id: cowrie-honeypot-detect

info:
  name: Cowrie SSH Honeypot Detect
  author: thesubtlety
  severity: info
  reference:
    - https://web.archive.org/web/20170826075224/https://morris.sc/detecting-kippo-ssh-honeypots/
    - https://github.com/blazeinfosec/detect-kippo-cowrie/blob/master/detectKippoCowrie.py
    - https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssh/detect_kippo.rb
  tags: network,ssh,honeypot

network:
  - host:
      - '{{Hostname}}'
      - '{{Host}}:22'

    inputs:
      - data: "\n"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'SSH\-([0-9.-A-Za-z_ ]+)'

      - type: word
        words:
          - Invalid SSH identification string