· 6 years ago · Nov 29, 2018, 08:42 AM
1# Password brute-force
2alert tcp any any -> 192.168.11.2 80 ( \
3classtype: web-application-attack; \
4msg: "Bank Oceanic password brute-force"; \
5uricontent: "/accounts/loginproc.php"; nocase; \
6content: "post"; nocase; \
7content: "username"; nocase; \
8content: "password"; nocase; \
9content: "submit"; nocase; \
10threshold: type both, track by_src, count 10, seconds 1; \
11react: block; \
12sid:000000001; )