nuclei-templates/network/detection/moveit-sftp-detect.yaml

31 lines
584 B
YAML

id: moveit-sftp-detect
info:
name: MOVEit Transfer SFTP - Detect
author: johnk3r
severity: info
description: |
MOVEit Transfer SFTP was detected.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
cwe-id: CWE-200
metadata:
max-request: 1
shodan-query: "SSH-2.0-MOVEit"
tags: network,ssh,detect,moveit,sftp
tcp:
- host:
- "{{Hostname}}"
port: 22
matchers:
- type: regex
regex:
- '(?i)MOVEit'
extractors:
- type: regex
regex:
- '(?i)SSH-(.*)-MOVEit[^\r]+'