id: dionaea-mysql-honeypot-detect

info:
  name: Dionaea MySQL Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: |
    A MySQL honeypot has been identified.
    The response to a connection command differs from real installations, signaling a possible deceptive setup.
  metadata:
    max-request: 1
    vendor: dionaea
    product: mysql
    shodan-query: product:"mysql"
  tags: dionaea,mysql,honeypot,ir,cti,network,tcp
tcp:
  - inputs:
      - data: "\x4a\x00\x00\x00\x0a\x35\x2e\x31\x2e\x32\x39\x00\x0b\x00\x00\x00\x21\x3e\x34\x1b\x51\x3f\x34\x33\x60\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"

    host:
      - "{{Hostname}}"
    port: 3306
    read-size: 1024

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "5.7.16"

      - type: word
        words:
          - "aaaaaaaa"
# digest: 4a0a0047304502205d2a4ab1f5f1f002db0fb86831417e577790867fcb04188cbd3ce9e069451b1c022100a79af3ecfb020084882de7890d826f104e3a1f417bec5b5c6e578a479e4f2bb7:922c64590222798bb761d5b6d8e72950