id: conpot-siemens-honeypot-detect

info:
  name: Conpot (Siemens) Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: |
    A Conpot (Siemens) honeypot has been identified.
    The response to a first packet of a connection attempt differs from real installations, signaling a possible deceptive setup.
  metadata:
    verified: true
    max-request: 1
    vendor: conpot
    product: siemens
    shodan-query:
      - html:"Overview - Siemens, SIMATIC"
      - http.html:"overview - siemens, simatic"
    fofa-query: body="overview - siemens, simatic"
  tags: conpot,siemens,honeypot,ir,cti,network,tcp,discovery
tcp:
  - inputs:
      - data: "0300001611e00000000400c1020100c2020102c0010a"
        type: hex

    host:
      - "{{Hostname}}"
    port: 102
    read-size: 1024

    matchers:
      - type: binary
        binary:
          - "030000130ed00000000000c1020000c2020000"
# digest: 4a0a0047304502204047952a6c2e92df5c67dd3117d1c1c25de2e8d7cf950dbf0c6d01ed66262c81022100c16a2c1674fc2b81d488f06e40b2e65b3799e53e5e7854ec2c5aa14b5a08e8bc:922c64590222798bb761d5b6d8e72950