updated matcher & info

http/cves/2015/CVE-2015-1635.yaml

@@ -1,18 +1,28 @@
 id: CVE-2015-1635
+
 info:
-  name: HTTP.sys Remote Code Execution Vulnerability
+  name: Microsoft Windows 'HTTP.sys' - Remote Code Execution
   author: Phillipo
   severity: critical
-  description: HTTP.sys in some versions of Microsoft Windows allows remote attackers to execute arbitrary code via crafted HTTP requests.
+  description: |
+    HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
   reference:
     - https://www.exploit-db.com/exploits/36773
     - https://www.securitysift.com/an-analysis-of-ms15-034/
+    - https://nvd.nist.gov/vuln/detail/CVE-2015-1635
   classification:
     cvss-metrics: AV:N/AC:L/Au:N/C:C/I:C/A:C
     cvss-score: 10.0
     cwe-id: CWE-94
     cve-id: CVE-2015-1635
-  tags: cve,cve2015,kev,microsoft
+    cpe: cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    verified: true
+    vendor: microsoft
+    product: windows_7
+    shodan-query: '"Microsoft-IIS" "2015"'
+  tags: cve,cve2015,kev,microsoft,iis,rce
 
 http:
   - method: GET
@@ -21,8 +31,16 @@ http:
     headers:
       Range: "bytes=0-18446744073709551615"
 
+    matchers-condition: and
     matchers:
       - type: word
+        part: body
         words:
           - "HTTP Error 416"
           - "The requested range is not satisfiable"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - "Microsoft"