id: cpppo-ethernetip-cip-honeypot

info:
  name: CPPPO Ethernet/IP CIP Honeypot Default Configuration - Detect
  author: biero-el-corridor
  severity: info
  description: |
    Detected devices responding with the default configuration signature of the CPPPO (Python-based) Ethernet/IP CIP parser honeypot.This indicates systems likely running the default Conpot honeypot configuration for ICS using the Common Industrial Protocol (CIP) over Ethernet/IP.
  reference:
    - https://github.com/claroty/enip-stack-detector
  tags: ics,cip,honeypot,network,tcp

tcp:
  - inputs:
      - data: "63000000000000000000000000000000c1debed100000000"
        type: hex

    host:
      - "{{Hostname}}"
    port: 44818
    read-size: 1024

    matchers:
      - type: word
        part: info
        words:
          - "63003c00000000000000000000000000c1debed10000000001000c00360001000002af1200000000000000000000000001000e003600140b60311a066c0014313735362d4c36312f42204c4f47495835353631ff"
# digest: 4a0a00473045022100a0eefd45eee0ef2982457873120e3371c9d019650c539bdbf8d74de60b0692b8022068a84aeafc404df46b343eec125f9f8be07162c9f79ab5e92868738a3e151052:922c64590222798bb761d5b6d8e72950