cve-2024-6387: much faster leakspeed and higher capacity

.index.json

@@ -13942,15 +13942,23 @@
   },
   "crowdsecurity/ssh-cve-2024-6387": {
    "path": "scenarios/crowdsecurity/ssh-cve-2024-6387.yaml",
-   "version": "0.1",
+   "version": "0.3",
    "versions": {
     "0.1": {
      "digest": "1a36e33f8743790c5544faa999aa8dd062f6e2b696e16232d3a3f28576119503",
      "deprecated": false
+    },
+    "0.2": {
+     "digest": "07cd656d9aaf98762ae805a5e5c18514e9f58fe5211a597a1401b9bb89027841",
+     "deprecated": false
+    },
+    "0.3": {
+     "digest": "2b56281d406b8cb679e9d095c4cb929b6846e04d2d6b99548114b0773825e828",
+     "deprecated": false
     }
    },
    "long_description": "RGV0ZWN0IGV4cGxvaXRhdGlvbiBhdHRlbXB0cyBvZiBDVkUtMjAyNC02Mzg3CiA=",
-   "content": "IyBzc2ggYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L3NzaC1jdmUtMjAyNC02Mzg3CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGV4cGxvaXRhdGlvbiBhdHRlbXB0IG9mIENWRS0yMDI0LTYzODciCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdzc2hfYXV0aF90aW1lb3V0JyIKbGVha3NwZWVkOiAiMTgwcyIKY2FwYWNpdHk6IDMKZ3JvdXBieTogZXZ0Lk1ldGEuc291cmNlX2lwCmJsYWNraG9sZTogMW0KcmVwcm9jZXNzOiB0cnVlCmxhYmVsczoKICBzZXJ2aWNlOiBzc2gKICBjb25maWRlbmNlOiAzCiAgc3Bvb2ZhYmxlOiAwCiAgY2xhc3NpZmljYXRpb246CiAgICAtIGF0dGFjay5UMTE5MAogICAgLSBjdmUuQ1ZFLTIwMjQtNjM4NwogIGxhYmVsOiAiU1NIIENWRS0yMDI0LTYzODciCiAgYmVoYXZpb3I6ICJzc2g6ZXhwbG9pdCIKICByZW1lZGlhdGlvbjogdHJ1ZQ==",
+   "content": "IyBzc2ggYnJ1dGVmb3JjZQp0eXBlOiBsZWFreQpuYW1lOiBjcm93ZHNlY3VyaXR5L3NzaC1jdmUtMjAyNC02Mzg3CmRlc2NyaXB0aW9uOiAiRGV0ZWN0IGV4cGxvaXRhdGlvbiBhdHRlbXB0IG9mIENWRS0yMDI0LTYzODciCmZpbHRlcjogImV2dC5NZXRhLmxvZ190eXBlID09ICdzc2hfYXV0aF90aW1lb3V0JyIKbGVha3NwZWVkOiAiMnMiCmNhcGFjaXR5OiAyMApncm91cGJ5OiBldnQuTWV0YS5zb3VyY2VfaXAKYmxhY2tob2xlOiAxbQpyZXByb2Nlc3M6IHRydWUKbGFiZWxzOgogIHNlcnZpY2U6IHNzaAogIGNvbmZpZGVuY2U6IDMKICBzcG9vZmFibGU6IDAKICBjdGk6IGZhbHNlCiAgcHVibGljOiBmYWxzZQogIGNsYXNzaWZpY2F0aW9uOgogICAgLSBhdHRhY2suVDExOTAKICAgIC0gY3ZlLkNWRS0yMDI0LTYzODcKICBsYWJlbDogIlNTSCBDVkUtMjAyNC02Mzg3IgogIGJlaGF2aW9yOiAic3NoOmV4cGxvaXQiCiAgcmVtZWRpYXRpb246IHRydWUK",
    "description": "Detect exploitation attempt of CVE-2024-6387",
    "author": "crowdsecurity",
    "labels": {
@@ -13960,7 +13968,9 @@
      "cve.CVE-2024-6387"
     ],
     "confidence": 3,
+    "cti": false,
     "label": "SSH CVE-2024-6387",
+    "public": false,
     "remediation": true,
     "service": "ssh",
     "spoofable": 0

scenarios/crowdsecurity/ssh-cve-2024-6387.yaml

@@ -3,18 +3,20 @@ type: leaky
 name: crowdsecurity/ssh-cve-2024-6387
 description: "Detect exploitation attempt of CVE-2024-6387"
 filter: "evt.Meta.log_type == 'ssh_auth_timeout'"
-leakspeed: "180s"
-capacity: 3
+leakspeed: "2s"
+capacity: 20
 groupby: evt.Meta.source_ip
 blackhole: 1m
 reprocess: true
 labels:
   service: ssh
   confidence: 3
   spoofable: 0
+  cti: false
+  public: false
   classification:
     - attack.T1190
     - cve.CVE-2024-6387
   label: "SSH CVE-2024-6387"
   behavior: "ssh:exploit"
-  remediation: true
+  remediation: true

scripts/scenario_taxonomy.py

@@ -260,6 +260,7 @@ def main():
             confidence = 0
             spoofable = 0
             in_cti = True
+            is_public = True
 
             if "label" in labels:
                 scenario_label = scenario["labels"]["label"]
@@ -276,6 +277,10 @@ def main():
                 if not labels["cti"]:
                     in_cti = False
 
+            if "public" in labels:
+                if not labels["public"]:
+                    is_public = False
+
             if scenario_label == "":
                 desc = scenario["description"].lower()
                 if desc.startswith("detect "):
@@ -320,6 +325,7 @@ def main():
                 "spoofable": spoofable,
                 "cti": in_cti,
                 "service": service,
+                "public": is_public,
             }
 
             if len(cves) > 0: