id: cowrie-ssh-honeypot-detect

info:
  name: Cowrie SSH Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: |
    A Cowrie (or Twisted) SSH honeypot has been identified.
    The response to a wrong SSH version differs from real installations, signaling a possible deceptive setup.
  metadata:
    max-request: 1
    vendor: cowrie
    product: ssh
  tags: cowrie,twisted,ssh,honeypot,ir,cti,network,tcp,discovery
tcp:
  - inputs:
      - data: "SSH-1337-OpenSSH_9.0\r\n"

    host:
      - '{{Hostname}}'
    port: 22

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'SSH\-([0-9.-A-Za-z_ ]+)'

      - type: word
        words:
          - Protocol major versions differ.
          - bad version 1337
        condition: or
# digest: 490a00463044022034c105ef1ced62ea7c2c24581ee430a8dd7203a47f35b6753d71441fa316b761022078fdae6248bd43bc71f81dc58678c3b06810b9a4fa8bc0996564e572ced83055:922c64590222798bb761d5b6d8e72950