HTTPS Bruteforce signature - rate limit

Forum|Forum|9 years ago
October 31, 2016
5 replies
5847 views

Hi,

I am trying to create a custom signature for HTTPS Bruteforce detection (SSL inspection enabled) and I have the following syntax: F-SBID (--name Website.Brute.Force.CustomBody; --protocol TCP; --flow from_server; --pattern "failed because"; --context body; --rate 5,45,limit; --track SRC_IP;)

it is based on server "failed" answers, but even if the rate is 5,45 sometimes alert is triggered even earlier (3,4 attempts) Does anyone know how to mitigate that, or what to change to have more accurate detection.

Thx in advance!

BR Petr Bucek

5.2

ede_pfau

SuperUser

I think you should use

--flow from_server,reversed;

See post #102544 for example.

dzimofukAuthor

New Member

Hi,

thx for your answer, but even if i added "reversed" the detection is not working properly.

F-SBID(--name Website.Brute.Force; --protocol TCP; --flow from_server,reversed; --pattern "failed because"; --context body; --rate 6,60,limit; --track SRC_IP;) The behavior is the same like before, (example: even 4 attempts generate 3 alarms etc.)

dzimofukAuthor

New Member

noone knows?

Sign up

Login with SSO

Login to the community

Login with SSO