id: tlsa-record-detect

info:
  name: TLSA Record - DANE Detection
  author: rxerium
  severity: info
  description: |
    A TLSA record was detected. TLSA records are used for DANE (DNS-based Authentication of Named Entities) to bind TLS certificates to domain names.
  reference:
    - https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities
    - https://www.internetsociety.org/resources/deploy360/dane/
  classification:
    cwe-id: CWE-200
  metadata:
    max-request: 1
  tags: dns,tlsa,dane,ssl,discovery

dns:
  - name: "_443._tcp.{{FQDN}}"
    type: TLSA

    matchers:
      - type: regex
        part: answer
        regex:
          - "IN\tTLSA\t(.+)$"

    extractors:
      - type: regex
        group: 1
        regex:
          - "IN\tTLSA\t(.+)"
# digest: 490a00463044022079c1cfbb5ed46da7fff285b9079789ba2115ff07632e9493e2245e8e1770a10402202ac8100ddeaa84161ec3c79ac885ee57b84514622f5b69805d987c0d995f799a:922c64590222798bb761d5b6d8e72950