id: maltrail-panel

info:
  name: Maltrail Panel - Detect
  author: ritikchaddha
  severity: info
  description: |
    Maltrail is a malicious traffic detection system, utilizing publicly available (black)lists containing malicious and/or generally suspicious trails, along with static trails compiled from various AV reports and custom user defined lists, where trail can be anything from domain name, URL (e.g. hXXp://109.162.38.120/harsh02.exe for known malicious executable), IP address (e.g. 185.130.5.231 for known attacker) or HTTP User-Agent header value.
  metadata:
    max-request: 1
    shodan-query: title:"Maltrail"
    verified: true
  tags: panel,maltrail,detect

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Maltrail</title>"
          - "/stamparm/maltrail/wiki"
          - "<b>M</b>altrail"
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '<b>M<\/b>altrail \(v<b>([0-9.]+)<\/b>'
# digest: 4b0a00483046022100d40f53d97241305a8e9aae26497ac23da172705a37faa55e877e630faabbe1f2022100f240403455c46f2c88ce218f6b62362637cad47416f16a8223f4f4651a82180a:922c64590222798bb761d5b6d8e72950