2023-11-07 12:34:04 +00:00
|
|
|
id: dionaea-mysql-honeypot-detect
|
|
|
|
|
|
|
|
|
|
info:
|
2023-11-08 06:13:53 +00:00
|
|
|
name: Dionaea MySQL Honeypot - Detect
|
2023-11-07 12:34:04 +00:00
|
|
|
author: UnaPibaGeek
|
|
|
|
|
severity: info
|
|
|
|
|
description: |
|
|
|
|
|
A MySQL honeypot has been identified.
|
|
|
|
|
The response to a connection command differs from real installations, signaling a possible deceptive setup.
|
|
|
|
|
metadata:
|
|
|
|
|
max-request: 2
|
|
|
|
|
vendor: dionaea
|
|
|
|
|
product: mysql
|
2023-11-08 06:13:53 +00:00
|
|
|
tags: dionaea,mysql,honeypot,ir,cti,network
|
2023-11-07 12:34:04 +00:00
|
|
|
|
|
|
|
|
tcp:
|
|
|
|
|
- inputs:
|
|
|
|
|
- data: "\x4a\x00\x00\x00\x0a\x35\x2e\x31\x2e\x32\x39\x00\x0b\x00\x00\x00\x21\x3e\x34\x1b\x51\x3f\x34\x33\x60\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
|
|
|
|
|
|
|
|
|
|
host:
|
|
|
|
|
- "{{Hostname}}"
|
2023-11-07 19:02:53 +00:00
|
|
|
port: 3306
|
2023-11-07 12:34:04 +00:00
|
|
|
read-size: 1024
|
|
|
|
|
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
- type: word
|
|
|
|
|
words:
|
|
|
|
|
- "5.7.16"
|
|
|
|
|
|
|
|
|
|
- type: word
|
|
|
|
|
words:
|
2023-11-10 06:42:26 +00:00
|
|
|
- "aaaaaaaa"
|
|
|
|
|
# digest: 4b0a00483046022100a423f772a912a505bd8d4b19a18dc6bad894d29467c991f291fc232d42b946f6022100e462030fa370646b9f7633015f06933b79ec9619ff0338307e60220d8cc34462:922c64590222798bb761d5b6d8e72950
|
