Create moveit-sftp-detect.yaml

network/detection/moveit-sftp-detect.yaml

@@ -0,0 +1,29 @@
+id: moveit-sftp-detect
+
+info:
+  name: MOVEit Transfer SFTP - Detect
+  author: johnk3r
+  severity: info
+  description: |
+    MOVEit Transfer SFTP was detected.
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+    cwe-id: CWE-200
+  metadata:
+    max-request: 1
+  tags: network,ssh,detect,moveit,sftp
+
+tcp:
+  - host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: regex
+        regex:
+          - '(?i)MOVEit'
+
+    extractors:
+      - type: regex
+        regex:
+          - '(?i)SSH-(.*)-MOVEit[^\r]+'