diff --git a/network/detection/vmware-authentication-daemon-detect.yaml b/network/detection/vmware-authentication-daemon-detect.yaml index 9b89b5b67f..e95b503f7f 100644 --- a/network/detection/vmware-authentication-daemon-detect.yaml +++ b/network/detection/vmware-authentication-daemon-detect.yaml @@ -1,4 +1,4 @@ -id: vmware-authentication-daemon-detect +id: vmware-authentication-daemon info: name: VMware Authentication Daemon Detection @@ -9,7 +9,7 @@ info: metadata: verified: true shodan-query: 'product:"VMware Authentication Daemon"' - tags: network,vmware,auth + tags: network,vmware,authenticated network: @@ -18,13 +18,15 @@ network: host: - "{{Hostname}}" - "{{Host}}:902" - matchers-condition: and + matchers: - type: word words: - "ServerDaemonProtocol:SOAP" - "MKSDisplayProtocol:VNC" + condition: and + extractors: - type: regex regex: - - "VMware Authentication Daemon Version ([0-9.]+)" \ No newline at end of file + - "VMware Authentication Daemon Version ([0-9.]+)"