id: cowrie-ssh-honeypot-detect

info:
  name: Cowrie SSH Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: |
    A Cowrie (or Twisted) SSH honeypot has been identified.
    The response to a wrong SSH version differs from real installations, signaling a possible deceptive setup.
  metadata:
    max-request: 1
    vendor: cowrie
    product: ssh
  tags: cowrie,twisted,ssh,honeypot,ir,cti,network,tcp
tcp:
  - inputs:
      - data: "SSH-1337-OpenSSH_9.0\r\n"

    host:
      - '{{Hostname}}'
    port: 22

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'SSH\-([0-9.-A-Za-z_ ]+)'

      - type: word
        words:
          - Protocol major versions differ.
          - bad version 1337
        condition: or
# digest: 4a0a0047304502210084b47d1cc7036632b3a728e5bfe9feca2eee7e56fd02f1ad5445481dc483375e0220335e49d78f543ee7228cf2bda1da7a04cc5a73c10b5343a704c1646c95b59364:922c64590222798bb761d5b6d8e72950