id: elasticpot-honeypot-detect

info:
  name: ElasticPot Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: |
    A ElasticPot (ElasticSearch) honeypot has been identified.
    The response to a '_cluster/settings' request differs from real installations, signaling a possible deceptive setup.
  metadata:
    max-request: 1
    vendor: elasticpot
    product: elasticsearch
    fofa-query: "index_not_found_exception"
  tags: elasticpot,elasticsearch,honeypot,ir,cti

http:
  - method: GET
    path:
      - "{{BaseURL}}/_cluster/settings"

    matchers:
      - type: word
        part: body
        words:
          - 'index_not_found_exception'
# digest: 4a0a0047304502201d96aeb450267677b4d91c80ce903eb86c8cb3567f38ceefdc8823a0bcfa7b79022100877daacf4e0121a5b087003f66e564fa64c84dc975ff2837df209321941d179f:922c64590222798bb761d5b6d8e72950