id: srv-service-detect

info:
  name: SRV Record Service - Detect
  author: rxerium
  severity: info
  description: |
    Detected services via SRV (Service) DNS records. SRV records defined the location of servers for specified services.
  reference:
    - https://www.rfc-editor.org/rfc/rfc2srv
    - https://en.wikipedia.org/wiki/SRV_record
  metadata:
    max-request: 15
    verified: true
  tags: dns,srv,service,discovery

dns:
  - name: "{{service}}.{{FQDN}}"
    type: SRV

    payloads:
      service:
        - _xmpp-server._tcp
        - _xmpp-client._tcp
        - _xmpps-client._tcp
        - _sip._tcp
        - _sip._udp
        - _sips._tcp
        - _caldav._tcp
        - _carddav._tcp
        - _autodiscover._tcp
        - _minecraft._tcp
        - _teamspeak._tcp
        - _ldap._tcp
        - _ldaps._tcp
        - _kerberos._tcp
        - _kerberos._udp

    matchers:
      - type: word
        part: answer
        words:
          - "IN\tSRV"

    extractors:
      - type: regex
        regex:
          - 'SRV\s+\d+\s+\d+\s+\d+\s+(.+)'
# digest: 4a0a004730450220379e24167bc5f9af99e39f7db265709fe1c221d9dcaecefbef60723c7e3fba6a02210098bc52887cb734c4f962554a8e24516bee734a9755faf7f3bf74fc03c1ffd0d0:922c64590222798bb761d5b6d8e72950