diff --git a/network/detection/bitvise-ssh-detect.yaml b/network/detection/bitvise-ssh-detect.yaml new file mode 100644 index 0000000000..7ea2c93b37 --- /dev/null +++ b/network/detection/bitvise-ssh-detect.yaml @@ -0,0 +1,34 @@ +id: bitvise-detect + +info: + name: SSH Bitvise Service - Detect + author: abdullahisik + severity: info + description: | + Bitvise SSH service was detected. + reference: + - https://www.bitvise.com/ + - https://vulners.com/openvas/OPENVAS:1361412562310813387 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + cpe: cpe:/a:bitvise:winsshd + metadata: + shodan-query: product:"bitvise" + max-request: 1 + tags: network,ssh,bitvise,detect + +tcp: + - host: + - "{{Hostname}}" + port: 22 + + matchers: + - type: regex + regex: + - '(?i)Bitvise' + + extractors: + - type: regex + regex: + - "SSH([-0-9.]+) FlowSsh: Bitvise ([A-Z a-z()]+) ([0-9.]+)" \ No newline at end of file