Update dionaea-http-honeypot-detect.yaml

http/honeypot/dionaea-http-honeypot-detect.yaml

@@ -1,37 +1,37 @@
-  id: dionaea-http-honeypot-detect
+id: dionaea-http-honeypot-detect
 
-  info:
+info:
-    name: Dionaea HTTP Honeypot - Detect
+  name: Dionaea HTTP Honeypot - Detect
-    author: UnaPibaGeek
+  author: UnaPibaGeek
-    severity: info
+  severity: info
-    description: |
+  description: |
-      Dionaea HTTP honeypot has been identified.
+    Dionaea HTTP honeypot has been identified.
-      The response to an incorrect HTTP method reveals a possible setup of the Dioanea web application honeypot.
+    The response to an incorrect HTTP method reveals a possible setup of the Dioanea web application honeypot.
-    metadata:
+  metadata:
-      max-request: 1
+    max-request: 1
-      vendor: dionaea
+    vendor: dionaea
-      product: http
+    product: http
-    tags: dionaea,honeypot,ir,cti
+  tags: dionaea,honeypot,ir,cti
 
-  http:
+http:
-    - raw:
+  - raw:
-        - |
+      - |
-          AAAA / HTTP/1.1
+        AAAA / HTTP/1.1
-          Host: {{Hostname}}
+        Host: {{Hostname}}
 
-      unsafe: true
+    unsafe: true
-      matchers-condition: and
+    matchers-condition: and
-      matchers:
+    matchers:
-        - type: status
+      - type: status
-          status:
+        status:
-            - 501
+          - 501
 
-        - type: word
+      - type: word
-          part: header
+        part: header
-          words:
+        words:
-            - "nginx"
+          - "nginx"
 
-        - type: word
+      - type: word
-          part: body
+        part: body
-          words:
+        words:
-            - '<?xml version="1.0" encoding="ascii"?>'
+          - '<?xml version="1.0" encoding="ascii"?>'