id: dionaea-mqtt-honeypot-detect

info:
  name: Dionaea MQTT Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: |
    A Dionaea MQTT honeypot has been identified.
    The response to a MQTTv5 packet differs from real installations, signaling a possible deceptive setup.
  metadata:
    verified: true
    max-request: 1
    vendor: dionaea
    product: mqtt
    shodan-query:
      - product:"MQTT"
      - product:"mqtt"
  tags: dionaea,mqtt,honeypot,ir,cti,network,tcp,discovery
tcp:
  - inputs:
      - data: "101000044d5154540502003c032100140000"
        type: hex

    host:
      - "{{Hostname}}"
    port: 1883
    read-size: 1024

    matchers:
      - type: binary
        binary:
          - "20020000"
# digest: 4b0a00483046022100bdda8f7a0256f02cc429a6b6e6ce8d3d25607acf473206b4daeac4483d162daa022100e09d5185a6a601f7ea4c4e811dfb8a4fb1275c44ba85399f6712a29a6f26f799:922c64590222798bb761d5b6d8e72950