id: dionaea-mysql-honeypot-detect

info:
  name: Dionaea MySQL Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: |
    A MySQL honeypot has been identified.
    The response to a connection command differs from real installations, signaling a possible deceptive setup.
  metadata:
    max-request: 1
    vendor: dionaea
    product: mysql
    shodan-query: product:"mysql"
  tags: dionaea,mysql,honeypot,ir,cti,network,tcp
tcp:
  - inputs:
      - data: "\x4a\x00\x00\x00\x0a\x35\x2e\x31\x2e\x32\x39\x00\x0b\x00\x00\x00\x21\x3e\x34\x1b\x51\x3f\x34\x33\x60\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"

    host:
      - "{{Hostname}}"
    port: 3306
    read-size: 1024

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "5.7.16"

      - type: word
        words:
          - "aaaaaaaa"
# digest: 4b0a00483046022100afac433126433d32a25495ffabaa5be29218575516e683701b75725a24aacc74022100befb7741e456d3b2ea6870da2c5221d034073697c9609d7a8dcd105264e5aa43:922c64590222798bb761d5b6d8e72950