id: clamav-detect

info:
  name: ClamAV Server Detect
  author: pussycat0x
  severity: info
  description: |
    Clam AntiVirus is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses.
  metadata:
    max-request: 2
    verified: true
    shodan-query: 'port:3310 product:"ClamAV"'
  tags: network,clamav,detect

tcp:
  - inputs:
      - data: "VERSION"
    host:
      - "{{Hostname}}"
      - "{{Host}}:3310"

    matchers:
      - type: regex
        regex:
          - 'ClamAV ([0-9.]+)'

    extractors:
      - type: regex
        regex:
          - "ClamAV ([0-9.]+)"