVzLCBjYXBhY2l0eSBvZiA1IG9uIHNvdXJjZSBpcAotIGxlYWtzcGVlZCBvZiAzMHMsIGNhcGFjaXR5IG9mIDUgb24gc291cmNlIGlwIGFuZCB1bmlxdWUgZGlzdGluY3QgdXNlcnMK", - "content": "IyBTb25hcnIgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBzY2hpejBwaHIzbmUvc29uYXJyLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFNvbmFyciBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3NvbmFycl9mYWlsZWRfYXV0aGVudGljYXRpb24nXSIKbGVha3NwZWVkOiAiMTVzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IHNvbmFycgogIHR5cGU6IGJydXRlZm9yY2UKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBTb25hcnIgdXNlciBlbnVtIGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogc2NoaXowcGhyM25lL3NvbmFyci1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgU29uYXJyIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3NvbmFycl9mYWlsZWRfYXV0aGVudGljYXRpb24nXSIKbGVha3NwZWVkOiAiMzBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXJuYW1lCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBzb25hcnIKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWUgCg==", + "content": "IyBTb25hcnIgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBzY2hpejBwaHIzbmUvc29uYXJyLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFNvbmFyciBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3NvbmFycl9mYWlsZWRfYXV0aGVudGljYXRpb24nXSIKbGVha3NwZWVkOiAiMTVzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IHNvbmFycgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJTb25hcnIgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBTb25hcnIgdXNlciBlbnVtIGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogc2NoaXowcGhyM25lL3NvbmFyci1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgU29uYXJyIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3NvbmFycl9mYWlsZWRfYXV0aGVudGljYXRpb24nXSIKbGVha3NwZWVkOiAiMzBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXJuYW1lCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBzb25hcnIKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU4OQogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIlNvbmFyciBVc2VyIEVudW1lcmF0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect Sonarr bruteforce", "author": "schiz0phr3ne", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Sonarr Bruteforce", + "remediation": true, "service": "sonarr", - "type": "bruteforce" + "spoofable": 0 } }, "thespad/sshesame-honeypot": { "path": "scenarios/thespad/sshesame-honeypot.yaml", - "version": "0.2", + "version": "0.3", "versions": { "0.1": { "digest": "0818e9e2be666b4e6315050b7fa96f82dc47b6010c07704370738875842c160b", @@ -9069,73 +11576,173 @@ "0.2": { "digest": "a6120c94b2390d7deea3b79407e37870e084fed11d08bd7434162ce6f84257a5", "deprecated": false + }, + "0.3": { + "digest": "950cf9776305bfb38f8711a5d5a2ed59f533e40e51666b0393d0117634bf4799", + "deprecated": false } }, "long_description": "IyBzc2hlc2FtZSBzY2VuYXJpb3MKClNjZW5hcmlvcyBmb3IgW3NzaGVzYW1lXShodHRwczovL2dpdGh1Yi5jb20vamFrc2kvc3NoZXNhbWUvKSBob25leXBvdCBsb2dzLgoKIyMgU2NlbmFyaW8gc2V0dXAKCiogQWxsIGxvZ2luIGV2ZW50czogbGVha3NwZWVkIG9mIDMwbSwgY2FwYWNpdHkgb2YgMwoqIEFueSBjb21tYW5kcyBzZW50IGJ5IGNsaWVudHMgYXMgcGFydCBvZiBhIGNvbm5lY3Rpb24gYXR0ZW1wdCB3aWxsIGltbWVkaWF0ZWx5IG92ZXJmbG93Cg==", - "content": "IyBzc2hlc2FtZSBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IHRoZXNwYWQvc3NoZXNhbWUtYmYKZGVzY3JpcHRpb246ICJEZXRlY3Qgc3NoZXNhbWUgYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3NzaGVzYW1lX2xvZ2luJyIKbGVha3NwZWVkOiAiMzBtIgpjYXBhY2l0eTogMwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogc3NoZXNhbWUKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgc3NoZXNhbWUgY29tbWFuZHMKdHlwZTogdHJpZ2dlcgpuYW1lOiB0aGVzcGFkL3NzaGVzYW1lLWNtZApkZXNjcmlwdGlvbjogIkRldGVjdCBzc2hlc2FtZSBjb21tYW5kcyIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3NzaGVzYW1lX2NtZCciCmNhcGFjaXR5OiAwCmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBzc2hlc2FtZQogIHR5cGU6IGNvbW1hbmQKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBzc2hlc2FtZSBpbnB1dAp0eXBlOiBsZWFreQpuYW1lOiB0aGVzcGFkL3NzaGVzYW1lLWlucHV0CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IHNzaGVzYW1lIGlucHV0IHNwYW0iCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdzc2hlc2FtZV9pbnB1dCciCmxlYWtzcGVlZDogIjVtIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogc3NoZXNhbWUKICB0eXBlOiBpbnB1dAogIHJlbWVkaWF0aW9uOiB0cnVlCg==", + "content": "IyBzc2hlc2FtZSBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IHRoZXNwYWQvc3NoZXNhbWUtYmYKZGVzY3JpcHRpb246ICJEZXRlY3Qgc3NoZXNhbWUgYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3NzaGVzYW1lX2xvZ2luJyIKbGVha3NwZWVkOiAiMzBtIgpjYXBhY2l0eTogMwpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogc3NoZXNhbWUKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAic3NoOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJTU0hlc2FtZSBCcnV0ZWZvcmNlIgogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIHNzaGVzYW1lIGNvbW1hbmRzCnR5cGU6IHRyaWdnZXIKbmFtZTogdGhlc3BhZC9zc2hlc2FtZS1jbWQKZGVzY3JpcHRpb246ICJEZXRlY3Qgc3NoZXNhbWUgY29tbWFuZHMiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdzc2hlc2FtZV9jbWQnIgpjYXBhY2l0eTogMApncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpsYWJlbHM6CiAgc2VydmljZTogc3NoZXNhbWUKICB0eXBlOiBjb21tYW5kCiAgYmVoYXZpb3I6ICJzc2g6YnJ1dGVmb3JjZSIKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMDU5CiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIHNzaGVzYW1lIGlucHV0CnR5cGU6IGxlYWt5Cm5hbWU6IHRoZXNwYWQvc3NoZXNhbWUtaW5wdXQKZGVzY3JpcHRpb246ICJEZXRlY3Qgc3NoZXNhbWUgaW5wdXQgc3BhbSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ3NzaGVzYW1lX2lucHV0JyIKbGVha3NwZWVkOiAiNW0iCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCmxhYmVsczoKICBzZXJ2aWNlOiBzc2hlc2FtZQogIGJlaGF2aW9yOiAic3NoOmJydXRlZm9yY2UiCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDEwNTkKICByZW1lZGlhdGlvbjogdHJ1ZQo=", "description": "Detect sshesame bruteforce", "author": "thespad", "labels": { - "remediation": "true", + "behavior": "ssh:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "SSHesame Bruteforce", + "remediation": true, "service": "sshesame", - "type": "bruteforce" + "spoofable": 0 } }, "timokoessler/gitlab-bf": { "path": "scenarios/timokoessler/gitlab-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "c41f3f4003eeb331fa35aa2ace0e861a674992efdb5a26c5f9d447db40a67eca", "deprecated": false + }, + "0.2": { + "digest": "2cd1a9d5dfd164c06ed4dd7a89104e1f25251ab4eb35c8f8f66890fbd127a6f5", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBHaXRMYWIgYXV0aGVudGljYXRpb25zOgoKLSBsZWFrc3BlZWQgb2YgMjBzLCBjYXBhY2l0eSBvZiA1IG9uIHNvdXJjZSBpcAotIGxlYWtzcGVlZCBvZiA0MHMsIGNhcGFjaXR5IG9mIDUgb24gc291cmNlIGlwIGFuZCB1bmlxdWUgZGlzdGluY3QgdXNlcnM=", - "content": "IyBnaXRsYWIgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiB0aW1va29lc3NsZXIvZ2l0bGFiLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGdpdGxhYiBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2dpdGxhYl9mYWlsZWRfcGFzc3dvcmQnLCAnZ2l0bGFiX2ZhaWxlZF90b3RwJ10iCmxlYWtzcGVlZDogIjIwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBnaXRsYWIKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgZ2l0bGFiIHVzZXIgZW51bSBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IHRpbW9rb2Vzc2xlci9naXRsYWItYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGdpdGxhYiB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2dpdGxhYl9mYWlsZWRfcGFzc3dvcmQnIgpsZWFrc3BlZWQ6ICI0MHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcm5hbWUKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IGdpdGxhYgogIHR5cGU6IGJydXRlZm9yY2UKICByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "IyBnaXRsYWIgYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiB0aW1va29lc3NsZXIvZ2l0bGFiLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGdpdGxhYiBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ2dpdGxhYl9mYWlsZWRfcGFzc3dvcmQnLCAnZ2l0bGFiX2ZhaWxlZF90b3RwJ10iCmxlYWtzcGVlZDogIjIwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBnaXRsYWIKICBiZWhhdmlvcjogInZjczpicnV0ZWZvcmNlIgogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExMTAKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgbGFiZWw6ICJHaXRsYWIgQnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBnaXRsYWIgdXNlciBlbnVtIGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogdGltb2tvZXNzbGVyL2dpdGxhYi1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgZ2l0bGFiIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnZ2l0bGFiX2ZhaWxlZF9wYXNzd29yZCciCmxlYWtzcGVlZDogIjQwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS51c2VybmFtZQpibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgc2VydmljZTogZ2l0bGFiCiAgYmVoYXZpb3I6ICJ2Y3M6YnJ1dGVmb3JjZSIKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgICAtIGF0dGFjay5UMTExMAogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICBsYWJlbDogIkdpdGxhYiBVc2VyIEVudW1lcmF0aW9uIgogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect gitlab bruteforce", "author": "timokoessler", "labels": { - "remediation": "true", + "behavior": "vcs:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Gitlab Bruteforce", + "remediation": true, "service": "gitlab", - "type": "bruteforce" + "spoofable": 0 } }, "timokoessler/mongodb-bf": { "path": "scenarios/timokoessler/mongodb-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "2091dbe9f9e71d2f31a6c6dbcd1aaa5b8eb8215925bfdf8a36f9b3c1624cffcf", "deprecated": false + }, + "0.2": { + "digest": "df5a0f8e6bad0a57e451ba4c06adb9a2852b45a9c717917ff254b8d78ce06f80", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBNb25nb0RCIGF1dGhlbnRpY2F0aW9uczoKCi0gbGVha3NwZWVkIG9mIDIwcywgY2FwYWNpdHkgb2YgNSBvbiBzb3VyY2UgaXAKLSBsZWFrc3BlZWQgb2YgNDBzLCBjYXBhY2l0eSBvZiA1IG9uIHNvdXJjZSBpcCBhbmQgdW5pcXVlIGRpc3RpbmN0IHVzZXJzCi0gbGVha3NwZWVkIG9mIDQwcywgY2FwYWNpdHkgb2YgNSBvbiBzb3VyY2UgaXAgYW5kIHVuaXF1ZSBkaXN0aW5jdCBhdXRoZW50aWNhdGlvbiBkYXRhYmFzZQ==", - "content": "IyBtb25nb2RiIGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogdGltb2tvZXNzbGVyL21vbmdvZGItYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgbW9uZ29kYiBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnbW9uZ29kYl9mYWlsZWRfYXV0aCciCmxlYWtzcGVlZDogIjIwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBtb25nb2RiCiAgdHlwZTogYnJ1dGVmb3JjZQogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIG1vbmdvZGIgdXNlciBlbnVtIGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogdGltb2tvZXNzbGVyL21vbmdvZGItYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG1vbmdvZGIgdXNlciBlbnVtIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdtb25nb2RiX2ZhaWxlZF9hdXRoJyIKbGVha3NwZWVkOiAiNDBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXJuYW1lCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBtb25nb2RiCiAgdHlwZTogYnJ1dGVmb3JjZQogIHJlbWVkaWF0aW9uOiB0cnVlCi0tLQojIG1vbmdvZGIgYXV0aGVudGljYXRpb24gZGF0YWJhc2UgZW51bSBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IHRpbW9rb2Vzc2xlci9tb25nb2RiLWJmX2F1dGgtZGItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBtb25nb2RiIGF1dGhlbnRpY2F0aW9uIGRhdGFiYXNlIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21vbmdvZGJfZmFpbGVkX2F1dGgnIgpsZWFrc3BlZWQ6ICI0MHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEuYXV0aGVudGljYXRpb25fZGF0YWJhc2UKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IG1vbmdvZGIKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWU=", + "content": "IyBtb25nb2RiIGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogdGltb2tvZXNzbGVyL21vbmdvZGItYmYKZGVzY3JpcHRpb246ICJEZXRlY3QgbW9uZ29kYiBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnbW9uZ29kYl9mYWlsZWRfYXV0aCciCmxlYWtzcGVlZDogIjIwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBtb25nb2RiCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiZGF0YWJhc2U6YnJ1dGVmb3JjZSIKICBsYWJlbDogIk1vbmdvREIgQnJ1dGVmb3JjZSIKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgbW9uZ29kYiB1c2VyIGVudW0gYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiB0aW1va29lc3NsZXIvbW9uZ29kYi1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgbW9uZ29kYiB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ21vbmdvZGJfZmFpbGVkX2F1dGgnIgpsZWFrc3BlZWQ6ICI0MHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcm5hbWUKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IG1vbmdvZGIKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgICAtIGF0dGFjay5UMTExMAogIGJlaGF2aW9yOiAiZGF0YWJhc2U6YnJ1dGVmb3JjZSIKICBsYWJlbDogIk1vbmdvREIgVXNlciBFbnVtZXJhdGlvbiIKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgbW9uZ29kYiBhdXRoZW50aWNhdGlvbiBkYXRhYmFzZSBlbnVtIGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogdGltb2tvZXNzbGVyL21vbmdvZGItYmZfYXV0aC1kYi1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IG1vbmdvZGIgYXV0aGVudGljYXRpb24gZGF0YWJhc2UgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnbW9uZ29kYl9mYWlsZWRfYXV0aCciCmxlYWtzcGVlZDogIjQwcyIKY2FwYWNpdHk6IDUKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmRpc3RpbmN0OiBldnQuTWV0YS5hdXRoZW50aWNhdGlvbl9kYXRhYmFzZQpibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgc2VydmljZTogbW9uZ29kYgogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDE1ODkKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJkYXRhYmFzZTpicnV0ZWZvcmNlIgogIGxhYmVsOiAiTW9uZ29EQiBBdXRoZW50aWNhdGlvbiBFbnVtZXJhdGlvbiIKICBzcG9vZmFibGU6IDAKICBjb25maWRlbmNlOiAzCiAgcmVtZWRpYXRpb246IHRydWUK", "description": "Detect mongodb bruteforce", "author": "timokoessler", "labels": { - "remediation": "true", + "behavior": "database:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "MongoDB Bruteforce", + "remediation": true, "service": "mongodb", - "type": "bruteforce" + "spoofable": 0 } }, "timokoessler/uptime-kuma-bf": { "path": "scenarios/timokoessler/uptime-kuma-bf.yaml", - "version": "0.1", + "version": "0.2", "versions": { "0.1": { "digest": "a50fbbc0db115694fc140607f27688c499d63b3702b2bc596809f3cfaeb58c02", "deprecated": false + }, + "0.2": { + "digest": "c78efdf197b94e8be0540b5d6e1bfa6c926cda8e8bd51969d8db4c3960eb9f04", + "deprecated": false } }, "long_description": "RGV0ZWN0IGZhaWxlZCBVcHRpbWUgS3VtYSBhdXRoZW50aWNhdGlvbnM6CgotIGxlYWtzcGVlZCBvZiAxNXMsIGNhcGFjaXR5IG9mIDUgb24gc291cmNlIGlwCi0gbGVha3NwZWVkIG9mIDMwcywgY2FwYWNpdHkgb2YgNSBvbiBzb3VyY2UgaXAgYW5kIHVuaXF1ZSBkaXN0aW5jdCB1c2Vycw==", - "content": "IyBVcHRpbWUgS3VtYSBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IHRpbW9rb2Vzc2xlci91cHRpbWUta3VtYS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBVcHRpbWUgS3VtYSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3VwdGltZV9rdW1hX2ZhaWxlZF9wYXNzd29yZCcsICd1cHRpbWVfa3VtYV9mYWlsZWRfdG90cCddIgpsZWFrc3BlZWQ6ICIxNXMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgc2VydmljZTogdXB0aW1lLWt1bWEKICB0eXBlOiBicnV0ZWZvcmNlCiAgcmVtZWRpYXRpb246IHRydWUKLS0tCiMgVXB0aW1lIEt1bWEgdXNlciBlbnVtIGJydXRlZm9yY2UKdHlwZTogbGVha3kKbmFtZTogdGltb2tvZXNzbGVyL3VwdGltZS1rdW1hLWJmX3VzZXItZW51bQpkZXNjcmlwdGlvbjogIkRldGVjdCBVcHRpbWUgS3VtYSB1c2VyIGVudW0gYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgaW4gWyd1cHRpbWVfa3VtYV9mYWlsZWRfcGFzc3dvcmQnLCAndXB0aW1lX2t1bWFfZmFpbGVkX3RvdHAnXSIKbGVha3NwZWVkOiAiMzBzIgpjYXBhY2l0eTogNQpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnVzZXJuYW1lCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiB1cHRpbWUta3VtYQogIHR5cGU6IGJydXRlZm9yY2UKICByZW1lZGlhdGlvbjogdHJ1ZQ==", + "content": "IyBVcHRpbWUgS3VtYSBicnV0ZWZvcmNlCnR5cGU6IGxlYWt5Cm5hbWU6IHRpbW9rb2Vzc2xlci91cHRpbWUta3VtYS1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBVcHRpbWUgS3VtYSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3VwdGltZV9rdW1hX2ZhaWxlZF9wYXNzd29yZCcsICd1cHRpbWVfa3VtYV9mYWlsZWRfdG90cCddIgpsZWFrc3BlZWQ6ICIxNXMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApibGFja2hvbGU6IDFtCnJlcHJvY2VzczogdHJ1ZQpsYWJlbHM6CiAgc2VydmljZTogdXB0aW1lLWt1bWEKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgYmVoYXZpb3I6ICJodHRwOmJydXRlZm9yY2UiCiAgbGFiZWw6ICJVcHRpbWUgS3VtYSBCcnV0ZWZvcmNlIgogIHNwb29mYWJsZTogMAogIGNvbmZpZGVuY2U6IDMKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KIyBVcHRpbWUgS3VtYSB1c2VyIGVudW0gYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiB0aW1va29lc3NsZXIvdXB0aW1lLWt1bWEtYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IFVwdGltZSBLdW1hIHVzZXIgZW51bSBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSBpbiBbJ3VwdGltZV9rdW1hX2ZhaWxlZF9wYXNzd29yZCcsICd1cHRpbWVfa3VtYV9mYWlsZWRfdG90cCddIgpsZWFrc3BlZWQ6ICIzMHMiCmNhcGFjaXR5OiA1Cmdyb3VwYnk6IGV2dC5NZXRhLnNvdXJjZV9pcApkaXN0aW5jdDogZXZ0Lk1ldGEudXNlcm5hbWUKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IHVwdGltZS1rdW1hCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTU4OQogICAgLSBhdHRhY2suVDExMTAKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICBsYWJlbDogIlVwdGltZSBLdW1hIFVzZXIgRW51bWVyYXRpb24iCiAgc3Bvb2ZhYmxlOiAwCiAgY29uZmlkZW5jZTogMwogIHJlbWVkaWF0aW9uOiB0cnVlCg==", "description": "Detect Uptime Kuma bruteforce", "author": "timokoessler", "labels": { - "remediation": "true", + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Uptime Kuma Bruteforce", + "remediation": true, "service": "uptime-kuma", - "type": "bruteforce" + "spoofable": 0 + } + }, + "xs539/bookstack-bf": { + "path": "scenarios/xs539/bookstack-bf.yaml", + "version": "0.2", + "versions": { + "0.1": { + "digest": "828ad724c5f1e4753fcb812c7aea04fac5be2f1c0ef336bde572515496e6f3ff", + "deprecated": false + }, + "0.2": { + "digest": "808f23a3c6324bfff37364a37ab62141ac8e0c124486a999ca9382ba8362de6e", + "deprecated": false + } + }, + "content": "dHlwZTogbGVha3kKbmFtZTogeHM1MzkvYm9va3N0YWNrLWJmCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGJvb2tzdGFjayBicnV0ZWZvcmNlIgpmaWx0ZXI6ICJldnQuTWV0YS5sb2dfdHlwZSA9PSAnYm9va3N0YWNrX2ZhaWxlZF9hdXRoJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmxlYWtzcGVlZDogMTVtCmNhcGFjaXR5OiAzCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGJvb2tzdGFjawogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgbGFiZWw6ICJCb29rc3RhY2sgQnJ1dGVmb3JjZSIKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KdHlwZTogbGVha3kKbmFtZTogIHhzNTM5L2Jvb2tzdGFjay1iZl91c2VyLWVudW0KZGVzY3JpcHRpb246ICJEZXRlY3QgYm9va3N0YWNrIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdib29rc3RhY2tfZmFpbGVkX2F1dGgnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnRhcmdldF91c2VyCmxlYWtzcGVlZDogMTVtCmNhcGFjaXR5OiAzCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGJvb2tzdGFjawogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgbGFiZWw6ICJCb29rc3RhY2sgVXNlciBFbnVtZXJhdGlvbiIKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQ==", + "description": "Detect bookstack bruteforce", + "author": "xs539", + "labels": { + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Bookstack Bruteforce", + "remediation": true, + "service": "bookstack", + "spoofable": 0 + } + }, + "xs539/joplin-server-bf": { + "path": "scenarios/xs539/joplin-server-bf.yaml", + "version": "0.3", + "versions": { + "0.1": { + "digest": "0c145a9d2072160940cb9de1d84b19a92df3b5227581f008481a505f74301ffb", + "deprecated": false + }, + "0.2": { + "digest": "5ffec4624031734a05c87617f2d4a242b04ab9ca5cfe54c78d4f2a91835ae7f3", + "deprecated": false + }, + "0.3": { + "digest": "edb791f6bdcaca842a71097a78202b717ba499dad029513f71154e4a22e5b67e", + "deprecated": false + } + }, + "content": "dHlwZTogbGVha3kKbmFtZTogeHM1Mzkvam9wbGluLXNlcnZlci1iZgpkZXNjcmlwdGlvbjogIkRldGVjdCBKb3BsaW4gU2VydmVyIGJydXRlZm9yY2UiCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdqb3BsaW5fc2VydmVyX2ZhaWxlZF9hdXRoJyIKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmxlYWtzcGVlZDogMTVtCmNhcGFjaXR5OiAzCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGpvcGxpbgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxMTEwCiAgbGFiZWw6ICJKb3BsaW4gQnJ1dGVmb3JjZSIKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQotLS0KdHlwZTogbGVha3kKbmFtZTogIHhzNTM5L2pvcGxpbi1zZXJ2ZXItYmZfdXNlci1lbnVtCmRlc2NyaXB0aW9uOiAiRGV0ZWN0IEpvcGxpbiBTZXJ2ZXIgYnJ1dGVmb3JjZSIKZmlsdGVyOiAiZXZ0Lk1ldGEubG9nX3R5cGUgPT0gJ2pvcGxpbl9zZXJ2ZXJfZmFpbGVkX2F1dGgnIgpncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKZGlzdGluY3Q6IGV2dC5NZXRhLnRhcmdldF91c2VyCmxlYWtzcGVlZDogMTVtCmNhcGFjaXR5OiAzCmJsYWNraG9sZTogMW0KbGFiZWxzOgogIHNlcnZpY2U6IGpvcGxpbgogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjbGFzc2lmaWNhdGlvbjoKICAgIC0gYXR0YWNrLlQxNTg5CiAgbGFiZWw6ICJKb3BsaW4gVXNlciBFbnVtZXJhdGlvbiIKICBiZWhhdmlvcjogImh0dHA6YnJ1dGVmb3JjZSIKICByZW1lZGlhdGlvbjogdHJ1ZQ==", + "description": "Detect Joplin Server bruteforce", + "author": "xs539", + "labels": { + "behavior": "http:bruteforce", + "classification": [ + "attack.T1110" + ], + "confidence": 3, + "label": "Joplin Bruteforce", + "remediation": true, + "service": "joplin", + "spoofable": 0 } } } diff --git a/crowdsec/hub/collections/crowdsecurity/http-cve.yaml b/crowdsec/hub/collections/crowdsecurity/http-cve.yaml index 5b67f32..9807935 100644 --- a/crowdsec/hub/collections/crowdsecurity/http-cve.yaml +++ b/crowdsec/hub/collections/crowdsecurity/http-cve.yaml @@ -22,7 +22,9 @@ scenarios: - crowdsecurity/CVE-2022-44877 - crowdsecurity/CVE-2019-18935 - crowdsecurity/netgear_rce + - crowdsecurity/CVE-2023-22515 author: crowdsecurity +description: "Detect CVE exploitation in http logs" tags: - web - exploit diff --git a/crowdsec/hub/parsers/s02-enrich/crowdsecurity/http-logs.yaml b/crowdsec/hub/parsers/s02-enrich/crowdsecurity/http-logs.yaml index ede7bd6..96d0494 100644 --- a/crowdsec/hub/parsers/s02-enrich/crowdsecurity/http-logs.yaml +++ b/crowdsec/hub/parsers/s02-enrich/crowdsecurity/http-logs.yaml @@ -30,4 +30,4 @@ nodes: - parsed: file_name expression: evt.Parsed.file_frag + evt.Parsed.file_ext - parsed: static_ressource - expression: "Upper(evt.Parsed.file_ext) in ['.JPG', '.CSS', '.JS', '.JPEG', '.PNG', '.SVG', '.MAP', '.ICO', '.OTF', '.GIF', '.MP3', '.MP4', '.WOFF', '.WOFF2', '.TTF', '.OTF', '.EOT', '.WEBP', '.WAV', '.GZ', '.BROTLI', '.BVR', '.TS', '.BMP'] ? 'true' : 'false'" + expression: "Upper(evt.Parsed.file_ext) in ['.JPG', '.CSS', '.JS', '.JPEG', '.PNG', '.SVG', '.MAP', '.ICO', '.OTF', '.GIF', '.MP3', '.MP4', '.WOFF', '.WOFF2', '.TTF', '.OTF', '.EOT', '.WEBP', '.WAV', '.GZ', '.BROTLI', '.BVR', '.TS', '.BMP', '.AVIF'] ? 'true' : 'false'" diff --git a/crowdsec/hub/scenarios/crowdsecurity/CVE-2019-18935.yaml b/crowdsec/hub/scenarios/crowdsecurity/CVE-2019-18935.yaml index bcc81a9..58ce6d9 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/CVE-2019-18935.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/CVE-2019-18935.yaml @@ -9,3 +9,12 @@ blackhole: 2m labels: type: exploit remediation: true + classification: + - attack.T1595 + - attack.T1190 + - cve.CVE-2019-18935 + spoofable: 0 + confidence: 3 + behavior: "http:exploit" + label: "Telerik CVE-2019-18935" + service: telerik diff --git a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-26134.yaml b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-26134.yaml index 0517e7b..4325da2 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-26134.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-26134.yaml @@ -8,3 +8,12 @@ groupby: "evt.Meta.source_ip" labels: type: exploit remediation: true + classification: + - attack.T1595 + - attack.T1190 + - cve.CVE-2022-26134 + spoofable: 0 + confidence: 3 + behavior: "http:exploit" + service: atlassian-confluence + label: "Confluence CVE-2022-26134" diff --git a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-35914.yaml b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-35914.yaml index ae63f14..494f02b 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-35914.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-35914.yaml @@ -8,3 +8,12 @@ groupby: "evt.Meta.source_ip" labels: type: exploit remediation: true + classification: + - attack.T1595 + - attack.T1190 + - cve.CVE-2022-35914 + spoofable: 0 + confidence: 3 + behavior: "http:exploit" + service: glpi + label: "GLPI CVE-2022-35914" diff --git a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-37042.yaml b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-37042.yaml index 778f45e..c4ada28 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-37042.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-37042.yaml @@ -3,16 +3,24 @@ type: trigger name: crowdsecurity/CVE-2022-37042 description: "Detect CVE-2022-37042 exploits" filter: | - ( - Upper(evt.Meta.http_path) contains Upper('/service/extension/backup/mboximport?account-name=admin&ow=2&no-switch=1&append=1') || - Upper(evt.Meta.http_path) contains Upper('/service/extension/backup/mboximport?account-name=admin&account-status=1&ow=cmd') - ) - and evt.Meta.http_status startsWith ('40') and - Upper(evt.Meta.http_verb) == 'POST' - + ( + Upper(evt.Meta.http_path) contains Upper('/service/extension/backup/mboximport?account-name=admin&ow=2&no-switch=1&append=1') || + Upper(evt.Meta.http_path) contains Upper('/service/extension/backup/mboximport?account-name=admin&account-status=1&ow=cmd') + ) + and evt.Meta.http_status startsWith ('40') and + Upper(evt.Meta.http_verb) == 'POST' blackhole: 2m groupby: "evt.Meta.source_ip" labels: type: exploit remediation: true + classification: + - attack.T1595 + - attack.T1190 + - cve.CVE-2022-37042 + spoofable: 0 + confidence: 3 + behavior: "http:exploit" + label: "ZCS CVE-2022-37042" + service: zimbra diff --git a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-40684.yaml b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-40684.yaml index e81e3b7..546ba74 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-40684.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-40684.yaml @@ -8,4 +8,12 @@ groupby: "evt.Meta.source_ip" blackhole: 2m labels: type: exploit - remediation: true \ No newline at end of file + remediation: true + classification: + - attack.T1548 + - cve.CVE-2022-40684 + spoofable: 0 + confidence: 3 + behavior: "http:exploit" + label: "Fortinet CVE-2022-40684" + service: fortinet diff --git a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-41082.yaml b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-41082.yaml index 2fdb874..7bf75c7 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-41082.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-41082.yaml @@ -3,11 +3,20 @@ type: trigger name: crowdsecurity/CVE-2022-41082 description: "Detect CVE-2022-41082 exploits" filter: | - Upper(evt.Meta.http_path) contains Upper('/autodiscover/autodiscover.json') && - Upper(evt.Parsed.http_args) contains Upper('powershell') + Upper(evt.Meta.http_path) contains Upper('/autodiscover/autodiscover.json') && + Upper(evt.Parsed.http_args) contains Upper('powershell') blackhole: 1m groupby: "evt.Meta.source_ip" labels: type: exploit remediation: true + classification: + - attack.T1595 + - attack.T1190 + - cve.CVE-2022-41082 + spoofable: 0 + confidence: 3 + behavior: "http:exploit" + service: exchange + label: "Microsoft Exchange CVE-2022-41082" diff --git a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-41697.yaml b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-41697.yaml index cc21599..f3975fc 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-41697.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-41697.yaml @@ -2,13 +2,21 @@ type: leaky name: crowdsecurity/CVE-2022-41697 description: "Detect CVE-2022-41697 enumeration" filter: | - Upper(evt.Meta.http_path) contains Upper('/ghost/api/admin/session') && - Upper(evt.Parsed.verb) == 'POST' && - evt.Meta.http_status == '404' + Upper(evt.Meta.http_path) contains Upper('/ghost/api/admin/session') && + Upper(evt.Parsed.verb) == 'POST' && + evt.Meta.http_status == '404' leakspeed: "10s" capacity: 5 blackhole: 1m groupby: "evt.Meta.source_ip" labels: type: exploit - remediation: true \ No newline at end of file + remediation: true + classification: + - attack.T1589 + - cve.CVE-2022-41697 + spoofable: 0 + confidence: 3 + behavior: "http:exploit" + label: "Ghost CVE-2022-41697" + service: ghost diff --git a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-42889.yaml b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-42889.yaml index 6d912d8..a5cf31b 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-42889.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-42889.yaml @@ -9,9 +9,18 @@ filter: | or Upper(PathUnescape(evt.Meta.http_path)) contains Upper('${url:UTF-8:') or - Upper(PathUnescape(evt.Meta.http_path)) contains Upper('${dns:address|') + Upper(PathUnescape(evt.Meta.http_path)) contains Upper('${dns:address|') blackhole: 1m groupby: "evt.Meta.source_ip" labels: type: exploit remediation: true + classification: + - attack.T1595 + - attack.T1190 + - cve.CVE-2022-42889 + spoofable: 0 + confidence: 3 + behavior: "http:exploit" + label: "Text4Shell CVE-2022-42889" + service: apache diff --git a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-44877.yaml b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-44877.yaml index 77ab520..e233b68 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-44877.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-44877.yaml @@ -3,13 +3,22 @@ type: trigger name: crowdsecurity/CVE-2022-44877 description: "Detect CVE-2022-44877 exploits" filter: | - Lower(evt.Meta.http_path) contains '/index.php' && - Upper(evt.Parsed.verb) == 'POST' && - evt.Meta.http_status == '302' && - Lower(evt.Parsed.http_args) matches 'login=.*[$|%24][\\(|%28].*[\\)|%29]' + Lower(evt.Meta.http_path) contains '/index.php' && + Upper(evt.Parsed.verb) == 'POST' && + evt.Meta.http_status == '302' && + Lower(evt.Parsed.http_args) matches 'login=.*[$|%24][\\(|%28].*[\\)|%29]' blackhole: 1m groupby: "evt.Meta.source_ip" labels: type: exploit remediation: true + classification: + - attack.T1595 + - attack.T1190 + - cve.CVE-2022-44877 + spoofable: 0 + confidence: 3 + behavior: "http:exploit" + label: "Centos Webpanel CVE-2022-44877" + service: centos diff --git a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-46169.yaml b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-46169.yaml index 503da25..d39ed33 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-46169.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/CVE-2022-46169.yaml @@ -2,10 +2,10 @@ type: leaky name: crowdsecurity/CVE-2022-46169-bf description: "Detect CVE-2022-46169 brute forcing" filter: | - Upper(evt.Meta.http_path) contains Upper('/remote_agent.php') && - Upper(evt.Parsed.verb) == 'GET' && - Lower(evt.Parsed.http_args) contains 'host_id' && - Lower(evt.Parsed.http_args) contains 'local_data_ids' + Upper(evt.Meta.http_path) contains Upper('/remote_agent.php') && + Upper(evt.Parsed.verb) == 'GET' && + Lower(evt.Parsed.http_args) contains 'host_id' && + Lower(evt.Parsed.http_args) contains 'local_data_ids' leakspeed: "10s" capacity: 5 blackhole: 1m @@ -13,17 +13,34 @@ groupby: "evt.Meta.source_ip" labels: type: exploit remediation: true + classification: + - attack.T1592 + - cve.CVE-2022-46169 + spoofable: 0 + confidence: 3 + behavior: "http:bruteforce" + label: "Cacti CVE-2022-46169" + service: cacti --- type: trigger name: crowdsecurity/CVE-2022-46169-cmd description: "Detect CVE-2022-46169 cmd injection" filter: | - Upper(evt.Meta.http_path) contains Upper('/remote_agent.php') && - Upper(evt.Parsed.verb) == 'GET' && - Lower(evt.Parsed.http_args) contains 'action=polldata' && - Lower(evt.Parsed.http_args) matches 'poller_id=.*(;|%3b)' + Upper(evt.Meta.http_path) contains Upper('/remote_agent.php') && + Upper(evt.Parsed.verb) == 'GET' && + Lower(evt.Parsed.http_args) contains 'action=polldata' && + Lower(evt.Parsed.http_args) matches 'poller_id=.*(;|%3b)' blackhole: 1m groupby: "evt.Meta.source_ip" labels: type: exploit - remediation: true \ No newline at end of file + remediation: true + classification: + - attack.T1595 + - attack.T1190 + - cve.CVE-2022-46169 + spoofable: 0 + confidence: 3 + behavior: "http:exploit" + label: "Cacti CVE-2022-46169" + service: cacti diff --git a/crowdsec/hub/scenarios/crowdsecurity/CVE-2023-22515.yaml b/crowdsec/hub/scenarios/crowdsecurity/CVE-2023-22515.yaml new file mode 100644 index 0000000..4adcdcb --- /dev/null +++ b/crowdsec/hub/scenarios/crowdsecurity/CVE-2023-22515.yaml @@ -0,0 +1,22 @@ +## CVE-2023-22515 +type: trigger +name: crowdsecurity/CVE-2023-22515 +description: "Detect CVE-2023-22515 exploitation" +filter: | + Lower(evt.Parsed.file_ext) == '.action' && + (Lower(evt.Parsed.file_dir) contains '/setup' || Lower(evt.Parsed.file_frag) == 'server-info') && + evt.Parsed.file_frag != nil +blackhole: 1m +groupby: "evt.Meta.source_ip" +labels: + type: exploit + remediation: true + classification: + - attack.T1595 + - attack.T1190 + - cve.CVE-2023-22515 + spoofable: 0 + confidence: 1 + behavior: "http:exploit" + label: "Confluence CVE-2023-22515" + service: confluence \ No newline at end of file diff --git a/crowdsec/hub/scenarios/crowdsecurity/apache_log4j2_cve-2021-44228.yaml b/crowdsec/hub/scenarios/crowdsecurity/apache_log4j2_cve-2021-44228.yaml index b381bec..bd41e85 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/apache_log4j2_cve-2021-44228.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/apache_log4j2_cve-2021-44228.yaml @@ -19,5 +19,13 @@ data: groupby: "evt.Meta.source_ip" blackhole: 2m labels: - type: exploit + service: apache + confidence: 3 + spoofable: 0 + classification: + - attack.T1595 + - attack.T1190 + - cve.CVE-2021-44228 + behavior: "http:exploit" + label: "Log4j CVE-2021-44228" remediation: true diff --git a/crowdsec/hub/scenarios/crowdsecurity/f5-big-ip-cve-2020-5902.yaml b/crowdsec/hub/scenarios/crowdsecurity/f5-big-ip-cve-2020-5902.yaml index cbbcecc..51cd423 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/f5-big-ip-cve-2020-5902.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/f5-big-ip-cve-2020-5902.yaml @@ -12,5 +12,13 @@ filter: | groupby: "evt.Meta.source_ip" blackhole: 2m labels: - type: exploit + confidence: 3 + spoofable: 0 + classification: + - attack.T1190 + - attack.T1595 + - cve.CVE-2020-5902 + behavior: "http:exploit" + label: "CVE-2020-5902" remediation: true + service: f5 diff --git a/crowdsec/hub/scenarios/crowdsecurity/fortinet-cve-2018-13379.yaml b/crowdsec/hub/scenarios/crowdsecurity/fortinet-cve-2018-13379.yaml index c9fe73a..b4178c1 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/fortinet-cve-2018-13379.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/fortinet-cve-2018-13379.yaml @@ -8,5 +8,13 @@ filter: | groupby: "evt.Meta.source_ip" blackhole: 2m labels: - type: exploit + confidence: 3 + spoofable: 0 + classification: + - attack.T1190 + - attack.T1595 + - cve.CVE-2018-13379 + behavior: "http:exploit" + label: "CVE-2018-13379" remediation: true + service: fortinet diff --git a/crowdsec/hub/scenarios/crowdsecurity/grafana-cve-2021-43798.yaml b/crowdsec/hub/scenarios/crowdsecurity/grafana-cve-2021-43798.yaml index b956392..7c545e9 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/grafana-cve-2021-43798.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/grafana-cve-2021-43798.yaml @@ -10,5 +10,13 @@ filter: | groupby: "evt.Meta.source_ip" blackhole: 2m labels: - type: exploit + service: grafana + confidence: 3 + spoofable: 0 + classification: + - attack.T1190 + - attack.T1595 + - cve.CVE-2021-43798 + behavior: "http:exploit" + label: "CVE-2021-43798" remediation: true diff --git a/crowdsec/hub/scenarios/crowdsecurity/http-backdoors-attempts.yaml b/crowdsec/hub/scenarios/crowdsecurity/http-backdoors-attempts.yaml index e0bf4c3..846e817 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/http-backdoors-attempts.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/http-backdoors-attempts.yaml @@ -13,6 +13,11 @@ capacity: 1 leakspeed: 5s blackhole: 5m labels: + confidence: 3 + spoofable: 0 + classification: + - attack.T1595 + behavior: "http:exploit" + label: "scanning for backdoors" service: http - type: discovery remediation: true diff --git a/crowdsec/hub/scenarios/crowdsecurity/http-bad-user-agent.yaml b/crowdsec/hub/scenarios/crowdsecurity/http-bad-user-agent.yaml index 087d9e4..7c91e2c 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/http-bad-user-agent.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/http-bad-user-agent.yaml @@ -16,5 +16,11 @@ leakspeed: 1m groupby: "evt.Meta.source_ip" blackhole: 2m labels: - type: scan + confidence: 1 + spoofable: 0 + classification: + - attack.T1595 + behavior: "http:scan" + label: "detection of bad user-agents" + service: http remediation: true diff --git a/crowdsec/hub/scenarios/crowdsecurity/http-crawl-non_statics.yaml b/crowdsec/hub/scenarios/crowdsecurity/http-crawl-non_statics.yaml index 7b994d2..73cd2b2 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/http-crawl-non_statics.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/http-crawl-non_statics.yaml @@ -11,6 +11,11 @@ cache_size: 5 groupby: "evt.Meta.source_ip + '/' + evt.Parsed.target_fqdn" blackhole: 1m labels: - service: http - type: crawl - remediation: true + confidence: 1 + spoofable: 0 + classification: + - attack.T1595 + behavior: "http:crawl" + service: http + label: "detection of aggressive crawl" + remediation: true diff --git a/crowdsec/hub/scenarios/crowdsecurity/http-cve-2021-41773.yaml b/crowdsec/hub/scenarios/crowdsecurity/http-cve-2021-41773.yaml index 19ccce6..90efb77 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/http-cve-2021-41773.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/http-cve-2021-41773.yaml @@ -11,5 +11,13 @@ filter: | groupby: "evt.Meta.source_ip" blackhole: 2m labels: - type: scan + confidence: 3 + spoofable: 0 + classification: + - attack.T1190 + - attack.T1595 + - cve.CVE-2021-41773 + behavior: "http:exploit" + label: "CVE-2021-41773" + service: apache remediation: true diff --git a/crowdsec/hub/scenarios/crowdsecurity/http-cve-2021-42013.yaml b/crowdsec/hub/scenarios/crowdsecurity/http-cve-2021-42013.yaml index 0063d06..b5985d4 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/http-cve-2021-42013.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/http-cve-2021-42013.yaml @@ -10,5 +10,13 @@ filter: | groupby: "evt.Meta.source_ip" blackhole: 2m labels: - type: scan + service: apache + confidence: 3 + spoofable: 0 + classification: + - attack.T1190 + - attack.T1595 + - cve.CVE-2021-42013 + behavior: "http:exploit" + label: "CVE-2021-42013" remediation: true diff --git a/crowdsec/hub/scenarios/crowdsecurity/http-generic-bf.yaml b/crowdsec/hub/scenarios/crowdsecurity/http-generic-bf.yaml index b7348e7..d920cf5 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/http-generic-bf.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/http-generic-bf.yaml @@ -9,9 +9,14 @@ capacity: 5 leakspeed: "10s" blackhole: 1m labels: - service: http - type: bf - remediation: true + confidence: 3 + spoofable: 0 + classification: + - attack.T1110 + behavior: "http:bruteforce" + label: "http bruteforce" + service: http + remediation: true --- # Generic 401 Authorization Errors type: leaky @@ -24,9 +29,14 @@ capacity: 5 leakspeed: "10s" blackhole: 1m labels: - service: http - type: bf - remediation: true + confidence: 3 + spoofable: 0 + classification: + - attack.T1110 + behavior: "http:bruteforce" + label: "http bruteforce" + service: http + remediation: true --- # Generic 403 Forbidden (Authorization) Errors type: leaky @@ -39,6 +49,11 @@ capacity: 5 leakspeed: "10s" blackhole: 1m labels: - service: http - type: bf - remediation: true + confidence: 3 + spoofable: 0 + classification: + - attack.T1110 + behavior: "http:bruteforce" + label: "http bruteforce" + service: http + remediation: true diff --git a/crowdsec/hub/scenarios/crowdsecurity/http-open-proxy.yaml b/crowdsec/hub/scenarios/crowdsecurity/http-open-proxy.yaml index a192a65..85ddba9 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/http-open-proxy.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/http-open-proxy.yaml @@ -5,6 +5,12 @@ description: "Detect scan for open proxy" filter: "evt.Meta.log_type == 'http_access-log' && evt.Meta.http_status in ['400','405'] && (evt.Parsed.verb == 'CONNECT' || evt.Parsed.request matches '^http[s]?://')" blackhole: 2m labels: - service: http - type: scan - remediation: true + service: http + type: scan + remediation: true + classification: + - attack.T1595 + behavior: "http:scan" + label: "HTTP Open Proxy Probing" + spoofable: 0 + confidence: 3 diff --git a/crowdsec/hub/scenarios/crowdsecurity/http-path-traversal-probing.yaml b/crowdsec/hub/scenarios/crowdsecurity/http-path-traversal-probing.yaml index 642aba3..f242236 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/http-path-traversal-probing.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/http-path-traversal-probing.yaml @@ -15,6 +15,11 @@ reprocess: true leakspeed: 10s blackhole: 2m labels: - service: http - type: scan - remediation: true + remediation: true + classification: + - attack.T1595.002 + behavior: "http:exploit" + label: "HTTP Path Traversal Exploit" + service: http + spoofable: 0 + confidence: 3 diff --git a/crowdsec/hub/scenarios/crowdsecurity/http-probing.yaml b/crowdsec/hub/scenarios/crowdsecurity/http-probing.yaml index 7fe7a19..d32d0be 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/http-probing.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/http-probing.yaml @@ -11,6 +11,11 @@ reprocess: true leakspeed: "10s" blackhole: 5m labels: - service: http - type: scan - remediation: true + remediation: true + classification: + - attack.T1595.003 + behavior: "http:scan" + label: "HTTP Probing" + spoofable: 0 + service: http + confidence: 1 diff --git a/crowdsec/hub/scenarios/crowdsecurity/http-sensitive-files.yaml b/crowdsec/hub/scenarios/crowdsecurity/http-sensitive-files.yaml index 823b8c2..19cdf94 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/http-sensitive-files.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/http-sensitive-files.yaml @@ -14,6 +14,11 @@ capacity: 4 leakspeed: 5s blackhole: 5m labels: - service: http - type: discovery remediation: true + classification: + - attack.T1595.003 + behavior: "http:scan" + label: "Access to sensitive files over HTTP" + spoofable: 0 + service: http + confidence: 3 diff --git a/crowdsec/hub/scenarios/crowdsecurity/http-sqli-probing.yaml b/crowdsec/hub/scenarios/crowdsecurity/http-sqli-probing.yaml index bb18152..28c5cfd 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/http-sqli-probing.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/http-sqli-probing.yaml @@ -15,6 +15,11 @@ blackhole: 5m #low false positives approach : we require distinct payloads to avoid false positives distinct: evt.Parsed.http_args labels: - service: http - type: sqli_probing remediation: true + classification: + - attack.T1595.002 + behavior: "http:exploit" + label: "SQL Injection Attempt" + spoofable: 0 + service: http + confidence: 3 diff --git a/crowdsec/hub/scenarios/crowdsecurity/http-xss-probing.yaml b/crowdsec/hub/scenarios/crowdsecurity/http-xss-probing.yaml index 058593d..8ac30a4 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/http-xss-probing.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/http-xss-probing.yaml @@ -15,6 +15,11 @@ blackhole: 5m #low false positives approach : we require distinct payloads to avoid false positives distinct: evt.Parsed.http_args labels: - service: http - type: xss_probing remediation: true + classification: + - attack.T1595.002 + behavior: "http:exploit" + label: "XSS Attempt" + spoofable: 0 + service: http + confidence: 3 diff --git a/crowdsec/hub/scenarios/crowdsecurity/jira_cve-2021-26086.yaml b/crowdsec/hub/scenarios/crowdsecurity/jira_cve-2021-26086.yaml index e655c7d..66406db 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/jira_cve-2021-26086.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/jira_cve-2021-26086.yaml @@ -12,5 +12,13 @@ data: groupby: "evt.Meta.source_ip" blackhole: 2m labels: - type: exploit remediation: true + classification: + - attack.T1595.001 + - attack.T1190 + - cve.CVE-2021-26086 + behavior: "http:exploit" + label: "Jira CVE-2021-26086 exploitation" + spoofable: 0 + service: jira + confidence: 3 diff --git a/crowdsec/hub/scenarios/crowdsecurity/mysql-bf.yaml b/crowdsec/hub/scenarios/crowdsecurity/mysql-bf.yaml index e10fff0..11e926b 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/mysql-bf.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/mysql-bf.yaml @@ -9,6 +9,11 @@ capacity: 5 groupby: evt.Meta.source_ip blackhole: 5m labels: - service: mysql - type: bruteforce - remediation: true + remediation: true + confidence: 3 + spoofable: 0 + classification: + - attack.T1110 + behavior: "database:bruteforce" + label: "MySQL Bruteforce" + service: mysql diff --git a/crowdsec/hub/scenarios/crowdsecurity/netgear_rce.yaml b/crowdsec/hub/scenarios/crowdsecurity/netgear_rce.yaml index e4f782b..5ac619a 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/netgear_rce.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/netgear_rce.yaml @@ -6,8 +6,15 @@ filter: | evt.Meta.log_type in ['http_access-log', 'http_error-log'] && Lower(QueryUnescape(evt.Meta.http_path)) startsWith Lower('/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=') groupby: "evt.Meta.source_ip" blackhole: 2m -references: +references: - "https://www.exploit-db.com/exploits/25978" labels: - type: exploit + confidence: 3 + spoofable: 0 + classification: + - attack.T1595 + - attack.T1190 + behavior: "http:exploit" + label: "Netgear RCE" + service: netgear remediation: true diff --git a/crowdsec/hub/scenarios/crowdsecurity/nginx-req-limit-exceeded.yaml b/crowdsec/hub/scenarios/crowdsecurity/nginx-req-limit-exceeded.yaml index 771b7c4..9dff73f 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/nginx-req-limit-exceeded.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/nginx-req-limit-exceeded.yaml @@ -8,6 +8,11 @@ capacity: 5 groupby: evt.Meta.source_ip blackhole: 5m labels: - service: nginx - type: bruteforce - remediation: true + remediation: true + confidence: 2 + spoofable: 2 + classification: + - attack.T1498 + behavior: "http:dos" + label: "Nginx request limit exceeded" + service: http diff --git a/crowdsec/hub/scenarios/crowdsecurity/pulse-secure-sslvpn-cve-2019-11510.yaml b/crowdsec/hub/scenarios/crowdsecurity/pulse-secure-sslvpn-cve-2019-11510.yaml index dd5a67d..7622e9b 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/pulse-secure-sslvpn-cve-2019-11510.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/pulse-secure-sslvpn-cve-2019-11510.yaml @@ -10,5 +10,12 @@ filter: | groupby: "evt.Meta.source_ip" blackhole: 2m labels: - type: exploit remediation: true + confidence: 3 + spoofable: 0 + classification: + - attack.T1190 + - cve.CVE-2019-11510 + behavior: "http:exploit" + label: "Pulse Secure CVE-2019-11510" + service: pulse-secure diff --git a/crowdsec/hub/scenarios/crowdsecurity/spring4shell_cve-2022-22965.yaml b/crowdsec/hub/scenarios/crowdsecurity/spring4shell_cve-2022-22965.yaml index 8bfc4b7..223afdc 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/spring4shell_cve-2022-22965.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/spring4shell_cve-2022-22965.yaml @@ -8,5 +8,12 @@ filter: | groupby: "evt.Meta.source_ip" blackhole: 2m labels: - type: exploit remediation: true + confidence: 3 + spoofable: 0 + classification: + - attack.T1190 + - cve.CVE-2022-22965 + behavior: "http:exploit" + label: "Spring4shell CVE-2022-22965" + service: spring diff --git a/crowdsec/hub/scenarios/crowdsecurity/ssh-bf.yaml b/crowdsec/hub/scenarios/crowdsecurity/ssh-bf.yaml index 7b350e4..84fab8c 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/ssh-bf.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/ssh-bf.yaml @@ -11,9 +11,14 @@ groupby: evt.Meta.source_ip blackhole: 1m reprocess: true labels: - service: ssh - type: bruteforce - remediation: true + service: ssh + confidence: 3 + spoofable: 0 + classification: + - attack.T1110 + label: "SSH Bruteforce" + behavior: "ssh:bruteforce" + remediation: true --- # ssh user-enum type: leaky @@ -26,7 +31,11 @@ leakspeed: 10s capacity: 5 blackhole: 1m labels: - service: ssh - type: bruteforce - remediation: true - + service: ssh + remediation: true + confidence: 3 + spoofable: 0 + classification: + - attack.T1589 + behavior: "ssh:bruteforce" + label: "SSH Bruteforce" diff --git a/crowdsec/hub/scenarios/crowdsecurity/ssh-slow-bf.yaml b/crowdsec/hub/scenarios/crowdsecurity/ssh-slow-bf.yaml index 8d64c1d..af3ba74 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/ssh-slow-bf.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/ssh-slow-bf.yaml @@ -11,9 +11,14 @@ groupby: evt.Meta.source_ip blackhole: 1m reprocess: true labels: - service: ssh - type: bruteforce - remediation: true + service: ssh + remediation: true + confidence: 3 + spoofable: 0 + classification: + - attack.T1110 + behavior: "ssh:bruteforce" + label: "SSH Bruteforce" --- # ssh user-enum type: leaky @@ -26,7 +31,11 @@ leakspeed: 60s capacity: 10 blackhole: 1m labels: - service: ssh - type: bruteforce - remediation: true - + service: ssh + remediation: true + confidence: 3 + spoofable: 0 + classification: + - attack.T1110 + behavior: "ssh:bruteforce" + label: "SSH Bruteforce" diff --git a/crowdsec/hub/scenarios/crowdsecurity/thinkphp-cve-2018-20062.yaml b/crowdsec/hub/scenarios/crowdsecurity/thinkphp-cve-2018-20062.yaml index 7a736fc..a5adb74 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/thinkphp-cve-2018-20062.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/thinkphp-cve-2018-20062.yaml @@ -12,5 +12,13 @@ data: groupby: "evt.Meta.source_ip" blackhole: 2m labels: - type: exploit + confidence: 3 + spoofable: 0 + classification: + - attack.T1190 + - attack.T1595 + - cve.CVE-2018-20062 + behavior: "http:exploit" + label: "ThinkPHP CVE-2018-20062" remediation: true + service: thinkphp diff --git a/crowdsec/hub/scenarios/crowdsecurity/vmware-cve-2022-22954.yaml b/crowdsec/hub/scenarios/crowdsecurity/vmware-cve-2022-22954.yaml index c7a8ae6..56ca70c 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/vmware-cve-2022-22954.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/vmware-cve-2022-22954.yaml @@ -7,5 +7,13 @@ filter: | groupby: "evt.Meta.source_ip" blackhole: 2m labels: - type: exploit + confidence: 3 + spoofable: 0 + classification: + - attack.T1190 + - attack.T1595 + - cve.CVE-2022-22954 + behavior: "vm-management:exploit" + label: "VMWARE CVE-2022-22954" remediation: true + service: vmware diff --git a/crowdsec/hub/scenarios/crowdsecurity/vmware-vcenter-vmsa-2021-0027.yaml b/crowdsec/hub/scenarios/crowdsecurity/vmware-vcenter-vmsa-2021-0027.yaml index d03eaba..7865695 100644 --- a/crowdsec/hub/scenarios/crowdsecurity/vmware-vcenter-vmsa-2021-0027.yaml +++ b/crowdsec/hub/scenarios/crowdsecurity/vmware-vcenter-vmsa-2021-0027.yaml @@ -7,5 +7,13 @@ filter: | groupby: "evt.Meta.source_ip" blackhole: 2m labels: - type: exploit + confidence: 3 + spoofable: 0 + classification: + - attack.T1190 + - attack.T1595 + - cve.CVE-2021-0027 + behavior: "vm-management:exploit" + label: "VMWARE VCenter VMSA CVE-2021-0027" remediation: true + service: vmware diff --git a/crowdsec/hub/scenarios/ltsich/http-w00tw00t.yaml b/crowdsec/hub/scenarios/ltsich/http-w00tw00t.yaml index b62e6b6..eb5a274 100644 --- a/crowdsec/hub/scenarios/ltsich/http-w00tw00t.yaml +++ b/crowdsec/hub/scenarios/ltsich/http-w00tw00t.yaml @@ -7,6 +7,11 @@ filter: "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name contains groupby: evt.Meta.source_ip blackhole: 5m labels: - service: http - type: scan - remediation: true + service: http + classification: + - attack.T1595 + spoofable: 0 + confidence: 3 + behavior: "http:scan" + label: "w00t w00t Scanner" + remediation: true diff --git a/crowdsec/scenarios/CVE-2023-22515.yaml b/crowdsec/scenarios/CVE-2023-22515.yaml new file mode 120000 index 0000000..0a4dbca --- /dev/null +++ b/crowdsec/scenarios/CVE-2023-22515.yaml @@ -0,0 +1 @@ +/etc/crowdsec/hub/scenarios/crowdsecurity/CVE-2023-22515.yaml \ No newline at end of file diff --git a/csf/changelog.txt b/csf/changelog.txt index 214685b..1367003 100644 --- a/csf/changelog.txt +++ b/csf/changelog.txt @@ -1,5 +1,15 @@ ChangeLog: +14.20 - Modified MaxMind URLs to use https + + Fixed DCOTYPE print order for integrated UI login + + Added "Require all granted" to Messenger v3 .htaccess generation + + Normalise source IP during connection tracking for IPv6 comparisons + + Fixed regression for some IMAP logon failure detections + 14.19 - Switch to using iptables-nft if it exists in /usr/sbin/iptables-nft Added IO::Handle::clearerr() call before reading data from a log file diff --git a/csf/csf.ignore b/csf/csf.ignore index 68609f0..c289e55 100644 --- a/csf/csf.ignore +++ b/csf/csf.ignore @@ -12,6 +12,7 @@ # local network 127.0.0.1 192.168.1.0/24 +10.208.1.0/24 # GZD 85.121.136.12/32 @@ -25,26 +26,12 @@ # Madrivo 208.68.37.110/32 -# Vodafone -46.97.176.82 - -# Digi -86.126.37.205 - # RND 82.76.35.226 82.76.35.228 86.120.251.224 -# CyberGhost VPN -191.101.61.25 -185.44.147.225 -185.44.147.129 -94.69.148.225 -94.70.109.113 -94.68.45.238 +# Digi +188.26.53.107 -# TEMP -80.106.207.66 # Halkidiki - -5.12.34.98 +188.25.217.58 diff --git a/csf/version.txt b/csf/version.txt index 006465e..2d06633 100644 --- a/csf/version.txt +++ b/csf/version.txt @@ -1 +1 @@ -14.19 \ No newline at end of file +14.20 \ No newline at end of file diff --git a/httpd/conf.d/ssl.conf b/httpd/conf.d/ssl.conf deleted file mode 100644 index d28adf3..0000000 --- a/httpd/conf.d/ssl.conf +++ /dev/null @@ -1,203 +0,0 @@ -# -# When we also provide SSL we have to listen to the -# standard HTTPS port in addition. -# -Listen 443 https - -## -## SSL Global Context -## -## All SSL configuration in this context applies both to -## the main server and all SSL-enabled virtual hosts. -## - -# Pass Phrase Dialog: -# Configure the pass phrase gathering process. -# The filtering dialog program (`builtin' is a internal -# terminal dialog) has to provide the pass phrase on stdout. -SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog - -# Inter-Process Session Cache: -# Configure the SSL Session Cache: First the mechanism -# to use and second the expiring timeout (in seconds). -SSLSessionCache shmcb:/run/httpd/sslcache(512000) -SSLSessionCacheTimeout 300 - -# -# Use "SSLCryptoDevice" to enable any supported hardware -# accelerators. Use "openssl engine -v" to list supported -# engine names. NOTE: If you enable an accelerator and the -# server does not start, consult the error logs and ensure -# your accelerator is functioning properly. -# -SSLCryptoDevice builtin -#SSLCryptoDevice ubsec - -## -## SSL Virtual Host Context -## - - - -# General setup for the virtual host, inherited from global configuration -#DocumentRoot "/var/www/html" -#ServerName www.example.com:443 - -# Use separate log files for the SSL virtual host; note that LogLevel -# is not inherited from httpd.conf. -ErrorLog logs/ssl_error_log -TransferLog logs/ssl_access_log -LogLevel warn - -# SSL Engine Switch: -# Enable/Disable SSL for this virtual host. -SSLEngine on - -# List the protocol versions which clients are allowed to connect with. -# The OpenSSL system profile is used by default. See -# update-crypto-policies(8) for more details. -#SSLProtocol all -SSLv3 -#SSLProxyProtocol all -SSLv3 - -# User agents such as web browsers are not configured for the user's -# own preference of either security or performance, therefore this -# must be the prerogative of the web server administrator who manages -# cpu load versus confidentiality, so enforce the server's cipher order. -SSLHonorCipherOrder on - -# SSL Cipher Suite: -# List the ciphers that the client is permitted to negotiate. -# See the mod_ssl documentation for a complete list. -# The OpenSSL system profile is configured by default. See -# update-crypto-policies(8) for more details. -SSLCipherSuite PROFILE=SYSTEM -SSLProxyCipherSuite PROFILE=SYSTEM - -# Point SSLCertificateFile at a PEM encoded certificate. If -# the certificate is encrypted, then you will be prompted for a -# pass phrase. Note that restarting httpd will prompt again. Keep -# in mind that if you have both an RSA and a DSA certificate you -# can configure both in parallel (to also allow the use of DSA -# ciphers, etc.) -# Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt) -# require an ECC certificate which can also be configured in -# parallel. -SSLCertificateFile /etc/pki/tls/certs/localhost.crt - -# Server Private Key: -# If the key is not combined with the certificate, use this -# directive to point at the key file. Keep in mind that if -# you've both a RSA and a DSA private key you can configure -# both in parallel (to also allow the use of DSA ciphers, etc.) -# ECC keys, when in use, can also be configured in parallel -SSLCertificateKeyFile /etc/pki/tls/private/localhost.key - -# Server Certificate Chain: -# Point SSLCertificateChainFile at a file containing the -# concatenation of PEM encoded CA certificates which form the -# certificate chain for the server certificate. Alternatively -# the referenced file can be the same as SSLCertificateFile -# when the CA certificates are directly appended to the server -# certificate for convenience. -#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt - -# Certificate Authority (CA): -# Set the CA certificate verification path where to find CA -# certificates for client authentication or alternatively one -# huge file containing all of them (file must be PEM encoded) -#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt - -# Client Authentication (Type): -# Client certificate verification type and depth. Types are -# none, optional, require and optional_no_ca. Depth is a -# number which specifies how deeply to verify the certificate -# issuer chain before deciding the certificate is not valid. -#SSLVerifyClient require -#SSLVerifyDepth 10 - -# Access Control: -# With SSLRequire you can do per-directory access control based -# on arbitrary complex boolean expressions containing server -# variable checks and other lookup directives. The syntax is a -# mixture between C and Perl. See the mod_ssl documentation -# for more details. -# -#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \ -# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ -# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \ -# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ -# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ -# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ -# - -# SSL Engine Options: -# Set various options for the SSL engine. -# o FakeBasicAuth: -# Translate the client X.509 into a Basic Authorisation. This means that -# the standard Auth/DBMAuth methods can be used for access control. The -# user name is the `one line' version of the client's X.509 certificate. -# Note that no password is obtained from the user. Every entry in the user -# file needs this password: `xxj31ZMTZzkVA'. -# o ExportCertData: -# This exports two additional environment variables: SSL_CLIENT_CERT and -# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the -# server (always existing) and the client (only existing when client -# authentication is used). This can be used to import the certificates -# into CGI scripts. -# o StdEnvVars: -# This exports the standard SSL/TLS related `SSL_*' environment variables. -# Per default this exportation is switched off for performance reasons, -# because the extraction step is an expensive operation and is usually -# useless for serving static content. So one usually enables the -# exportation for CGI and SSI requests only. -# o StrictRequire: -# This denies access when "SSLRequireSSL" or "SSLRequire" applied even -# under a "Satisfy any" situation, i.e. when it applies access is denied -# and no other module can change it. -# o OptRenegotiate: -# This enables optimized SSL connection renegotiation handling when SSL -# directives are used in per-directory context. -#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire - - SSLOptions +StdEnvVars - - - SSLOptions +StdEnvVars - - -# SSL Protocol Adjustments: -# The safe and default but still SSL/TLS standard compliant shutdown -# approach is that mod_ssl sends the close notify alert but doesn't wait for -# the close notify alert from client. When you need a different shutdown -# approach you can use one of the following variables: -# o ssl-unclean-shutdown: -# This forces an unclean shutdown when the connection is closed, i.e. no -# SSL close notify alert is sent or allowed to be received. This violates -# the SSL/TLS standard but is needed for some brain-dead browsers. Use -# this when you receive I/O errors because of the standard approach where -# mod_ssl sends the close notify alert. -# o ssl-accurate-shutdown: -# This forces an accurate shutdown when the connection is closed, i.e. a -# SSL close notify alert is sent and mod_ssl waits for the close notify -# alert of the client. This is 100% SSL/TLS standard compliant, but in -# practice often causes hanging connections with brain-dead browsers. Use -# this only for browsers where you know that their SSL implementation -# works correctly. -# Notice: Most problems of broken clients are also related to the HTTP -# keep-alive facility, so you usually additionally want to disable -# keep-alive for those clients, too. Use variable "nokeepalive" for this. -# Similarly, one has to force some clients to use HTTP/1.0 to workaround -# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and -# "force-response-1.0" for this. -BrowserMatch "MSIE [2-5]" \ - nokeepalive ssl-unclean-shutdown \ - downgrade-1.0 force-response-1.0 - -# Per-Server Logging: -# The home of a custom SSL log file. Use this when you want a -# compact non-error SSL logfile on a virtual host basis. -CustomLog logs/ssl_request_log \ - "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" - - - diff --git a/kernel/install.d/dkms b/kernel/install.d/dkms deleted file mode 100755 index ae23156..0000000 --- a/kernel/install.d/dkms +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/sh - -if [ "$1" = "add" ]; then - /etc/kernel/postinst.d/dkms "$2" -fi - -if [ "$1" = "remove" ]; then - /etc/kernel/prerm.d/dkms "$2" -fi diff --git a/letsencrypt/archive/mully.898.ro/cert1.pem b/letsencrypt/archive/mully.898.ro/cert1.pem new file mode 100644 index 0000000..583b4d8 --- /dev/null +++ b/letsencrypt/archive/mully.898.ro/cert1.pem @@ -0,0 +1,29 @@ +-----BEGIN CERTIFICATE----- +MIIE8jCCA9qgAwIBAgISA0IxtFv7M2B7/oA8bcz3gs6uMA0GCSqGSIb3DQEBCwUA +MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD +EwJSMzAeFw0yMzEwMTIwNzIyMzdaFw0yNDAxMTAwNzIyMzZaMBcxFTATBgNVBAMT +DG11bGx5Ljg5OC5ybzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKlC +q1iS5CuJ24y/VhV8NzMxdaMuZKR5guthODPuqBJB8pzM9gvYJRBJB1S61rHaDdES +uyuznstUk+4pHgnJZjdTCAt+szH+UOnUl9zXKQuHJeT13ubPRUwpkMM5Q1A94mVg +WdODYRyIPzIzjGmgs+tXq+Y55eQ20kdOj/A+5TI/clEvE56kDDnuwWT1oL8Pmdm6 +CuTsrAgxKngXIcrnptHntm2H985bLSLa5pqAktqaZX69PckUTsdauDA7IzdDe3/y +XEGLCn8eZBKYQGBhsZ+1ZCg3FJZxqgZ4WanatJJpgFGPl+zCSMXuqjsXPmvktYLv +wb/uxZHz4+D1qYByXXcCAwEAAaOCAhswggIXMA4GA1UdDwEB/wQEAwIFoDAdBgNV +HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4E +FgQUFOIPOI5oTkyYdv2skijY/4y3zHAwHwYDVR0jBBgwFoAUFC6zF7dYVsuuUAlA +5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRwOi8vcjMu +by5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNyLm9yZy8w +JAYDVR0RBB0wG4IMbXVsbHkuODk4LnJvggttdWxseS5nby5ybzATBgNVHSAEDDAK +MAgGBmeBDAECATCCAQQGCisGAQQB1nkCBAIEgfUEgfIA8AB1ADtTd3U+LbmATosw +Wwb+QDtn2E/D9Me9AA0tcm/h+tQXAAABiyL7AXcAAAQDAEYwRAIgBcyus3MXawdM +3q7J5uqLGrhTgKxfkiMhWuf0b8cI58ACIBWVO5W7yOT1BdAkB3YlYEGZQmS/b9gi +3EOZQEiN8Ee4AHcA2ra/az+1tiKfm8K7XGvocJFxbLtRhIU0vaQ9MEjX+6sAAAGL +IvsBoQAABAMASDBGAiEAwmtz0nzjW0qPH0pJTU7sju7iHtD9xb/3xCrOcU0A3ZoC +IQDQHNQWMUK0pntk+JwzdgDcBcKRvTGEoZqHZVpK7DFlBjANBgkqhkiG9w0BAQsF +AAOCAQEAckgayucapcYCHsLb+EGEgCzM8ow9mB510nfuByckqcnIDxLQSGQuNmZg +wISZUJRqZkbJ3VBDf8uFAKcdcIFiCKa+LIp/kuz/HzImtMPF8LsK/iONYy/rqEs3 +KuLNIuWxRWhiwXwMEK52kZRYG4WQmFg1rkcSSRwvRsyrQDCf4eZkLUQXxkF1r+Pe +F5Ogi1yRblnUz6J28c9gnvDbN2LX3XoQQ9O8FkZNBbuZmBkn3g8QP/ddL5d9Km5H +3FRMzLmT0sAGNA+UiYNX2lxGqdvw4pJCsNz8PrE7HqNJUwJ2VnTSaJTJqxG0aIs+ +nrIEVJuJPDBaOy0cxL1ufEEYMQ3idQ== +-----END CERTIFICATE----- diff --git a/letsencrypt/archive/mully.898.ro/chain1.pem b/letsencrypt/archive/mully.898.ro/chain1.pem new file mode 100644 index 0000000..ca1c1a6 --- /dev/null +++ b/letsencrypt/archive/mully.898.ro/chain1.pem @@ -0,0 +1,61 @@ +-----BEGIN CERTIFICATE----- +MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw +WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg +RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK +AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP +R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx +sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm +NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg +Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG +/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC +AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB +Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA +FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw +AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw +Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB +gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W +PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl +ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz +CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm +lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4 +avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2 +yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O +yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids +hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+ +HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv +MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX +nLRbwHOoq7hHwg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/ +MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT +DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB +AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC +ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL +wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D +LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK +4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5 +bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y +sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ +Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4 +FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc +SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql +PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND +TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw +SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1 +c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx ++tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB +ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu +b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E +U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu +MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC +5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW +9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG +WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O +he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC +Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5 +-----END CERTIFICATE----- diff --git a/letsencrypt/archive/mully.898.ro/fullchain1.pem b/letsencrypt/archive/mully.898.ro/fullchain1.pem new file mode 100644 index 0000000..2a964dc --- /dev/null +++ b/letsencrypt/archive/mully.898.ro/fullchain1.pem @@ -0,0 +1,90 @@ +-----BEGIN CERTIFICATE----- +MIIE8jCCA9qgAwIBAgISA0IxtFv7M2B7/oA8bcz3gs6uMA0GCSqGSIb3DQEBCwUA +MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD +EwJSMzAeFw0yMzEwMTIwNzIyMzdaFw0yNDAxMTAwNzIyMzZaMBcxFTATBgNVBAMT +DG11bGx5Ljg5OC5ybzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKlC +q1iS5CuJ24y/VhV8NzMxdaMuZKR5guthODPuqBJB8pzM9gvYJRBJB1S61rHaDdES +uyuznstUk+4pHgnJZjdTCAt+szH+UOnUl9zXKQuHJeT13ubPRUwpkMM5Q1A94mVg +WdODYRyIPzIzjGmgs+tXq+Y55eQ20kdOj/A+5TI/clEvE56kDDnuwWT1oL8Pmdm6 +CuTsrAgxKngXIcrnptHntm2H985bLSLa5pqAktqaZX69PckUTsdauDA7IzdDe3/y +XEGLCn8eZBKYQGBhsZ+1ZCg3FJZxqgZ4WanatJJpgFGPl+zCSMXuqjsXPmvktYLv +wb/uxZHz4+D1qYByXXcCAwEAAaOCAhswggIXMA4GA1UdDwEB/wQEAwIFoDAdBgNV +HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4E +FgQUFOIPOI5oTkyYdv2skijY/4y3zHAwHwYDVR0jBBgwFoAUFC6zF7dYVsuuUAlA +5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRwOi8vcjMu +by5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNyLm9yZy8w +JAYDVR0RBB0wG4IMbXVsbHkuODk4LnJvggttdWxseS5nby5ybzATBgNVHSAEDDAK +MAgGBmeBDAECATCCAQQGCisGAQQB1nkCBAIEgfUEgfIA8AB1ADtTd3U+LbmATosw +Wwb+QDtn2E/D9Me9AA0tcm/h+tQXAAABiyL7AXcAAAQDAEYwRAIgBcyus3MXawdM +3q7J5uqLGrhTgKxfkiMhWuf0b8cI58ACIBWVO5W7yOT1BdAkB3YlYEGZQmS/b9gi +3EOZQEiN8Ee4AHcA2ra/az+1tiKfm8K7XGvocJFxbLtRhIU0vaQ9MEjX+6sAAAGL +IvsBoQAABAMASDBGAiEAwmtz0nzjW0qPH0pJTU7sju7iHtD9xb/3xCrOcU0A3ZoC +IQDQHNQWMUK0pntk+JwzdgDcBcKRvTGEoZqHZVpK7DFlBjANBgkqhkiG9w0BAQsF +AAOCAQEAckgayucapcYCHsLb+EGEgCzM8ow9mB510nfuByckqcnIDxLQSGQuNmZg +wISZUJRqZkbJ3VBDf8uFAKcdcIFiCKa+LIp/kuz/HzImtMPF8LsK/iONYy/rqEs3 +KuLNIuWxRWhiwXwMEK52kZRYG4WQmFg1rkcSSRwvRsyrQDCf4eZkLUQXxkF1r+Pe +F5Ogi1yRblnUz6J28c9gnvDbN2LX3XoQQ9O8FkZNBbuZmBkn3g8QP/ddL5d9Km5H +3FRMzLmT0sAGNA+UiYNX2lxGqdvw4pJCsNz8PrE7HqNJUwJ2VnTSaJTJqxG0aIs+ +nrIEVJuJPDBaOy0cxL1ufEEYMQ3idQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw +WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg +RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK +AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP +R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx +sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm +NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg +Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG +/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC +AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB +Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA +FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw +AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw +Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB +gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W +PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl +ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz +CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm +lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4 +avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2 +yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O +yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids +hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+ +HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv +MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX +nLRbwHOoq7hHwg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/ +MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT +DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB +AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC +ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL +wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D +LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK +4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5 +bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y +sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ +Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4 +FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc +SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql +PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND +TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw +SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1 +c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx ++tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB +ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu +b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E +U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu +MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC +5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW +9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG +WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O +he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC +Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5 +-----END CERTIFICATE----- diff --git a/letsencrypt/archive/mully.898.ro/privkey1.pem b/letsencrypt/archive/mully.898.ro/privkey1.pem new file mode 100644 index 0000000..6cab89a --- /dev/null +++ b/letsencrypt/archive/mully.898.ro/privkey1.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCpQqtYkuQriduM +v1YVfDczMXWjLmSkeYLrYTgz7qgSQfKczPYL2CUQSQdUutax2g3RErsrs57LVJPu +KR4JyWY3UwgLfrMx/lDp1Jfc1ykLhyXk9d7mz0VMKZDDOUNQPeJlYFnTg2EciD8y +M4xpoLPrV6vmOeXkNtJHTo/wPuUyP3JRLxOepAw57sFk9aC/D5nZugrk7KwIMSp4 +FyHK56bR57Zth/fOWy0i2uaagJLammV+vT3JFE7HWrgwOyM3Q3t/8lxBiwp/HmQS +mEBgYbGftWQoNxSWcaoGeFmp2rSSaYBRj5fswkjF7qo7Fz5r5LWC78G/7sWR8+Pg +9amAcl13AgMBAAECggEAJL+x3hA+c+mBfoSIVy/Z+EZzyRMojMFJGHvKLRRS72vc +Fgk2Hoo2OdvxOIc8V+8E8vDDLJDaGEFrwNiyieNtSvO/GmfO1jrmLG6Y7jzUz4jv +RE/RroEwBYI8yPYk1EYrYmFR/2dV7VDzj527ja9zgNRPITRO4oa4jvzSqZGuR4M+ +lDBz5eA6/RBo6nd86ih1Gu4jgldL/Z2lRCOYjhfmKbF467im5su3rbmx49EFqfsZ +rVFuMR3M1JjNblJN8vpQDeDSpFb77bwGzogJsZtGnZegH1DPU0sS8KsovLLfxdZy +RIVUOokCN8DCknZmO1LCY+/SKEZqmZNKv9QidIb1WQKBgQDSoXobLsVBx4AFoHMN +O/cp4IQhMFn7YOhwQ/xNKbtvqcK6EslwiWKs4QpHl136OyWalhY6VjFLFcR5hs7i +mvfH0lXPgbVzulxbMdZIfCMbq1qZcm7Z6BsfAdDfn7O7xZ5rX2cO8jLN4+DEFx8K +sFfwS4Na62C4hGdK7YIE/Xk/gwKBgQDNt/bjtHgiWQobl5igeOfWe01dpsbuYjQc +fpwav20WgnxpvSWk4BBLjV9INmBViGU8dpEb1db6p6Ts3ty2QFrVA0n1tVogf33k +M46ZR/QY5gLa2XXaWmIEcmsJRZ7yvfbjmJYW4SuYl1YXvSYoXfVp5cGt6aYEj6Wr +8qBPaxKz/QKBgQCWh8rRZHKbGS3YV5wB6EozBn7HjVuxeMeFfEDzEJEhM2y0OLr4 +D2eS79293mLOc7jjKsJF/NWLuMnKpFp0vpW4nAyxmRyJ0bUxg4OGGBmrK6I7Kfop +B2VimpShTOxRlOEsEWmA1/0RAfvfiDqqE+81D3KX5sIf/Jgph2Y1lMUzawKBgCU4 +AFoIH6gPNe3yCnIWDdPXMRMdhmZArC7vlSydr43gA8RZrULcKvaQWEnHVLyE1dQP +m4dOs/tbc1JLq+DpWcWqN6pVqj2w80TjMwx2YSpUCvYvW8wqiAtH7CecSfqe9dkN +lTIEgQ+1aaUX2px5C1qib90YJaozlwS5+9kChTq9AoGBAIlO8jMh9OMCzeE6Kol0 +GpWqEtx21H7LebJNFZO+LVYvVo1z7RNc4tzESqKSzEB9nAz99kWu1bAzW0ju9Wz4 +y+1a5mN9BuaWyHWRz/s6XaP2Psbgcoh+DWobpY6Wgos5HrRrs/0jNScY8fi76dWK +XV1ZaatHcaZw0qHSdN4z35ee +-----END PRIVATE KEY----- diff --git a/letsencrypt/csr/0545_csr-certbot.pem b/letsencrypt/csr/0545_csr-certbot.pem new file mode 100644 index 0000000..ddf9976 --- /dev/null +++ b/letsencrypt/csr/0545_csr-certbot.pem @@ -0,0 +1,16 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIICfDCCAWQCAQAwADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKlC +q1iS5CuJ24y/VhV8NzMxdaMuZKR5guthODPuqBJB8pzM9gvYJRBJB1S61rHaDdES +uyuznstUk+4pHgnJZjdTCAt+szH+UOnUl9zXKQuHJeT13ubPRUwpkMM5Q1A94mVg +WdODYRyIPzIzjGmgs+tXq+Y55eQ20kdOj/A+5TI/clEvE56kDDnuwWT1oL8Pmdm6 +CuTsrAgxKngXIcrnptHntm2H985bLSLa5pqAktqaZX69PckUTsdauDA7IzdDe3/y +XEGLCn8eZBKYQGBhsZ+1ZCg3FJZxqgZ4WanatJJpgFGPl+zCSMXuqjsXPmvktYLv +wb/uxZHz4+D1qYByXXcCAwEAAaA3MDUGCSqGSIb3DQEJDjEoMCYwJAYDVR0RBB0w +G4IMbXVsbHkuODk4LnJvggttdWxseS5nby5ybzANBgkqhkiG9w0BAQsFAAOCAQEA +eReIFF8uErBmrF8USEziXHRueJ6un8dYeW3RuPHde3zrGc0ej4WrFSH1S+IY+52K +tboPtNkzzH6YkexQ9/plSlqlRxXoDLTVsEJk8xycGmxG8T1EjG91PBdekNJf8MH6 +Wq+iCW2lj2c6sxWF9L39vvQHnr7oU3VRGgnz8+k2xC9gWiXu1EpbJ9aNTKvRZGAp +so5BRY6yAEFfj6gvZZUNCj7qCbhQf+8O8m6Ntd+1HPiwtMAT5wW+RIjJPxOea8MA +IYLqKA+nPa7QbYpFFpG5prb4yWAEPUY996LAHkdFgmoMdK4E3qur8BGd3o8kBky2 +IIH2W/1K/K6VXgFXojl8sQ== +-----END CERTIFICATE REQUEST----- diff --git a/letsencrypt/keys/0545_key-certbot.pem b/letsencrypt/keys/0545_key-certbot.pem new file mode 100644 index 0000000..6cab89a --- /dev/null +++ b/letsencrypt/keys/0545_key-certbot.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCpQqtYkuQriduM +v1YVfDczMXWjLmSkeYLrYTgz7qgSQfKczPYL2CUQSQdUutax2g3RErsrs57LVJPu +KR4JyWY3UwgLfrMx/lDp1Jfc1ykLhyXk9d7mz0VMKZDDOUNQPeJlYFnTg2EciD8y +M4xpoLPrV6vmOeXkNtJHTo/wPuUyP3JRLxOepAw57sFk9aC/D5nZugrk7KwIMSp4 +FyHK56bR57Zth/fOWy0i2uaagJLammV+vT3JFE7HWrgwOyM3Q3t/8lxBiwp/HmQS +mEBgYbGftWQoNxSWcaoGeFmp2rSSaYBRj5fswkjF7qo7Fz5r5LWC78G/7sWR8+Pg +9amAcl13AgMBAAECggEAJL+x3hA+c+mBfoSIVy/Z+EZzyRMojMFJGHvKLRRS72vc +Fgk2Hoo2OdvxOIc8V+8E8vDDLJDaGEFrwNiyieNtSvO/GmfO1jrmLG6Y7jzUz4jv +RE/RroEwBYI8yPYk1EYrYmFR/2dV7VDzj527ja9zgNRPITRO4oa4jvzSqZGuR4M+ +lDBz5eA6/RBo6nd86ih1Gu4jgldL/Z2lRCOYjhfmKbF467im5su3rbmx49EFqfsZ +rVFuMR3M1JjNblJN8vpQDeDSpFb77bwGzogJsZtGnZegH1DPU0sS8KsovLLfxdZy +RIVUOokCN8DCknZmO1LCY+/SKEZqmZNKv9QidIb1WQKBgQDSoXobLsVBx4AFoHMN +O/cp4IQhMFn7YOhwQ/xNKbtvqcK6EslwiWKs4QpHl136OyWalhY6VjFLFcR5hs7i +mvfH0lXPgbVzulxbMdZIfCMbq1qZcm7Z6BsfAdDfn7O7xZ5rX2cO8jLN4+DEFx8K +sFfwS4Na62C4hGdK7YIE/Xk/gwKBgQDNt/bjtHgiWQobl5igeOfWe01dpsbuYjQc +fpwav20WgnxpvSWk4BBLjV9INmBViGU8dpEb1db6p6Ts3ty2QFrVA0n1tVogf33k +M46ZR/QY5gLa2XXaWmIEcmsJRZ7yvfbjmJYW4SuYl1YXvSYoXfVp5cGt6aYEj6Wr +8qBPaxKz/QKBgQCWh8rRZHKbGS3YV5wB6EozBn7HjVuxeMeFfEDzEJEhM2y0OLr4 +D2eS79293mLOc7jjKsJF/NWLuMnKpFp0vpW4nAyxmRyJ0bUxg4OGGBmrK6I7Kfop +B2VimpShTOxRlOEsEWmA1/0RAfvfiDqqE+81D3KX5sIf/Jgph2Y1lMUzawKBgCU4 +AFoIH6gPNe3yCnIWDdPXMRMdhmZArC7vlSydr43gA8RZrULcKvaQWEnHVLyE1dQP +m4dOs/tbc1JLq+DpWcWqN6pVqj2w80TjMwx2YSpUCvYvW8wqiAtH7CecSfqe9dkN +lTIEgQ+1aaUX2px5C1qib90YJaozlwS5+9kChTq9AoGBAIlO8jMh9OMCzeE6Kol0 +GpWqEtx21H7LebJNFZO+LVYvVo1z7RNc4tzESqKSzEB9nAz99kWu1bAzW0ju9Wz4 +y+1a5mN9BuaWyHWRz/s6XaP2Psbgcoh+DWobpY6Wgos5HrRrs/0jNScY8fi76dWK +XV1ZaatHcaZw0qHSdN4z35ee +-----END PRIVATE KEY----- diff --git a/letsencrypt/live/mully.898.ro/README b/letsencrypt/live/mully.898.ro/README new file mode 100644 index 0000000..5050078 --- /dev/null +++ b/letsencrypt/live/mully.898.ro/README @@ -0,0 +1,14 @@ +This directory contains your keys and certificates. + +`privkey.pem` : the private key for your certificate. +`fullchain.pem`: the certificate file used in most server software. +`chain.pem` : used for OCSP stapling in Nginx >=1.3.7. +`cert.pem` : will break many server configurations, and should not be used + without reading further documentation (see link below). + +WARNING: DO NOT MOVE OR RENAME THESE FILES! + Certbot expects these files to remain in this location in order + to function properly! + +We recommend not moving these files. For more information, see the Certbot +User Guide at https://certbot.eff.org/docs/using.html#where-are-my-certificates. diff --git a/letsencrypt/live/mully.898.ro/cert.pem b/letsencrypt/live/mully.898.ro/cert.pem new file mode 120000 index 0000000..b22d0f8 --- /dev/null +++ b/letsencrypt/live/mully.898.ro/cert.pem @@ -0,0 +1 @@ +../../archive/mully.898.ro/cert1.pem \ No newline at end of file diff --git a/letsencrypt/live/mully.898.ro/chain.pem b/letsencrypt/live/mully.898.ro/chain.pem new file mode 120000 index 0000000..cd44e32 --- /dev/null +++ b/letsencrypt/live/mully.898.ro/chain.pem @@ -0,0 +1 @@ +../../archive/mully.898.ro/chain1.pem \ No newline at end of file diff --git a/letsencrypt/live/mully.898.ro/fullchain.pem b/letsencrypt/live/mully.898.ro/fullchain.pem new file mode 120000 index 0000000..f09cce0 --- /dev/null +++ b/letsencrypt/live/mully.898.ro/fullchain.pem @@ -0,0 +1 @@ +../../archive/mully.898.ro/fullchain1.pem \ No newline at end of file diff --git a/letsencrypt/live/mully.898.ro/privkey.pem b/letsencrypt/live/mully.898.ro/privkey.pem new file mode 120000 index 0000000..730c026 --- /dev/null +++ b/letsencrypt/live/mully.898.ro/privkey.pem @@ -0,0 +1 @@ +../../archive/mully.898.ro/privkey1.pem \ No newline at end of file diff --git a/letsencrypt/renewal/mully.898.ro.conf b/letsencrypt/renewal/mully.898.ro.conf new file mode 100644 index 0000000..96b00f2 --- /dev/null +++ b/letsencrypt/renewal/mully.898.ro.conf @@ -0,0 +1,14 @@ +# renew_before_expiry = 30 days +version = 1.22.0 +archive_dir = /etc/letsencrypt/archive/mully.898.ro +cert = /etc/letsencrypt/live/mully.898.ro/cert.pem +privkey = /etc/letsencrypt/live/mully.898.ro/privkey.pem +chain = /etc/letsencrypt/live/mully.898.ro/chain.pem +fullchain = /etc/letsencrypt/live/mully.898.ro/fullchain.pem + +# Options used in the renewal process +[renewalparams] +account = 995d0d90943dc1603856ca5d83fcd7e0 +authenticator = nginx +installer = nginx +server = https://acme-v02.api.letsencrypt.org/directory diff --git a/nagios/nrpe.cfg b/nagios/nrpe.cfg index ad7964f..144cd8e 100644 --- a/nagios/nrpe.cfg +++ b/nagios/nrpe.cfg @@ -47,9 +47,9 @@ command[check_redis]=/usr/lib64/nagios/plugins/check_redis $ARG1$ command[check_varnish]=/usr/lib64/nagios/plugins/check_varnish $ARG1$ command[check_haproxy_stats]=/usr/lib64/nagios/plugins/check_haproxy $ARG1$ -U admin -P d8z4a80 --http-error-critical -command[check_linux_ftp]=/usr/lib64/nagios/plugins/check_ftp -H zira.go.ro $ARG1$ -command[check_linux_smtp]=/usr/lib64/nagios/plugins/check_smtp -H zira.go.ro $ARG1$ -command[check_linux_pop]=/usr/lib64/nagios/plugins/check_pop -H zira.go.ro $ARG1$ -command[check_linux_imap]=/usr/lib64/nagios/plugins/check_imap -H zira.go.ro $ARG1$ +command[check_linux_ftp]=/usr/lib64/nagios/plugins/check_ftp -H mully.go.ro $ARG1$ +command[check_linux_smtp]=/usr/lib64/nagios/plugins/check_smtp -H mully.go.ro $ARG1$ +command[check_linux_pop]=/usr/lib64/nagios/plugins/check_pop -H mully.go.ro $ARG1$ +command[check_linux_imap]=/usr/lib64/nagios/plugins/check_imap -H mully.go.ro $ARG1$ include_dir=/etc/nrpe.d/ diff --git a/nginx/conf.d/_zira.go.ro.conf b/nginx/conf.d/_zira.go.ro.conf deleted file mode 100644 index cdaaa0f..0000000 --- a/nginx/conf.d/_zira.go.ro.conf +++ /dev/null @@ -1,44 +0,0 @@ -server { - listen 192.168.1.2:80; - server_name zira.go.ro; - charset utf-8; - root /var/www/html/vhosts/club3d.ro/; - index index.php index.html index.htm; - - access_log /var/log/nginx/club3d.ro.access.log; - error_log /var/log/nginx/club3d.ro.error.log; - - location ~* \.php$ { - fastcgi_split_path_info ^(.+\.php)(/.+)$; - include fastcgi_params; - fastcgi_pass unix:/var/run/php-fpm.sock; - fastcgi_index index.php; - fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; - fastcgi_buffer_size 16k; - fastcgi_buffers 4 16k; - } - - - location /madalin { - autoindex on; - } - - # gzip should not be used with SSL - gzip off; - - location /sgwi { - auth_basic "Private Zone"; - auth_basic_user_file /etc/nginx/.htpasswd; - } - - listen 192.168.1.2:443 ssl http2; # managed by Certbot - ssl_certificate /etc/letsencrypt/live/zira.go.ro/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/zira.go.ro/privkey.pem; - include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot - - ### redirect - if ($scheme != "https") { - return 301 https://$host$request_uri; - } # managed by Certbot - -} diff --git a/nginx/conf.d/mully.go.ro.conf b/nginx/conf.d/mully.go.ro.conf new file mode 100644 index 0000000..e8edacb --- /dev/null +++ b/nginx/conf.d/mully.go.ro.conf @@ -0,0 +1,33 @@ +server { + server_name mully.go.ro mully.898.ro; + charset utf-8; + + listen 192.168.1.2:443 ssl http2; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/mully.898.ro/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/mully.898.ro/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + + location / { + allow 192.168.1.0/24; + allow 10.208.1.0/24; + allow 85.121.136.12/32; + allow 188.26.53.107/32; + deny all; + proxy_pass http://192.168.1.5:80; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $http_host; + } + +} + +server { + if ($host = mully.go.ro) { + return 301 https://$host$request_uri; + } # managed by Certbot + + listen 192.168.1.2:80; + server_name mully.go.ro mully.898.ro; + return 404; # managed by Certbot +} + diff --git a/nginx/conf.d/zira.898.ro.conf b/nginx/conf.d/zira.898.ro.conf deleted file mode 100644 index 4498db0..0000000 --- a/nginx/conf.d/zira.898.ro.conf +++ /dev/null @@ -1,12 +0,0 @@ -server { - listen 192.168.1.2:80; - server_name zira.898.ro; - charset utf-8; - root /var/www/html/zira.898.ro; - index index.php index.html index.htm; - - access_log /var/log/nginx/zira.898.ro.access.log; - error_log /var/log/nginx/zira.898.ro.error.log; - - #location / { rewrite ^ https://zira.898.ro$request_uri permanent; } -} diff --git a/nginx/conf.d/zira.go.ro.conf b/nginx/conf.d/zira.go.ro.conf deleted file mode 100644 index 9db2ec4..0000000 --- a/nginx/conf.d/zira.go.ro.conf +++ /dev/null @@ -1,12 +0,0 @@ -server { - listen 192.168.1.2:80; - server_name zira.go.ro; - charset utf-8; - - location / { - proxy_pass http://192.168.1.5:80; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Host $http_host; - } -} - diff --git a/pki/ca-trust/extracted/edk2/cacerts.bin b/pki/ca-trust/extracted/edk2/cacerts.bin index 790898637e5da30cdc3480c37f44ea1cbefce749..44f861c9847f450e26295399bc6abba9ddbdaf86 100644 GIT binary patch delta 8919 zcmchcWmJ@1+xHoUF6ja3ZkVAvq`N`sl9C2#7`hu|=#UaYLO@VTLh0@XK}tdzq+S%S z=kdDMv)=puaIbs5%sS3Jv-e)-f1k(i_#bC*JLcK?kEE0ksj3@Zcp?AoO6`p8*;M*&}Ir1^Hy0 z4I(258JOhfMIZ+LBLztbN?AKcGgCWC4M#^eN=XR_m>h%&5rA+)1i)MnUI?Ea2$P%p zF68_j{u@hB{EH=E2b}O!&;v`9=9y0frhOp@5=AzA9%OA*K0i7<G zaGBXj>kznR3;A(u7e5o7$_i3Tgi~L2Mlxzm#}t9l&OwB|<$Tv(C5a$U{`5DGci%4d zNBRM?Y9gO*tO`|Ahs7h=dm>*a;zFyQkw#)(H1xUYBe!=S^Nd)Sdv7^pFiwJ-*GU!# zDnqujx_VErwhs-NpyBa0t^zIWw2snL<)6lF=#YZnc*}+2v0@@M*m>z(6OQjBGN3ix{{kjbkxJ8c^lnd{CVsc*D;tHQA}>3~m;#TUqQH8AJFL11@wfACEf&iZ z5P>HwAgZw{*B4_AX0Z|oG8oEmWh*N;1@*5PXN%KuR~fQ7aFDVa zr`?XF%_nMY*1aiB=c${+_Gl21`!LzIaX=$FwG^7oAUrPKjE2#CvJp!+8R!-+GtTt< zG$08^i~fw9c2J)x`7cfQtTQ$VKd z3~yviC2b;SfEp){-G(qHzK zx{!^%60?RFj-ht3$LO0cZ_bmC?wFDvE`HrVO?Nk8BTsR0{*2Dd*_EU+Au~mGQA&)~ z{o}=;Jx$tcbpAIPI+%{J2N1Z3Hc-|8F)z=Jwr1Y4Fqd(v(HG9GC9Xy!h0^H|*Flfb z&*jc51_fjojc7~8UkaS3XZfIdd7doC<9^@VcMnaSik@bSMRF6BUAl-))rxo-OjG1@ z`OE~VVI+fI+s(HJHNxxiR;Dp93#hGBMV`>X{AI1NYj<3GYhWX^^QUHcjAL~L4Hoqg zW{-xlH3!mLEUe>I$#Lb*MwvR&7<&&n(UW7CRE14A2M|+DcMdCWYMjVe*^3YJpL{G@ zODRzZuPY-kVEOK%4G;J0BLGv!1`x{9fr9{Lc|dpoJUlil2*uBW`QuF}(G#ShT7_?5 zG$fR}1UV>z00jOUsq0^4N6x=xM}AJopV{$e_-`!nFR~+NGSvejXm(#fVyvcB-Fvla z;Q3d13JGe|Ds_#=lPuivpKxXHKSgt}hTO6`yqY*bT?JC%cS?%*wy}09+A0ieg)jS^ zQn&n2P;UT7U9T(>;i8?&)^C7X8KTA|lv0IFQroTxNDCf;#ld8E7$Cz!AVk0)Rj5{n zB7GkTqEK-#E(^XwkQ=W`yn6(xVJQ0WxaJR=^rvo0N42mN3`gy&#pjPDCq@<0iE(uT z&VspDcvR%<5gzD5z+krO*V#b+IV5-pTwi~v&vBpnmzEHOap(i^hLa77fUKoiWTiPO-gEwl?x^{gV3Q0v@KV z4>cYsOxW7ok~0ff7h4z@JnIR@8Jd5~(vs8~x7LZ*QfRF-3vW&6*79}%VeJ|70w0A5 z>)gp%zVC~A45u*m1HpZbv;MKni|7`tB}jd?wLwzx$=4$^?z&r_muunqpDRId`@qEA zQc@LX5$I^NUF5N6*t)HJ-eBEmRaxfg@i_ac%LVV}Zv^#pF@jfgm^IX{RBqi0sisLM z9Oy(v$8WyuNi+kzex%04g5bfm7nPn5V`_P^v5^s-hL0f$QR<(<=)KPVgj;1vr zU)&0xH7ZrIyXv_wV`T3<;^jmtW30Z_!#8j2Zv*v_SmKsm7797ek3!?k;p;ckSc$}B zyzr)}#uO3BxXupTXHEF%Bc;+Pzl^1zlho8#x8MbeOk6aLbW3`*${E_C5?ZMEq>ts3 zXPmRvFg#y+%vbsCWi6LN93&3(m^S^Ey8J3lhpYyZM2aWRF4&G!&|q~tpWK03Bu_Oy zC?!F4)Oqs6rmvY#;X<0J0|kWfN0zTa)mdztzs zjz|XK`V1H1I5}BdZS`MybP=HpgCNQn(yN2ZSqPK-?g@HGiE7)aN;_lLkG~Vqa{V1wa*a}OIc`O)!G0a{N>kTbg{Wo25o|y>=hnL zA);0o$I0q?_|W&dl?}MFy20_*=v-t#P3_|sPHQY8RRZ6BM4DZnO%fq+P;oCDSbv{L z)mv;2C}@lQY^qk_O>1|5!4uXtt|D*%fi$x8LkRV|B)GD4Wx;rl z%2MiH4)b1u$*#}eMeMFfG1IV3b8uc#PoW(qdOs7u;s8TCc;$1Kw;sStsqv*~`)%i* z3Vlc^Qrc<~Rj=LbP2$zEH=tvjU3i0kJ+}9S8u8okVZAl(lwOp?!_P@YdP3&Xs;w)6 z9@HELtuhySz)-wL#=VQ0Q)YF=JP7Twx9Qg*O9q2mMgfcxhkhI63Dc_XqCvu#S4F@d zJ`ZQ4$xUXVopBdeEImFiJ~7|Ej$8_YJaDPt((RVZ7jhgY&%D$ zCHWAV{}2&1;KK{^9>E>DTxj-(LRo@LDW?Nl#Yui6$s;0vHHR%d#`UM`9wdU-WGz7Y zg1PaPM*ma>7P7s<%UL=tJm8|h=MDMV*$J0U zbV>T?VK*yRauT>pCFUs?wgu>#7L+;?+b(F!@(nLq>X7P4;bFap@zicaq03hRiWk`} zR&7o=B8|uA^7X6qFu~kWW8ce<>AnI?%RXeSm?iO}OxzB%1bvGMMy(G!Ew|g(KL{8{ zrI$)PK|rozt*ik%>dK+Y|7H){ugU^Se21Rg-{?VIPJUW`Hq-rHloTC-nf>U`tP588 z!*^+GLO@`GU%m?uOUlN|<|ji~Ddio^+5a+RKs>U)1}L?ZG%2MeB`MXo__^=tB+K)& z%($bI4FtmTC!Qb>ZcZ*90UiOp|MY^tijFp^{2?5eTE-$x5D)Uea34|j=mFG&M^$Jc z#YJPcUFdx0htIRelsoAaJy+H>&)?6X?sVgwsC-5vvji(OQplnSn_@p=@-0HaTBhC_ zluzBsnY%VpHC9WXqO z1q3eAHdc0H=gL7FIAdi;uM+(Ey62Jwuc_WUruONmjg2{;xe&b?J0RZ+DKT5FwY>!% zEZafgQ=ONXE}#5L*mqL~DVp^V0+*6))*abQ9D=`9bO~s{beD`_*X;9M!T_bJ!8|np zLQs^8TF+NM{AX>s_#zj5hob%j7{;BcR{l4|r32I4mm8#i6IVl1f*UNr`wwmZS6ZWA zrNE+<#CnPUw zD*S=cUt8KA-RvC-zYE1n^&^EmLZw3c$Jxg!@mE4L-S!P%5NG?p?Q}qnr%IT# z0*0jYl^nr2NBs*FDU#XBP$wtMalsM3?{?XlAMukP?+-}uKX1YVzVL;v8f;BqPJHpj zHhcZ-y9m_%NUUJ9s_lCJwXSk`SP4-rQyVK*t3?Y_%rrdPfC0xLbf4fDgPR=30 z)mGU92FN?Gtgj#3AKcj~dfr>Ux?+CTkdM&aI4))2hb{4pj6zih zr=22v1_5=cu&DvR>!9;?+O}SRfNJc^Hhgi4EXxTDRGG=c;So7^9YM*ycW5{QA7b$A zkPzx}hQ8gqZFMfvU0(4@&=}o-jrC!r3XN!u#LuTL*#sXQdUxD`LGS=Llj2H!W8K-v zIYqV7P8uGn+hJ31NMgMh_7GiMPpb^~OdAzFsS~jac|lM3O{t_ss$jP!0@^!?#!gwd znOq_wp|@B^+}pHg3zd{66-kW7yc>pVi(SHVY65Q>MHrP+eceCnAGgin7nKp4Arpxk z!xHDSy2|RH>X_>`n%eyWezTu&v|T<4MMs`6 zKw(;Q_=sJ|xoF(+>d0yhIevkjcqLZ-1jXeE!;&ZK*w^*;zUD zJhb!?p3V-HM_{rZ#&+tAd~ZI=Axy|V6M=|UD$W;hI8Qfi6qZpfFn5y3X**Kv6!r3K zu~0gc{uOzQA(MW$;&g^B(8%d9RMk$=nxj_><1}WL^QPljuo(Ym{~C{aMGVx5-$Z=> zi-;UW;2?PBdm`e~%Mg1&R#Y7sc^3uL!`8=P5!7veqheq{vS|w;6c0(l;hCw6DTEjd zy2m26G@I6QD;HBr=|{4Z66~7ne{~Ge@$ml|(sFt3de@PB>frX&CM7>Ugm3V$R<&_a|Gh2!@`iC~Os!qm0I1S@oh20bc9=21mfLQ*;!H&vH~mIR6GUw?g=CBeu>hZe|LEIL9=|tLzH-M2}A@zpX38nyKuW-dT09`R`78JslYmd^b{U zq+_b)tv9Hm1_=PB$!@F>`AX@1F02vy{JBH$yIn_gH?%Mj@#tjc-D{-$`m(j^Z7O_& z;KHlhcWPrXxb*4nPFo)z6uVtD4wHBex+HyJ%xYTSLY)>Ii(GGE_gDg;Ii{X|jTKhb zaDS+?;_4477kOh>pn*%|v>u?sb?8seS&kUXU%2iroQrLPWuHCT=0*8Te~2q~B*mR) z!%(}cz8uO}CeyzmL{*1|wx;l8K9EOI>IE*ERZ;$}J{aBv}w9IXw@@@zgh%p5)!2$pS*W22Pb+$A5iPz8B z+!a5PXi^Q!?f;Pm{;%QWgJ9BM-S)^=F3^~7gX~0|*a2+V7`K=B0|?9b!YUb;xlFCp zIlAwITyf3m>-rP6MwyxRve^1r(_5q&)~cO%*Z5yR?hK~4x#v2MxvY61lH$-xevBe{h)|@nRrD~ zcIUw11)7y>ATBP-F%fsoG9S7J4nVHew6^Y?c&1NzyC7!&`a4pcebTXlsanYHj{MkK zi}gDDDg<2%{bAB%(Db{PPlYWJF0^OuF6Zj-EtOM(g$BrrS>E1wh=-MJETQ#WpDu*! z5KULHYMZ3~K=Ic|I8iKS4~P2pQO+TW<{1J#{9X#=Bt7|tMZSwIBD zhMBY$TJ6;pVU9r8AF`NPb|8P)$de=G@7R*QEP-C_!dpM=^}zKghSO%m-q)zen1vevt!!CtZ*11;~*?wf9<@am#&@ zMunR+%&hSYWdD|IR80)CYXLB$v4ENGZ4fn#ss#XI`)O`}zFqw5uQhOI~;8s&x&=SNF{CBnJM6OQCWYc435!0?gC z)w{hjp=#dEoYPJjMtQE`$CAwEO#RB$wcan^WAYan$}wN}y>&G#h(PJWxTEIBGBzyx zU80wBnp<>p+9=Cv{Yz4&gh6HURc`}#T*EzUmEM|>;Qk;~rc*R;Cg+>^CpAle_tcCA z!qrzb1G0dqm5BFOl9MHD2&tiW47K`8o)up{@oSPBt3Sbs0b6Vahy#EyiWUF`)vu!I zPLQ9X+`aFG@cyqT_aSV#86f)m*8r}2+N}1t$e)21QGH9r10Rpo3NCyweUPl?U?a@a zzNhb+Kw_mtwPVcFC?Lv$X0qRC&k}a&{Ia`zO(*4|r?T2*oU+_)w1MD_`c0@?{(I~j z#DEKpRQ|n9o-J4cPG>8XrD9{nOPo__7gguTdjxk?{E-s_0A%Idt>Y?3H zP0B7;q>V#INXi$v7H9s&mSH^3-8cbCZO-D4$y@SVPp?GPR+c&FMf?qD>b#s5e=Ls_ zO=3tm`Ipp-y8JNBR!2AMtuiE4K~moORm+tU#s;;UJsL+YSbsn5SaB6Y%sysi#qwhAu|b_J{82-& zQSGx934dMG=Td6g19~{7RA{E{r4iS7O>B`I1E$L_T6*hzR(!av&?(+wbor7KYxb5@ zD-clX;5&)11hGEICLogykiGRx$AVNkipKAT*^v7XMc}_}zY5}F&r)Q&bP|F(zh?2F zXE=J;K7R>n$lvbEtF0JI@%J7s>)7FE!(oqT9T$6pEA*&59^S#Pf5h0dCBI3~R&JYK zo0`zj81t5aE0+l97NxI2Df>)Xnc5>po8fyUc}!0*wN`z`uG*LgLsXgJ2KOCZznDAeXkz75Ei2`aT7Q)_cdKrzAC$WH2!WU z=izBkzU)&8c45}jkD4Wy6w$aKQwEtV5lv~mv7t-KnZX}Qf3FcZRACn-q$kjA2as&1 zwuk?2HlSiI`4NBi*!=tUvGblv_^Na1agXj-c4JbnMw-{*Qo38sJjxP{ii`zmZ%Jm* zLC9avwzE&%r&>GT1wOv*hTdA(n0dW%z@mWek=cB$cX6({DFX1MXt8|Mu#ea7>=|w7 z>*YpK56wGiss%mXMlk`;&kS09J4fH^{{?7EokP4;C1ln5Y?9(tq9@K(b z`P7lItW~jYPZUL#A@70XgJ`kx7eq(zvF5F`9n5lMutpF(dtEBrXNu0>E=8c4M(@+A zj64z38yD$G7G|+H3B)8!Jxl7ifjDk5bGl(2E2SwAVS%+KK7DKYM3A$YPW6p}1r=@X zVBLvGrx9bVFx!_>+smg1vY-P)O Q;Wj`9u-?5F5S#k{0IuNaAOHXW delta 4262 zcmcguc{r5q8aIn6TM7;ON<-FYykp-PW6hpV$v(zlG=^rz+Q*w+vX2b1B}*uY&zh`B z)DTF~GQ0VRzS?#3}){98iottK)~$a2!5!cEk+Yi-!?e;6|i1J3W0=2;qY`k8Bf8ZJcuY9 zkxD0dk_dPL$qyxMX=;SBIRdBw7>ugQ5mOnAG$6Sh%*78Lv?Wpli6k1zI>4PwBGCRh z7^4g*{#Yt^oajXiKzY;Y{xl7F`JkX6GyzX1ur@+dh;;ctA{9@i63HlOf()SeOW4tE z$LRpp0Szg15*<(fbr0~z34b1)NW<{5{+o3&7(c=gcLa;W0V0AtfFghaR238f)^HHy zQN(;V6_nML)gAuJynz2MG5@E$sQtUd{HMGyAbFx-tyquMbEf`#ZTIW5iG ztUpUh{v;s9Ag!eBy6n2^#*$|d)ryZlmKdt@*lNf7G7h&%4gKt%8n705VSmrMQe8&O zShfpTXi^ydLXg;46woNLHm@Ic{qxr>I&Z?^pAeyZFHDJTrW2DuzD3q(u<2Uvx3U=JJ# z2t@D^39fhoLGPCWWn#M^a$sTCd4meo62ms;S%=}b!9^Dros$4?I}imA1_A*(f=d&9u#0dXv zGVJrW^Lvz^C2$XRi{ch5;^&pyh4l#zP?us8A&nTnsk|25yxfks#!&pu#UL)wzcTd6 zBc_~(NK9J`J@ZmmDBm(SxQ`OWt@V;>RPe=Q%!Rpdq| zZRV}x)3kuYIq$1FsE|9cy}@JkysKE~`Yg2Z7k+g$>K!6*PK7)2#@Wrgouf@NZU znn1+ggfVA?Sq-?{mTeYY`Z0OKZQ{rUozHTIf43ZLipFQyTcv29pTn&MoJ+Eq>rx#_ zh_?t4Y2bT;3qG2VzA$bw##^i*W1!r)ThyFoRZH;LkynCnr!VT(c6U++7UC%9gl zr)JGt>JXB4_PT0S=_uw)og_z|mcyz|x9qb_=OqOZ=%l|XxJ==`o1>ca>8*;JnWS7~ z{{7%J9$rGR4KTAVE5)~C;?*r7_pIuZs$s1wYbYCihp1IXGimQz_q>8^^~g&NboBWL z-CSqn-`wS#)DGdyVeBuFrqa@IIc38ZG0{!s^b`TTo~fr-u^!|YpATrLSY5JS|_@jsNcNWXcPw>MJtzabp<86?L!1Vx~ zLM?zj5{CAoexHZ|03s5OCVKps{it35d&CbfYuffk{PePBmiI@kA6yN=&YYp>)+ENN z>L0b-uPTz{*(@H>YsJSa+74sJO87dDipg9d7x9!YX(Jr7HF^fRa+JWzU3V?_&uq+1 z4f3?MiGL%%IMvB>7m;t7gqJS$*_{9A{z^#8vd}iKMk9BrBsUFNZxK1o&2Cao{xI;l zKhN~fH_(zzf7t5;P_(3qKi0HMk=7cgNk1=WC~1yNi~8mjHfTZc+E|0}Wd`0!XJ=N#t@ZgR+eMEj1?pzQQqb|n20J6jAwv%2&tl(T zMx2Krk1PO@(4n7-;6%ToU#Amt!5Aqxn~L$C{%1wt&P-B<2q{?-=|O(fQz%t2(dK9z8Uq06A5<#!FH4xG)gVa5x{oO2zx@dFu?18VoNEbB2Yl~LB+GKO7!6HJ zWj=knzQH%DrAVuV%eS0PoG+*sbJKBk9^%-FZc8Bh0mRgQBu*NA?%HTxv_&P!wDLn6A8}+PLf{pjDn|LHp1qu zeCD$VBop>l5WS^XzsNjE`s^iK#lUA8>>Z_6>$doWEt`NzU6mE5Wo=1VTcx_{rfvl1 z?P|jhSZB&P!!z2Nl8N-r`H|tUnmrG`*ei(Tob8?3{KzyK z8BOr>mH&Brf8Fn2+Kx_S82gHXH>=EEG@MuhD~>eKjAMK{=1LCCz0g{Gf07tf7wYJc zB%v}L%0#QRpKy!HLPQlb1%^_rr<>#Dz8Ve)RcBwY*|mJ2F@7t~dVgf+?6kt!wn8rB zyIq*oY%hhgR)V4-+$5)`E=pC}eo&p;ufT<<%=O!SWL1Z4lj?%nRg z*N=9=_g6`ehIjtynI`F~g%)@1x944wUcSC3b8YI3Uwc{nJKLaIHNq}(_vi~5FXoi0;67*-0 zi2V;(!P&AhlYWH~7fW2*|3WI3<`@xR|2A?sx%b-A@pw8*6H`%^MAnlfuRVwqj0_<4 z9a-F{zxAUGkE4$H`O#50>~~@U$Sf*SWAT%^f;x+t6cm1%fP$LC|9)$Ru7eCX+Y^3n zUEEA#L@`QPj1{^-4PjbqBK;wZ9A4XWETfe~Z0VOaPtYJ|-_nrF#jcLt%1L4?XFxpLlI` z;FAbeycc~10m;?Mk%PMn*SkRwNs53OzZUUMqF%D7k-XDPcJ+ODefS1{a{0A27gB(v zkPcQ>6kIv)yaSPkyDh^h`}MF+Y`<2N#(FQ$WOw%SmSC)6;7psm^L%lZHTT{p(;K;< zn)m&h($KPD%&qVQdnsIPvtrt4S=L^soP|-|fJa}kSxlV@iN`7F=;|{dx9eL%x$64G z0Ft@1q{QUdJ3fCyyV++n7u64<%u?-shZfM{ zpCT79aKAgzMpHXur-vjS3~TBlrU>MU-mlmcq{32eT})hXvCVJFTaCOq)AF2(brj7Q zHB`+Qe#W8h{NhkW&VfGPE1a=036ZV(J08AMi=<7)InHa1=IfMc=D&y4uD=cAr$e`H zUYg%v3)x@liH&!1J5h?}xZS*&bFb{6Uf0b52TnUPO|?LqM#A~%3^;P(_!)O717rbtG?&4{a}!$T&Fp&OU~?@N*(-f*5aM*@81f)*&|b5 zA_ToSPB8aRG`xFssbmUz|0AnR~-1o0(4p-_0e{JNhsgUzonvPY8v-`m%y9FxJKPF zt5ApJkOz#po8HHwuaXznvi$9+3hPRhvZi%|DEB#yP%lDd=9F(0bNOpQ;PH60=RL>z z-s0+U_U0KWdB#o2!$pkh-`0{_59nQPQc2N?+_%pq{+0FTlh31!WVmJxoMtY7^`z7s z0Y7F{#69oT?3~uR7c=1J4Sr*!`GD_Ey%*<${j4JmtaUvR36;3$<41W>M`Cw<7JdSR#d3s#tK}V4cHRqD;s+3?X5~K8M9r%b>smdVlD7 zFB!8B2ou=6KmjanHgE-gUi)(aB=aUfTU9Bb1xi6hCV=y0=0zFKCm zrg=~Z0D+Jgx!KKEk0m)>#OrsKd+W>$Bf`exiByZ+CjtNhEDV?-oB)Q04K>2VCWk0# z!#QA=&KmfH441E{Yp83hGAmutH&jWtKQml$m ztVi!+xC}?*3t{*_sHr;3#E<=pld1hA(w|>ne>vS9a~GOb6=SzFFI~wRnTYM;hjW}v zhInzCK8EO^w#(ZDr=@*IwBObyV8u0qYZ%tBcyWrd;@)ajTjwtE>XsQdA}Z0*OR`bm zlG_!QviC!d?AYPY1JokO`G~MQ_0}Z|dvOb+90 ztM+ENd1;ePZe%7Rn^R^;p#h(;VRtEkeK^!RN@a-q&Xdc|`(80icbft)l1pXxG|wp73ESzbN9(2#(sRa@_Y+^hj8 zDBf?ZcaJ8pd{A4MAE6K^rb_+t2tbA^0jw!Tp-Z#s(fw+%oT03SDdu5=4w{mhYp;Fc9y-{6Yj|{0zR~D_WE*up1@zpf?y_zkn`R^qI8}-i(XY3Xm$9fD^Qktd zM^>H0UL_OY-5%+gdvZDz=zb{uSgXJWax8&-D39fycYDSLj9FSN@Tj1i$JJ@k|tsh0IO9c6kf95@!HOPEUi%z3gUtPWx< zR`H0FM^bn0Ma(WcGFbH%N%fjnXBD#l(&V0X9@k(^eyuGk+WK;Dw!z2rM%!D7I*ep$ z`vcsqkGMLwga}gOxpibLg+5}XS*>kVoK(3Z_ymf!ev!aGg-#)m4E_q85N=o)gdG+J zl%9u9K5E>%wmff7B4}=4_f~6sh2dl4qC;noEG88CAL7_~+)N!@BK;2$Q|NCIQ$h&- zXT&^f{s&EG5tHfPM@*sAIc^$6c2`Jpf`LQLYu!rdk1y&>imZ4q^z^R}^NJ+CCsUz# zA1BCn@08E=>8DM+c_<6TJ0;nmX1;ftP8uIqqGs>zu{QqH(5r>T9?wnFkm2vCqL!$e zIAeztucpaZrZpc^(&t}>DZm)e)WATDNrg!ctR}W=nDg9?zEuoZQzTysFwM!Qz8f3KB0{5k zkz~40T$7`X)-q&8q`{I_OktQi3Qs0EV6UE>ZR&*$<=9Z1U zP!_Z%p&>+z&?DJNc5gF{SDL!aMTDf?HR|A-AZ!8(&UgF5Kps5@)jHo7mld9P|)H z=pHGsDYc=$-#wUl5Z6dN14m`wGEFJk{j!ZOQga&kWFhMDhYD(p4QTRu3B9(5EMg$e zIcCQ%a?wdWucv0o#&sw zDK-H9Khxq9s3EZGg9<;o_-Zi{5*#e|z8!c{tls-b4*!>=(dO^J;~RcdFKU8h4Ja3{ z&--ntn7erN`@7StSm>>Eh)-GsJ0b!VXGE^dO5fXg9E&fOBi?PTKNmy9br8T-NhB+q zahx5x!I$(lP+7Z9eU@0`T1tIa&6GcNO!Blg&4%_lk9z_q1EMvVMM>t-v`HCJkWGAz&eS zr65(xDutO9mw7MJGh?8*@LlyC%;XYYHYBe)Ac~lMCeNObt8CgVwJcEXd-a~21L4j; z_$V|C0${v0uBas&Hx5s{MIg)oH89$F=)S-!`$F>T&lv0D{b3qRK^Bpz&0F6;rQMuv z3CV9x_~5jE!?&E$w%5cT%h!H2e(*NY)aDJoX5m6u2;~)=D|B$yS1A~X(sV7UMBj=M z)=oj2PRil758q{-kLZaWkyz!BK4Bff-%1X+ElDg0YZX(^on5&AQPvfIV03picTf7w zgTkvT^>TXE%bh7=hAyV;T;o&EDUJufeP+e_+P8(eMK*FXR*~*QO5sgun=3j^b5g#n zf~HL>2RES+BskGOnX+$L%0;T?k+JVjq3Qwg~<>d6+(Xo z(v4kVv>bnT|KNzXBk__SmK?45c328214 z-k<<=^%xXEW9#VPc=lA@&R%vlHtxa_B4_;TAPPR=|K@fK=-iGL&A++l{EIi6YFD;D z*8WDk&;?6ZT&!{0DusXQup1g})NMX647d zq)6S2X|^y?oR587G}!~22wzbh>8S^v`s*#yKh}N*-oDPfmR{a*bgSyl>j}KIcJf{A z5BLoBu&Z@Us`xTiB$v5^3UP^NSyu){Z}nu_=1903Q2eCugfQwKPIts;!iPm3hhO>ZwmrXO7dxuTA6_7 zmxiyKbRU-rpe6F8)uVzjREG}$**d`=i`;><@Jah9QY8@w~A`L{yH&0fs0QOiYZkg@fx_GV8* zsVgsQ$PI+0yT*mly;Nw|a|? z<|+8n97Am>Fcj~u{z&e@K6QPXHRZ!9--4S>K+}~1JtA; zM?T&?4*St^sksx7)Jb^KOrgM(W&eo~Pi1(kuV2mQnv_!4D|}MPH}T}o*qAjry|1JO%)swn|1hW%y0Rb8Rd&`zn#@fR??-{ZBOf>IIY=3XC@yD?yVP} z1|;eUzeJeu8S@V`)r{P}wxX?-K?Ql$ai4Vc4Ur~(b=Ud|1_vZ|s+CNTP zwb`J8ZBApy?|sL?^KbQMH0k;X|1;T^pvkrn{o(mdwiFyHw7&2;9XBqqX-U1v#UW%g zYxCa-H#8)5u8|5sj;-i=+se}lP79;{&A232_zlmLGGDo@%B(10AOKc62*@eGAw$nQ zUg+AhovXK<=N}9S4*$JC{fnD@gnuzI3|*6!fJusoiAtQEnnj7xZK3lv?6*ly|92++ zI(y%L#NE_J!pJ#M3hn0N8#Py>CE@Pwx)ItPUz$ONNF{B>r9JRV|?q{FecEnU0!|LO%*|4?w&d|3py>KBob zg$J}%yelrgH-{`(*4(2G`X+<3{yElo^3~xFC3f9a&d{fk^@;i#X$UDxy0p4uubqhF z@MFY17ZGQK6G{_+Ha&MljR=kH8au5-hRGG$!>g!dTedkYg$DH*UpNn*Et?oAe4N^gr+sT{1IjLzN-8N>#d-q*-e4@fS31 zOoobTDnBH{cPM;(YJ!0?@V5Iv{wP;?3*$$;b5u4q|K`U0BKFVs_T(lM?;yooY-dB$J-j3O5 zYIbv;`o5u!BSPI9(-tc}A6Zraa0wD~FGxIuqmS+ZHhwdmVpM`*(Yf`csyaSe?fmz@&hQ6mOOKcD&5xT=6qPSW zC}(54-ap(3&~W1C<)S%hO5(dim3v_|?JffATPAs-vhxpU-xS;2F_er9cZWu#YF3=U zmlRNIvZ}86K|9u^wVEHlar_;-#wBG(!%Fww`kMOSLgTGPfq6KAApu>=aMU;Nz4EaUwC*($XvJ|WpZnb?G7d@x2fP_fPrUHj=HHAd|h($VHYx`E5 zH%obH^b)NrR}PC2N9&MVbe+CrzC{>DToh}=ZDda_+Ff2rUha~MiZL`BtH?%XIWFO! zUbyKOXTx*#uIdB%Y0VXbKG^2_y&Ux!gmhkVe*VeF>)op}6>eP8d5)QhYh~rUhS`~z zm8#4YX=HLX4;V0)1nMH&2s5Iad{j5~Ul1Ve2b6m)^>OAt@o7kLTKRU4BrZh}!%hk7 zFh5(hK50i<-LHl@$+)!OSZH_&${$e00`?nkk~{T{1IvdNFH8{xAmVa3n0uu+Fhf1U zZ={xX@Pqa74jb^Of2F4fgfxSq;7MM8H~{SJAHNM&9u(&)z{0}r;$N_2Eg$UF+wueR z61^>ks;~Pd;E3ii&v|JeRr8pk3VBL*-bB3u02L4em_XjS38*3*Aod)mvf$F9vtn^wP+N8O|YL>1xNsKo+hAmt^;Wn5743rw1Gfy5PhnR1~JVIfDKfl zU;$`=1}EA8>7bGP_P`fVp4u502l1WSGi2>{MBL6le`t^)=oZKoV{=7&E!n-a(Q88!zDr}UAfZyxZ8(h)TH6bhlAnE z3&uW^NiCu!n$a?3sxGFd>N<29x|RP>zKNt?I^i$Wh{HYMBK_HzZ;$!I@`fN1jt!ve zH>9>OO0&zdN3Xu^OIM05=j^>x;ZhgwyRO7z!`-b_Ssn1?HIYQ2nHtY=*Gn(6{Ak=Z zLUhjewv?aPWu4~9gux2?gc0tnZug9`6;)WN`iqyLYhF=))mL9yUnKiUrNypk)4(V` zhNNx+*nbBQ6#8wLI4F|7380t!=ko zifn8Jm{@*g{OBz?+ZOa|DR8m>-Im`?O!intD}r)%Qq9Rq>Bz$S=KB>>m=oP@hvy%TzDf7J)X3eEnItW&{0w8ImBG%Jy1*e zT<;{p`|)d%6ReN}{nRQ2**hd0(l+-9sVTW9zj%kLc@qx3RSja&7m6i|ivsJ=#e_t~PrpTxV>|^V&O-)18|Y)q~t z3#-P*^-@l1s~kqGRAv@Lr<}sMG*ItY6MbgY+gG$$edCQdzgIBEcZ9PVqB8n)#(Iv% z1nASaDj|c=26laV5qllB(jDKhG=_d-7%nN+F{W|xcH1 zJI6}jlx%kflv-F_Am6P&YTGEir5N9_`M$d2@l88w-lJrv!}yDU1-*YA+p{QT=OQO-cj)B^)P7z$ah`inUYU=B&_@)63HXoz}Pt(+C@2xtFVpdx1V3=s2vOL6T zBmA2}U$l`E`*_Gng)){ZfTAsX>2?A*9Yn>1^_$>FMU=3Q{R5GP;ukY@We@uY*1t96bFaX+SCr)Rm( zSmBSCGtqcfaT}Mk`)|nK9FpxwmEpDB4JD#V+fQjdfx9j92ze9lTz#ZLLku(g^!{u8 zd&->Ube6B2ym1QV#7z_~50@mV5vlJ4U)zhPkBy_E# zeOcLdU46Wqa44hLoUG3s!qY1puc!3t+1e~dN25p-$cSVm#Fvz1XxL;DGC*4Y&sC=9Gh2g2too<2}H+5LJi|sPC>i#-*?|*#-2j9kX@qb9!u6_$(B72$v%z2ScYZ>(WA*IB(jW*B_&ys9;JCS zND^%-6fF`(mLjxBrS%&%SMPJa=XuY2zVn{*%{epo@BUx^?Y{2o|GWOz6u%Z~yC$Ue zZT8zNA0Hpg{bu~Q3gHQacnY4BgyZ9bQk_d>EF07o1<*ebTSc%1&4VLir7#cfU9O7Z z!5ZloK%qb(5yg{AD8~bstwse3Xl*s%VVzDWPl5Fr4a>0`ur5FgW$+l{xfwH5t4ZAWR`E=$nl?H-v_;LY|G`?J(oqpmC@RD3j1WM0OQ2-1)GYNbT?jiw?&4>2E z8X_iqd}v>Uf%Zli{1)XX7=q#Db2=Me-cxxZb#ljP{`ui65F&;VTASvO_CXAS&}cp+ zWgaJj2w_lO{1{2t))Qxjm@M50OX^vL5y=D+UfBju!$;xCc;yhHvdz+Thmr_%Jb@IW zyvEhhPT6A}VvOK$MjO^SYU9=*noHIqlB+$5lz1YEs_Y)OBZ@?z{?&NN7H5d)|J2m= zCWaB?l*4JXSgPsz^$7_HSOT85^j@)KB5i#TX#Y*%`;p z(3VUi(eSjt1p%oOsW@@&b8{0zNn&hm)>+xuAWAY~h(3ZtjP&#o?#EX~Odt2-R?pDH z(8TvY%nSYBP0at(y!iaPiTQ8mg@u0tsnS)iyFFuBAI`8(wS2EAGoMOTSMr!I%IwT< z`fizvj!h5l;;U^eAj+w(l>xE^pb1pk)m&Ln|n55|U}eB#Xyx0`F>sf(K2li?5%fv!xF!TwgS3EZBd)IIx`V zP`>B646&&qu1RTr!aDiP?0lv}NB~2MInX}-o$XF}8~>giVC|lGr@$gol&@_da+&Me z8H>K#j0#zzzGTADk^p(hfzHPpZ?KZ)VrOe6e}BBQcU{4br_m1_@xo46bT|B zh+B1*e_5a`yeXthFYi3K`IJ$W?IqS;-@9*iRg_KzWFzz?LuLM5NIXKri0EJ-erRDA zgo1<-BBF~C{G|;e+VWa|s~G8jE*Vzd4QM6Z!H)sGcX4Pk@iIKJ zH_5a3zVG*joo2U9gbD&548CfE`~v!w2EHb{b(dR>7%(s0dX{#?C_mR*Vd$kcdg98_ z>xNG=MZ2%6*i4oJDrtFDY z>lA^u&3da+iOWroA|5HL3O;PQmA-JdPLMo5=eL-#aZghW88r@BGf$4M<5B70I010A z^;8dlE9VRW6}!Dj0@9v^NU(iad^y8oV9r|z`h}|npc6puDhBQ1VHOuFa$ZP4eqhi+ z7Fr7!o{JSZ1@e$QPrzX-Kz0CsQ-aEQsc=rHLYX|wR1uWpIB7ym;BZU_G5|ITSSSU^ zEA$~#Uj7{JRx%HKJu-tBKtI?5dJXiwHba6ag@HsIo0zxvj8T1cKkjp*rcjx= z?<mJv?K%urZ39w zC_1~{D7kHJUfILiH}w^>g|za`jZvVUK5EiFgN^7_z|(^er-f6A4@glP4UoXzJnrh5Wtq69tvY|-=y9>p9$QdpzC zkR)rZ1S}I!ooD@362C?5s9>e`#DFBf+MJaJV!y;AO8l0HMY%bGW}vWPlphyj9D-r+ zV~HU@uQ8M`1fBA8lzUkkP2r7luiQ~)UbGZ_^{Ygy(cR=t=d#j_thcx-7%63kwy39c zxk-qtw4+#Q8qop$s@f-`D#U7EZp8Q%n_j=&SzH{PQ(j^)(hX zn@Lxxs+UZ2?9`{WrJKRgWgF|k*wL!rC(U9^?KY&5^woM4c1bGmmE z&SETMY_Frn4OU}WNwLdW^N(BjN<)T^nK<3mf*&@qwCo|%pM1axwTE!LBIg`&fewSZ z*x(8If!ZnbhTZ^qmOqpYu+k351=Lh*2voq6GpD=cIcgCQ8R!+pKx!aHTO70n)TdYy zR1ECveupN2{$U0*2rw-J(&i6W=QctKF_cJZOjI0=6ho%|=z6(r7@kJN$I-%LC?s0q z-&#S`G`D^y5eD4DYX!I6(vRuzm!7njmKn>%g^&F2R&WQaM<0?kaQzuf*%L%lcE&nm zZLl~5!T#)_wEm{TLXshA=7vZW=)ZO{7^y-ZZ{3rRL|+>?q$AR5*E6D3_~gmrCy9P@ zeJY!Oee2GwiDTzggDrvrdW60+L|2t~xXWuE7`~4WkQl@l?IAK-E568M1U;rw zCx3sxs=0P!iS*UIC*NI&L~_>K!4(ans=6cnJa%9qDFr_pkY)VR{8B1N*Jr+mu0@0C zr`F!7!8TapYMhxWGpcr5mndR2zZ2q!*q7Uu+oV}7_0!yTnm~zKYNNR;hf0mY5@Mp) z^WNRBw+mW&?pk8*i&mjusCRnK+4hotY8{7azdz#gc$MP#bMvWp+ldK{Nq)ZB8XHEE zSXkrsZNaHUnABs<@kwO&k(LbIFSfU3&lVr{ST>{Bl<_^?U4hXtHlnxpQn`rzjZWOF z;xN6vZZax~q9p$(fd=((qvo{xQ@Sisx9crov{vBT?>kpV>Z?a6(a|5!;q4I;x3Gcu zTlH)D_jLRjnx`3Lj#Ur3YtVW`0=)`#_@1@|_!#Dx_T(pzg{jV)${#cz>I&fz}OSQB?(v_ii^|j4kBKZRc1;S&$l!AlkE_=YR-K=R*0sf@N_FUXJ6>{8yFt7C|Gt zs{J|Gee_?0mX**o9tHdyRIh{fgBq_t3*7@ekj{p*09UY^p)Md#X@y`Q&**@TfRwba zLHPi;cR^18KG6-`K|u;E_hD$2kRG6hr4u_x;~qpovD}8C)x1Zf4nt%VeHE34$J0WH z6f%+f!#(eX5Xr=NN=yum@au5>t35!|xTnlmF1`5tq!xa@qQdOI(uoN7Wa;ylmci8- zr-Udhv4^neO3$T8+yfy++4WZ}IvJ;pX#JoUQRRP9AS>H?D{tkdqikdKqwhetjfOF| z`!LZn;r1PRdc0di&)E0>7Wzlz)&C(hi%x~L>0{UT99UF$GVRk(HPj`|3<*_^d7RYH zNo*3_IFi@0Z~wLZl{Y85u%4A&>Pla|LU#t}UJVZC=RE4zs%e~2`M}Jwx}$qjcM+5Q zo0LzX*M0YIX@67_=>F;N4^3+2hsor_DBYn4p|siIugDB& zSLt+VQVPm`Rw+E2a@^&d=Czinpy&r@?lwpss{La=kQApWYhk6MLZ3SrAb=^exuPws z^JT3?+AZ@`)5R{a!K=m3T6bCL$B$lGA23l_J; zMDb?yN#V5pnT$4Tfd_Am8PvgazX|jHqZT!0N8h2?i*J%8Y4G<8$0t7VB`Q>hT4neL zZ>z=%U1|AR(p$6Ivh%`iUtupNGvj!VCc?pe1^m*J-t)}7Ms4OM5mBjcb$q!+N7cX7 z-j>h&tkrZ0A)hp3K^~A4y*ELZ?A_+dKEIEzpw7NatS|n0+A&3e{_}rc5ZrZ!)FB@_OC-?emB{h7%kt^zx(L>4eQLpz@XU{!)*yAJfqE@?} z>X81t^d?#Rcu0_(6mU z9Ghi-0%hah9AH;27V~}kp|;^;lukdLr&)eI6QXue`R9aBIR9oXyHY~-;^3DS8u|O> z^W`A}wLxC>$NVGW3kRrS>GaPobpJWhP3rQ`nYCY!Uff{p=$QU)nbhm4^rlTUZb`m} z67Mm`FNAO1cRFfnz9`mX8+N{^z)?L5~&zg zeM)cmtKyQj#^PcW}o*KapiSs%NF_`_a$XI zbyvM`eG{mu0c}?+-_!SgkIJ@(TCFR$Iak_U9!XUab#__phLL-=c=DYoFc3_-N{Fkh`M-|J=+&ENf^4lIJn(=Ml&WbbU?}kP5&%ryx0ib7rAQ zup=bRLvsK}FGBBltj^-%dXCgLXe*%kNC-X%9B}`$O#ns-B5*a(Q5A;+fP9}6Tnw

|~63Yry6)UEBLb6Rv$u>#1K^EZ0h!u>AY2qouC-KgwgYA+&FF7-%&J1DD zC8a@EWOo)lyBgUdquRTX_D5_4_4@g5hp0~>>$^b@?#n!_g1I<~%*FCM*`l?~WfHZ> zAJ<0(_>FQM!!iuxrzg=0-{%Vj?1)s9pUWgDH_kN(*0d31O;Z+T(ajoV#xDBtPT46% zqEaqJLdBdG+J}_XKBV#)$s7}1Fk852iH4DM(GoN8WH>2DQXRpOFiIVl!&>Qlk-E8_ za$cxUUZVFt%?|}qO}rvJF_WX$O_~or>f*J|64V2{CR{%uqP!|?f`;X&qCwkWlLvS^ z8{W~%7#Mont9=#2UZajr+Jrp%GF`{*7;YIJ9B%pbtnOG6n@$Iw>aM5If}gsh4{6~3 zsE^0F;j?xW>2E*9gYJ=fJm_K=q0TrO#y~8@!C0y@#^0L4ddZX@|63%&W|UYM&nL1& zg2@vP1{enkkOBxZF{J zTlxDJYlL&1s~{g%gB1#(5Z1t2D1vpc9*V&R8(<@pz$Pe#GT02|V228*ge_17TVWei z!**~$4LD&3xL_yL(z#BzNAu60jgxJN5e)rq*adaqfqL-5ZrB4pXn;oW!(Ir$J_wSb If4}R@A9={BApigX delta 1027 zcmX}pTQHPi7zgn0%ePn->$Ie;U9?Jy6_rzAb#BWs#1@^Y3NpsX=MNpwZv5E`B%v_nG(kfA6=j)WAJ}Dg$d+XRt7E zZGtQ*d!MqU0*Vw>3snLuhGi0&CWe=51SHp3ewGubx74a^tA%r%rRh*kW$!JAOOc4h z%SmOJoKnK9@YlfM?Af3@!S?Th9g>y{%&iqj%ykGYMxqj|7Nwd|haM|FbHaf#C&cB7l_sB@95taB zTUgs0pmyW~)J_zjcK+H+Qg;_=6f36CRF^uPX|wrlx<0xzzQ84mT#H8UYEM};uH$-4 zEUi_D6-x3ms4q+6>59*v)JrNfq#cqBJL5+rPfEOEFg;`5OC^DBf_%FB)UDo^4I+;| zx7YrrbMuS#&b!rrK%x?u8>Dx-|9nUZsq0(&c#*;bHh>g1!X^?aWNm(|jymIHOBOAC zNiuJClcqeB*2o1j8=a4SOI2LLm&osc|-<;fL{8o`R$J zZ+pKC@#>C!5D8Hb4JwF%{cr#d!XY>eN8l(N12r6n6A(-4j<_1zl^)aGar|_5JS0FO zB*95Yh7?GJQ;-Jfpn=nH1~MQM&cZo34;SDfT!PDx1=(-~uEI6Qf$NY9d5{kUa03cy zy1S^%RVZK>rm#?#s5Jh5C3E4MM~a{rN/dev/null 2>&1 } -#if [[ "$USER" == "laser" || "$USER" == "madalin" || "$USER" == "smiti" ]] if [[ "$USER" == "laser" ]] then pagerduty - log_ssh_login else log_ssh_login - exit 0 fi diff --git a/tor/torrc b/tor/torrc index 149342d..f5a60ea 100644 --- a/tor/torrc +++ b/tor/torrc @@ -10,7 +10,7 @@ ## for more options you can use in this file. ## ## Tor will look for this file in various places based on your platform: -## https://www.torproject.org/docs/faq#torrc +## https://support.torproject.org/tbb/tbb-editing-torrc/ ControlSocket /run/tor/control ControlSocketsGroupWritable 1 @@ -84,7 +84,7 @@ CookieAuthFileGroupReadable 1 ################ This section is just for relays ##################### # -## See https://www.torproject.org/docs/tor-doc-relay for details. +## See https://community.torproject.org/relay for details. ## Required: what port to advertise for incoming Tor connections. #ORPort 9001 @@ -172,7 +172,7 @@ CookieAuthFileGroupReadable 1 ## key fingerprint of each Tor relay you control, even if they're on ## different networks. You declare it here so Tor clients can avoid ## using more than one of your relays in a single circuit. See -## https://www.torproject.org/docs/faq#MultipleRelays +## https://support.torproject.org/relay-operators/multiple-relays/ ## However, you should never include a bridge's fingerprint here, as it would ## break its concealability and potentially reveal its IP/TCP address. ## @@ -210,9 +210,9 @@ CookieAuthFileGroupReadable 1 ## reject *:* or an accept *:*. Otherwise, you're _augmenting_ (prepending to) ## the default exit policy. Leave commented to just use the default, which is ## described in the man page or at -## https://www.torproject.org/documentation.html +## https://support.torproject.org/relay-operators ## -## Look at https://www.torproject.org/faq-abuse.html#TypicalAbuses +## Look at https://support.torproject.org/abuse/exit-relay-expectations/ ## for issues you might encounter if you use the default exit policy. ## ## If certain IPs and ports are blocked externally, e.g. by your firewall, @@ -248,11 +248,11 @@ CookieAuthFileGroupReadable 1 #BridgeDistribution none ## Configuration options can be imported from files or folders using the %include -## option with the value being a path. This path can have wildcards. Wildcards are -## expanded first, using lexical order. Then, for each matching file or folder, the following -## rules are followed: if the path is a file, the options from the file will be parsed as if -## they were written where the %include option is. If the path is a folder, all files on that -## folder will be parsed following lexical order. Files starting with a dot are ignored. Files +## option with the value being a path. This path can have wildcards. Wildcards are +## expanded first, using lexical order. Then, for each matching file or folder, the following +## rules are followed: if the path is a file, the options from the file will be parsed as if +## they were written where the %include option is. If the path is a folder, all files on that +## folder will be parsed following lexical order. Files starting with a dot are ignored. Files ## on subfolders are ignored. ## The %include option can be used recursively. #%include /etc/torrc.d/*.conf