IBM DB2 Database Server Detection

network/detection/ibm-d2b-database-server-detect.yaml

@@ -0,0 +1,29 @@
+id: ibm-d2b-database-server-detect
+
+info:
+  name: IBM DB2 Database Server Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    A Db2 server is a relational database management system (RDBMS) that delivers data to its IBM data server clients. If you plan to use a database that resides on this computer, install a Db2 server. For more information about Db2 server.
+  reference:
+    - https://nmap.org/nsedoc/scripts/db2-das-info.html
+  metadata:
+    verified: true
+    shodan-query: product:"IBM DB2 Database Server"
+  tags: network,detect,mikrotik
+
+network:
+  - inputs:
+      - data: "01c2000000040000b601000053514c4442325241000100000401010005001d008800000001000080000000010900000001000040000000010900000001000040000000010800000004000040000000010400000001000040000000400400000004000040000000010400000004000040000000010400000004000040000000010400000002000040000000010400000004000040000000010000000001000040000000000400000004000080000000010400000004000080000000010400000003000080000000010400000004000080000000010800000001000040000000010400000004000040000000011000000001000080000000011000000001000080000000010400000004000040000000010900000001000040000000010900000001000080000000010400000003000080000000010000000000000000000000000104000001000080000000010000000000000000000000000000000000000000000000000000000001000040000000010000000001000040000000002020202020202020000000000000000000000000000000000100ff000000000000000000000000000000000000000000e404000000000000000000000000000000000000007f"
+        type: hex
+    host:
+      - "{{Hostname}}"
+      - "{{Host}}:50000"
+    matchers:
+      - type: word
+        encoding: hex
+        words:
+          - "SQLDB2RA"
+          - "DB2"
+          - "SQLJS1D"