id: dionaea-mysql-honeypot-detect

info:
  name: Dionaea MySQL Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: |
    A MySQL honeypot has been identified.
    The response to a connection command differs from real installations, signaling a possible deceptive setup.
  metadata:
    max-request: 1
    vendor: dionaea
    product: mysql
    shodan-query: product:"mysql"
  tags: dionaea,mysql,honeypot,ir,cti,network,tcp,discovery
tcp:
  - inputs:
      - data: "\x4a\x00\x00\x00\x0a\x35\x2e\x31\x2e\x32\x39\x00\x0b\x00\x00\x00\x21\x3e\x34\x1b\x51\x3f\x34\x33\x60\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"

    host:
      - "{{Hostname}}"
    port: 3306
    read-size: 1024

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "5.7.16"

      - type: word
        words:
          - "aaaaaaaa"
# digest: 490a0046304402200cca1b227015e44f9af922f56c39727955600d44d848cb956caeaebc728a3ca802200dbc09954e570e0e091b53d3b2e56b790929a1734ecf447999af294bc02df0aa:922c64590222798bb761d5b6d8e72950