Skip to content

Commit 7af166b

Browse files
buixorCopilotCopilot
authored
add the technology probing scenario (#1776)
* add the technology probing scenario * no reprocess * Update scenarios/crowdsecurity/http-technology-probing.yaml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update scenarios/crowdsecurity/http-technology-probing.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Clarify technology probing scenario description and trim whitespace Agent-Logs-Url: https://github.com/crowdsecurity/hub/sessions/ac391c70-f3f2-41da-a496-78626375dc17 Co-authored-by: buixor <990714+buixor@users.noreply.github.com> * fix tests * tests --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: buixor <990714+buixor@users.noreply.github.com>
1 parent e515b59 commit 7af166b

6 files changed

Lines changed: 88 additions & 0 deletions

File tree

‎.tests/http-technology-probing/config.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
parsers:
2+
- crowdsecurity/syslog-logs
3+
- crowdsecurity/dateparse-enrich
4+
- crowdsecurity/nginx-logs
5+
- crowdsecurity/http-logs
6+
scenarios:
7+
- ./scenarios/crowdsecurity/http-technology-probing.yaml
8+
log_file: http-technology-probing.log
9+
log_type: nginx
10+
ignore_parsers: true

‎.tests/http-technology-probing/http-technology-probing.log‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
10.0.0.1 - - [01/Apr/2026:10:00:00 +0000] "GET /cgi-bin/videoconfiguration.cgi HTTP/1.1" 404 153 "-" "curl/7.68.0"
2+
10.0.0.2 - - [01/Apr/2026:10:00:01 +0000] "GET /crx/packmgr/service.jsp HTTP/1.1" 403 153 "-" "curl/7.68.0"
3+
10.0.0.3 - - [01/Apr/2026:10:00:02 +0000] "GET /some/random/path HTTP/1.1" 404 153 "-" "curl/7.68.0"
4+
10.0.0.1 - - [01/Apr/2026:10:00:03 +0000] "GET /index.html HTTP/1.1" 200 1024 "-" "Mozilla/5.0"
5+
10.0.0.1 - - [01/Apr/2026:10:00:01 +0000] "GET /crx/packmgr/service.jsp HTTP/1.1" 403 153 "-" "curl/7.68.0"
6+

‎.tests/http-technology-probing/scenario.assert‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
len(results) == 2
2+
"10.0.0.2" in results[0].Overflow.GetSources()
3+
results[0].Overflow.Sources["10.0.0.2"].IP == "10.0.0.2"
4+
results[0].Overflow.Sources["10.0.0.2"].Range == ""
5+
results[0].Overflow.Sources["10.0.0.2"].GetScope() == "Ip"
6+
results[0].Overflow.Sources["10.0.0.2"].GetValue() == "10.0.0.2"
7+
basename(results[0].Overflow.Alert.Events[0].GetMeta("datasource_path")) == "http-technology-probing.log"
8+
results[0].Overflow.Alert.Events[0].GetMeta("datasource_type") == "file"
9+
results[0].Overflow.Alert.Events[0].GetMeta("http_args_len") == "0"
10+
results[0].Overflow.Alert.Events[0].GetMeta("http_path") == "/crx/packmgr/service.jsp"
11+
results[0].Overflow.Alert.Events[0].GetMeta("http_status") == "403"
12+
results[0].Overflow.Alert.Events[0].GetMeta("http_user_agent") == "curl/7.68.0"
13+
results[0].Overflow.Alert.Events[0].GetMeta("http_verb") == "GET"
14+
results[0].Overflow.Alert.Events[0].GetMeta("log_type") == "http_access-log"
15+
results[0].Overflow.Alert.Events[0].GetMeta("service") == "http"
16+
results[0].Overflow.Alert.Events[0].GetMeta("source_ip") == "10.0.0.2"
17+
results[0].Overflow.Alert.Events[0].GetMeta("target_technology") == "adobe-aem-crx-package-manager-probing"
18+
results[0].Overflow.Alert.Events[0].GetMeta("timestamp") == "2026-04-01T10:00:01Z"
19+
results[0].Overflow.Alert.GetScenario() == "crowdsecurity/http-technology-probing"
20+
results[0].Overflow.Alert.Remediation == false
21+
results[0].Overflow.Alert.GetEventsCount() == 1
22+
"10.0.0.1" in results[1].Overflow.GetSources()
23+
results[1].Overflow.Sources["10.0.0.1"].IP == "10.0.0.1"
24+
results[1].Overflow.Sources["10.0.0.1"].Range == ""
25+
results[1].Overflow.Sources["10.0.0.1"].GetScope() == "Ip"
26+
results[1].Overflow.Sources["10.0.0.1"].GetValue() == "10.0.0.1"
27+
basename(results[1].Overflow.Alert.Events[0].GetMeta("datasource_path")) == "http-technology-probing.log"
28+
results[1].Overflow.Alert.Events[0].GetMeta("datasource_type") == "file"
29+
results[1].Overflow.Alert.Events[0].GetMeta("http_args_len") == "0"
30+
results[1].Overflow.Alert.Events[0].GetMeta("http_path") == "/cgi-bin/videoconfiguration.cgi"
31+
results[1].Overflow.Alert.Events[0].GetMeta("http_status") == "404"
32+
results[1].Overflow.Alert.Events[0].GetMeta("http_user_agent") == "curl/7.68.0"
33+
results[1].Overflow.Alert.Events[0].GetMeta("http_verb") == "GET"
34+
results[1].Overflow.Alert.Events[0].GetMeta("log_type") == "http_access-log"
35+
results[1].Overflow.Alert.Events[0].GetMeta("service") == "http"
36+
results[1].Overflow.Alert.Events[0].GetMeta("source_ip") == "10.0.0.1"
37+
results[1].Overflow.Alert.Events[0].GetMeta("target_technology") == "acti-video-monitoring-panel-probing"
38+
results[1].Overflow.Alert.Events[0].GetMeta("timestamp") == "2026-04-01T10:00:00Z"
39+
results[1].Overflow.Alert.GetScenario() == "crowdsecurity/http-technology-probing"
40+
results[1].Overflow.Alert.Remediation == false
41+
results[1].Overflow.Alert.GetEventsCount() == 1

‎collections/crowdsecurity/base-http-scenarios.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ scenarios:
1818
- crowdsecurity/http-cve-probing
1919
- crowdsecurity/http-sap-interface-probing
2020
- crowdsecurity/http-generic-test
21+
- crowdsecurity/http-technology-probing
2122
collections:
2223
- crowdsecurity/http-cve
2324
contexts:

‎scenarios/crowdsecurity/http-technology-probing.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
A scenario that detects fingerprinting for various (300+) vendors and technologies.
2+
3+
It doesn't trigger a ban on its own.

‎scenarios/crowdsecurity/http-technology-probing.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
type: trigger
2+
name: crowdsecurity/http-technology-probing
3+
description: "Detect HTTP technology/vendor probing"
4+
filter: |
5+
if (evt.Meta.service == 'http' and
6+
evt.Meta.log_type in ['http_access-log', 'http_error-log'] and
7+
evt.Meta.http_status in ['404', '403'])
8+
{
9+
let target_technology = LookupFile(evt.Meta.http_path, "technology_probing.json");
10+
target_technology != "" ? evt.SetMeta("target_technology", target_technology) : false
11+
} else { false }
12+
groupby: evt.Meta.source_ip
13+
blackhole: 1m
14+
data:
15+
#
16+
- dest_file: technology_probing.json
17+
source_url: https://hub-data.crowdsec.net/web/technology_probing.json
18+
type: map
19+
labels:
20+
confidence: 3
21+
spoofable: 0
22+
classification:
23+
- attack.T1595
24+
behavior: "http:scan"
25+
label: "HTTP Technology Probing"
26+
service: http
27+
remediation: false

0 commit comments

Comments
 (0)