Custom IPS Signature for website brute force logins

[greminn]

Hi There, We are trying to develop a custom IPS Signature to assist in protecting brute force login attempts. We would like to match a URL (e.g. a_login_page.php) if it is accessed X number of times within X number of seconds - and then be able to monitor/block/quarantine from there. Currently we have the following: F-SBID( --name " Website.Login.Brute.Force.Custom" ; --protocol TCP; --service HTTP; --flow from_client; --pattern " a_login_page.php" ; --no_case; --context host; --rate 10,60,limit; --track SRC_IP; ) In theory we are counting 10 accesses within 60 seconds and counting those accesses strictly.. but what we have found is that if a client accesses http://www.awebsite.com/a_login_page.php and the login page includes other elements such as images, the count is including the images as they are refered by the page (we think!). In this case, its easy for a real client to trigger the attack as they might have 2 or 3 attempts to access. I have a feeling that we are going about it in the wrong way.. can anyone suggest a better way to skin this cat? Thanks Simon

[billp]

Simon, I did a search on " brute force" on this forum and found some interesting links that might help you. This looks to be the most promising: https://forum.fortinet.com/FindPost/103518

[greminn]

OK thats great thanks! (Sorry i didnt search before hand!) So I have this working correctly from the point of view that the IPS profile works, and bans a IP after 10 attempts within 60 seconds. I now have 15 pages of Banned IPs! But it seems to get to some limit of the amount of Banned IPs and then lets everthing after that thru... Is there a limit of Banned IPs? Simon

[greminn · Accepted solution]

As a followup on this. We asked Fortigate to assist in getting this correct and thanks to the IPS team we have a well functioning custom IPS sig. We have used this to quarantine the (multiple) attackers IP for 1 hour and after a couple of days the issue has gone away (150,000 attacks in a week+). The final syntax was: F-SBID( --name Website.Brute.Force.Custom; --protocol TCP; --service HTTP; --flow from_client; --pattern login-page-url.php; --context uri; --no_case; --rate 10,120,limit; --track SRC_IP; ) In our case we were using it to protect against WordPress brute force login attempts, so we simply used " --pattern wp-login.php;" We check for 10 accesses sequentially with 2mins and are applying the quarantine rule to countries that are outside of our main client base. Cheers Simon

[billp]

Simon -- Thanks for posting back! I' m glad the script is working well. It' s really helpful to have that added to the collective knowledge on the board.