2021-12-19 09:04:36 +00:00
|
|
|
id: cowrie-honeypot-detect
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: Cowrie SSH Honeypot Detect
|
|
|
|
|
author: thesubtlety
|
|
|
|
|
severity: info
|
|
|
|
|
reference:
|
|
|
|
|
- https://web.archive.org/web/20170826075224/https://morris.sc/detecting-kippo-ssh-honeypots/
|
|
|
|
|
- https://github.com/blazeinfosec/detect-kippo-cowrie/blob/master/detectKippoCowrie.py
|
|
|
|
|
- https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssh/detect_kippo.rb
|
|
|
|
|
tags: network,ssh,honeypot
|
|
|
|
|
|
|
|
|
|
network:
|
|
|
|
|
- host:
|
|
|
|
|
- '{{Hostname}}'
|
2021-12-19 13:33:13 +00:00
|
|
|
- '{{Host}}:22'
|
2021-12-19 09:04:36 +00:00
|
|
|
|
|
|
|
|
inputs:
|
|
|
|
|
- data: "\n"
|
|
|
|
|
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
- type: regex
|
|
|
|
|
part: body
|
|
|
|
|
regex:
|
|
|
|
|
- 'SSH\-([0-9.-A-Za-z_ ]+)'
|
|
|
|
|
|
|
|
|
|
- type: word
|
|
|
|
|
words:
|
|
|
|
|
- Invalid SSH identification string
|
