id: gaspot-honeypot-detect

info:
  name: GasPot Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: |
    A GasPot honeypot has been identified.
    The response to the '^AI21400' command differs from real installations, signaling a possible deceptive setup.
  metadata:
    max-request: 1
    vendor: gaspot
    product: veeder-root
    shodan-query: port:10001
  tags: gaspot,veeder-root,ics,honeypot,ir,cti,network,tcp
tcp:
  - inputs:
      - data: "^AI21400"

    host:
      - "{{Hostname}}"
    port: 10001
    read-size: 1024

    matchers:
      - type: word
        words:
          - "9999FF1B"
# digest: 4a0a00473045022100f3e10c6b5f1b442197b29696a073115cfbe2b37ab34cfd8537cfc48985c8c8bb02207b6dab712e71ee717ad6f4aada666ee30e6c11f0d6897bf4fe54eec6a0e76f1f:922c64590222798bb761d5b6d8e72950