feat: add PumbaLP/adguardhome-dot collection for DoT scanner detection#1797
Open
PumbaLP wants to merge 1 commit into
Open
feat: add PumbaLP/adguardhome-dot collection for DoT scanner detection#1797PumbaLP wants to merge 1 commit into
PumbaLP wants to merge 1 commit into
Conversation
Parser: PumbaLP/adguardhome-dot-errors - Extracts remote IP from AdGuard Home DoT connection reset errors - Detects port 853 scanners that fail TLS handshake Scenario: PumbaLP/adguardhome-dot-scan - Bans after 5 resets within 10 minutes from same IP - Tested against AdGuard Home v0.107.x in production Closes: crowdsecurity#1753
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a parser and scenario to detect port 853 (DNS-over-TLS) scanners targeting AdGuard Home instances.
Port scanners that probe DoT without completing a proper TLS handshake cause repeated "connection reset by peer" errors in AdGuard Home logs. This collection extracts the remote IP from these errors and bans IPs that trigger 5+ resets within 10 minutes.
Components
PumbaLP/adguardhome-dot-errors: extracts remote_ip, log_type and service from AdGuard Home DoT error logsPumbaLP/adguardhome-dot-scan: leaky bucket, capacity 5, leakspeed 10m, grouped by source_ipPumbaLP/adguardhome-dot: bundles both componentsWhat it detects
Port scanners and probers that connect to port 853 (DoT) without completing a proper TLS handshake. These appear as repeated
connection reset by peererrors in AdGuard Home logs.What it does NOT detect
crowdsecurity/nginx-logsinsteadTesting
Two hubtests are included:
adguardhome-dot-errors: validates parser extracts source_ip, log_type and service correctlyadguardhome-dot-scan: validates scenario coverage with 6 events from same IPTested in production against AdGuard Home v0.107.x running in Docker.
Closes #1753
Checklist