From fdbad0dd37bf12e8351eec036aa68e348dcdf071 Mon Sep 17 00:00:00 2001
From: johnk3r <johnatan2camargo@gmail.com>
Date: Wed, 15 Nov 2023 15:42:48 -0300
Subject: [PATCH 1/2] Create moveit-sftp-detect.yaml

---
 network/detection/moveit-sftp-detect.yaml | 29 +++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 network/detection/moveit-sftp-detect.yaml

diff --git a/network/detection/moveit-sftp-detect.yaml b/network/detection/moveit-sftp-detect.yaml
new file mode 100644
index 0000000000..81e1fd800a
--- /dev/null
+++ b/network/detection/moveit-sftp-detect.yaml
@@ -0,0 +1,29 @@
+id: moveit-sftp-detect
+
+info:
+  name: MOVEit Transfer SFTP - Detect
+  author: johnk3r
+  severity: info
+  description: |
+    MOVEit Transfer SFTP was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cwe-id: CWE-200
+  metadata:
+    max-request: 1
+  tags: network,ssh,detect,moveit,sftp
+
+tcp:
+  - host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?i)MOVEit'
+
+    extractors:
+      - type: regex
+        regex:
+          - '(?i)SSH-(.*)-MOVEit[^\r]+'

From fdb50b54cb880183a13aea887d7cf2a6a0775e2c Mon Sep 17 00:00:00 2001
From: johnk3r <johnatan2camargo@gmail.com>
Date: Wed, 15 Nov 2023 15:44:39 -0300
Subject: [PATCH 2/2] Update moveit-sftp-detect.yaml

---
 network/detection/moveit-sftp-detect.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/network/detection/moveit-sftp-detect.yaml b/network/detection/moveit-sftp-detect.yaml
index 81e1fd800a..21af9e3a91 100644
--- a/network/detection/moveit-sftp-detect.yaml
+++ b/network/detection/moveit-sftp-detect.yaml
@@ -11,6 +11,7 @@ info:
     cwe-id: CWE-200
   metadata:
     max-request: 1
+    shodan-query: "SSH-2.0-MOVEit"
   tags: network,ssh,detect,moveit,sftp
 
 tcp: