id: cowrie-ssh-honeypot-detect

info:
  name: Cowrie SSH Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: |
    A Cowrie (or Twisted) SSH honeypot has been identified.
    The response to a wrong SSH version differs from real installations, signaling a possible deceptive setup.
  metadata:
    max-request: 1
    vendor: cowrie
    product: ssh
  tags: cowrie,twisted,ssh,honeypot,ir,cti,network,tcp
tcp:
  - inputs:
      - data: "SSH-1337-OpenSSH_9.0\r\n"

    host:
      - '{{Hostname}}'
    port: 22

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'SSH\-([0-9.-A-Za-z_ ]+)'

      - type: word
        words:
          - Protocol major versions differ.
          - bad version 1337
        condition: or
# digest: 4a0a004730450220510ac244dcd25a1b3001d3a376a3aa1b56e7809e8871af50d112b54a313ec2cd0221009ba69954e5a654abc3d8986d98342d15b903f8e3e4b5df1240fd80cf8f792fa2:922c64590222798bb761d5b6d8e72950