diff --git a/technologies/dell/dell-idrac9-detect.yaml b/technologies/dell/dell-idrac9-detect.yaml index f6c4427914..f165ac02ae 100644 --- a/technologies/dell/dell-idrac9-detect.yaml +++ b/technologies/dell/dell-idrac9-detect.yaml @@ -3,8 +3,8 @@ id: dell-idrac9-detect info: name: Detect Dell iDRAC9 author: kophjager007 - description: The Integrated Dell Remote Access Controller (iDRAC) is designed for secure local and remote server management and helps IT administrators deploy, update and monitor Dell EMC PowerEdge servers. severity: info + description: The Integrated Dell Remote Access Controller (iDRAC) is designed for secure local and remote server management and helps IT administrators deploy, update and monitor Dell EMC PowerEdge servers. tags: tech,dell requests: @@ -17,19 +17,20 @@ requests: - type: status status: - 200 + - type: word - part: all words: - - "14G" + - "BuildVersion" + - "SystemModelName" extractors: - type: regex part: body regex: - '[0-9]{2}G' + - type: regex part: body - name: fwver group: 1 regex: - '"FwVer" *: *"([^"]+)"' diff --git a/technologies/osquery-fleet-detect.yaml b/technologies/osquery-fleet-detect.yaml new file mode 100644 index 0000000000..7a0e69c068 --- /dev/null +++ b/technologies/osquery-fleet-detect.yaml @@ -0,0 +1,29 @@ +id: osquery-fleet-detect + +info: + name: OSQuery Fleet Detection + author: Adam Crosser + severity: info + reference: https://fleetdm.com/ + metadata: + shodan-query: http.favicon.hash:-1529860313 + tags: panel,fleet,osquery + +requests: + - method: GET + path: + - '{{BaseURL}}/login' + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "Fleet" + - "osquery" + - "/assets/bundle" + condition: and + + - type: status + status: + - 200