Collection for Dockge Docker Container.

collections/LearningSpot/dockge.md

@@ -0,0 +1,17 @@
+A collection to defend Dockge instance against common attacks :
+ - Dockge parser
+ - Dockge bruteforce & enumeration detection
+
+## Acquisition template
+
+Example acquisition for this collection :
+
+If dockge container name is dockge or change the container name accordingly :
+```yaml
+---
+source: docker
+container_name:
+ - dockge
+labels:
+  type: dockge
+```

collections/LearningSpot/dockge.yml

@@ -0,0 +1,10 @@
+parsers:
+  - LearningSpot/dockge-logs
+scenarios:
+  - LearningSpot/dockge-bf
+description: "Dockge parser and brute-force detection"
+author: LearningSpot
+tags:
+  - linux
+  - brute-force
+  - dockge

collections/LearningSpot/open-webui.md

@@ -0,0 +1,17 @@
+A collection to defend Open WebUI Docker instance against common attacks :
+ - Open WebUI parser
+ - Open WebUI bruteforce detection
+
+## Acquisition template
+
+Example acquisition for this collection :
+
+If Open WebUI container name is open-webui or change the container name accordingly :
+```yaml
+---
+source: docker
+container_name:
+ - open-webui
+labels:
+  type: open-webui
+```

collections/LearningSpot/open-webui.yml

@@ -0,0 +1,10 @@
+parsers:
+  - LearningSpot/open-webui-logs
+scenarios:
+  - LearningSpot/open-webui-bf
+description: "Open WebUI parser and brute-force detection"
+author: LearningSpot
+tags:
+  - linux
+  - brute-force
+  - open-webui

parsers/s01-parse/LearningSpot/dockge-logs.md

@@ -0,0 +1,10 @@
+Parser for Dockge Logs with Docker.
+
+```yaml
+---
+source: docker
+container_name:
+ - dockge
+labels:
+  type: dockge
+```

parsers/s01-parse/LearningSpot/dockge-logs.yaml

@@ -0,0 +1,22 @@
+name: LearningSpot/dockge-logs
+description: "Parse Dockge Logs"
+filter: "evt.Parsed.program == 'dockge'"
+onsuccess: next_stage
+nodes:
+ - grok:
+     pattern: '%{TIMESTAMP_ISO8601:timestamp} \[AUTH\] WARN: Incorrect username or password for user %{EMAILADDRESS:username} IP=%{IP:source_ip}'
+     apply_on: message
+     statics:
+       - meta: log_type
+         value: dockge_failed_auth
+       - target: evt.StrTime
+         expression: evt.Parsed.event_timestamp
+       - meta: target_user
+         expression: evt.Parsed.username
+       - meta: dockge_service
+         expression: evt.Parsed.dockge_service
+statics:
+   - meta: service
+     value: dockge
+   - meta: source_ip
+     expression: evt.Parsed.source_ip

parsers/s01-parse/LearningSpot/open-webui-logs.md

@@ -0,0 +1,10 @@
+Parser for Open WebUI Logs with Docker.
+
+```yaml
+---
+source: docker
+container_name:
+ - open-webui
+labels:
+  type: open-webui
+```

parsers/s01-parse/LearningSpot/open-webui-logs.yaml

@@ -0,0 +1,20 @@
+name: LearningSpot/open-webui-logs
+description: "Parse Open Web UI logs"
+filter: "evt.Parsed.program == 'open-webui'"
+onsuccess: next_stage
+nodes:
+ - grok:
+     pattern: '%{LOGLEVEL:log_level}:%{SPACE}%{IP:source_ip}:0 - "POST /api/v1/auths/signin HTTP/1.1" %{NUMBER:status} Bad Request'
+     apply_on: message
+     statics:
+       - meta: log_type
+         value: open-webui_failed_auth
+       - target: evt.StrTime
+         expression: evt.Parsed.event_timestamp
+       - meta: open-webui_service
+         expression: evt.Parsed.open-webui_service
+statics:
+   - meta: service
+     value: open-webui
+   - meta: source_ip
+     expression: evt.Parsed.source_ip

parsers/s02-enrich/crowdsecurity/nextcloud-whitelist.yaml

@@ -8,7 +8,7 @@ whitelist:
    - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/files_versions/preview' && evt.Parsed.http_args contains 'version' #Backup app missing file version
    - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/photos/api/v1/preview' && evt.Parsed.http_args contains 'x' && evt.Parsed.http_args contains 'y' #Photo app loads all previews as small panes, but can 404
    - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Parsed.request contains '/core/preview' && evt.Parsed.http_args contains 'x=' && evt.Parsed.http_args contains 'y=' && evt.Parsed.http_args contains 'fileId=' #File preview often 404s while searching
-   - evt.Meta.http_status in ['404', '200'] && evt.Meta.http_verb in ['PROPFIND', 'GET'] && evt.Meta.http_path matches '^/remote.php/(web)?dav/' #Uploading new files via WebDAV always produces a 404
+   - evt.Meta.http_status in ['404', '200'] && evt.Meta.http_verb in ['PROPFIND', 'GET', 'HEAD'] && evt.Meta.http_path matches '^/remote.php/(web)?dav/' #Uploading new files via WebDAV always produces a 404
    - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/mail/api/avatars/url/' #When loading mail contacts the avatars may get 404
    - evt.Meta.http_status == '200' && evt.Parsed.static_ressource == 'false' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/photos/api/v1/preview' && evt.Parsed.http_args contains '&x=' && evt.Parsed.http_args contains '&y=' && evt.Parsed.http_args contains 'etag=' #When loading multiple images inside Nextcloud Photos, HTTP Crawl non statics is triggered since the images look like dynamic assets.
    - evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Parsed.request == '/ocs/v2.php/apps/text/workspace' && evt.Parsed.http_args contains 'path=%2F' #When opening folders in Nextcloud Files that don't contain a readme.md 404 error is thrown

scenarios/LearningSpot/dockge-bf.md

@@ -0,0 +1,4 @@
+Detect failed dockge authentications:
+
+leakspeed of 1m, capacity of 3 on source ip
+leakspeed of 1m, capacity of 3 on users

scenarios/LearningSpot/dockge-bf.yaml

@@ -0,0 +1,35 @@
+type: leaky
+name: LearningSpot/dockge_bf
+description: "Detect Dockge Bruteforce"
+filter: evt.Meta.log_type == 'dockge_failed_auth'
+groupby: evt.Meta.source_ip
+leakspeed: 1m
+capacity: 3
+blackhole: 5m
+reprocess: true
+labels:
+  service: dockge
+  classification:
+    - attack.T1110
+  behavior: "http:bruteforce"
+  label: "Dockge Bruteforce"
+  remediation: true
+---
+type: leaky
+name: LearningSpot/dockge_bf_user_enum
+description: "Detect Dockge User Enumeration Bruteforce"
+filter: evt.Meta.log_type == 'dockge_failed_auth'
+distinct: evt.Meta.target_user
+groupby: evt.Meta.source_ip
+leakspeed: 1m
+capacity: 3
+blackhole: 5m
+reprocess: true
+labels:
+  service: dockge
+  classification:
+    - attack.T1589
+    - attack.T1110
+  behavior: "http:bruteforce"
+  label: "Dockge User Enumeration"
+  remediation: true

scenarios/LearningSpot/open-webui-bf.md

@@ -0,0 +1,3 @@
+Detect failed authentications for Open WebUI:
+
+leakspeed of 1m, capacity of 3 on source ip leakspeed of 1m, blackhole for 5m.

scenarios/LearningSpot/open-webui-bf.yaml

@@ -0,0 +1,16 @@
+type: leaky
+name: LearningSpot/open-webui-bf
+description: "Detect open webui bruteforce"
+filter: evt.Meta.log_type == 'open-webui_failed_auth'
+groupby: evt.Meta.source_ip
+leakspeed: 1m
+capacity: 3
+blackhole: 5m
+reprocess: true
+labels:
+  service: open-webui
+  classification:
+    - attack.T1110
+  behavior: "http:bruteforce"
+  label: "Open Web UI Bruteforce"
+  remediation: true