id: clamav-detect

info:
  name: ClamAV Server Detect
  author: pussycat0x
  severity: info
  description: |
    Clam AntiVirus is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses.
  metadata:
    max-request: 1
    shodan-query: port:3310 product:"ClamAV"
    verified: true
  tags: network,clamav,detect

tcp:
  - inputs:
      - data: "VERSION"
    host:
      - "{{Hostname}}"
    port: 3310

    matchers:
      - type: regex
        regex:
          - 'ClamAV ([0-9.]+)'

    extractors:
      - type: regex
        regex:
          - "ClamAV ([0-9.]+)"
# digest: 4a0a00473045022100fc88d4c90eea9d261889b6d66b27798b6f3b063b9067cfd4f0c367c7763546ab022037b50510e479f32561c39409537cf0f9867ca24c5787e903fd6a421e1b4a537a:922c64590222798bb761d5b6d8e72950