Create aws-sftp-detect.yaml

network/detection/aws-sftp-detect.yaml

@@ -0,0 +1,31 @@
+id: aws-sftp-detect
+
+info:
+  name: OpenSSH Service - Detect
+  author: johnk3r
+  severity: info
+  description: |
+    AWS_SFTP service was detected.
+  reference:
+    - https://aws.amazon.com/pt/about-aws/whats-new/2018/11/aws-transfer-for-sftp-fully-managed-sftp-for-s3/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cwe-id: CWE-200
+  metadata:
+    max-request: 1
+  tags: network,ssh,detect,aws
+
+tcp:
+  - host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?i)AWS_SFTP'
+
+    extractors:
+      - type: regex
+        regex:
+          - '(?i)SSH-(.*)-AWS_SFTP_[^\r]+'