diff --git a/network/detection/bitvise-detect.yaml b/network/detection/bitvise-detect.yaml new file mode 100644 index 0000000000..59125af37c --- /dev/null +++ b/network/detection/bitvise-detect.yaml @@ -0,0 +1,35 @@ +id: bitvise-detect + +info: + name: Bitvise Service - Detect + author: abdullahisik + severity: info + description: | + Bitvise service was detected. + reference: + - https://www.bitvise.com/ + - https://vulners.com/openvas/OPENVAS:1361412562310813387 + + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N + cwe-id: CWE-200 + cpe: cpe:/a:bitvise:winsshd + metadata: + shodan-query: product:"bitvise" + max-request: 1 + tags: seclists,network,ssh,bitvise,detect + +tcp: + - host: + - "{{Hostname}}" + port: 22 + + matchers: + - type: regex + regex: + - '(?i)Bitvise' + + extractors: + - type: regex + regex: + - "SSH-([0-9.]+)-([0-9.]+) .*"