id: cowrie-ssh-honeypot-detect

info:
  name: Cowrie SSH Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: |
    A Cowrie (or Twisted) SSH honeypot has been identified.
    The response to a wrong SSH version differs from real installations, signaling a possible deceptive setup.
  metadata:
    max-request: 1
    product: ssh
    vendor: cowrie
  tags: cowrie,twisted,ssh,honeypot,ir,cti,network

tcp:
  - inputs:
      - data: "SSH-1337-OpenSSH_9.0\r\n"

    host:
      - '{{Hostname}}'
    port: 22

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'SSH\-([0-9.-A-Za-z_ ]+)'

      - type: word
        words:
          - Protocol major versions differ.
          - bad version 1337
        condition: or
# digest: 4b0a00483046022100a91298c47f57c0e8066bab70d78e218b951576d18c5261983f05a5b70624df5c022100ee4373b8996ed8f513b2fd32f2c16a90cdd16c68ab6d78bd1da33dae5f19f1e8:922c64590222798bb761d5b6d8e72950