lint - fix

network/detection/SSH/3com-wx-nos-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: 3com-wx-nos-ssh-detect
+
+info:
+  name: 3Com WX NOS SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    3Com WX2200 or WX4400 NOS SSH server detection. 3Com WX switches use NOS (Network Operating System) with a custom SSH implementation that can be identified by the SSH banner format SSH-2.0-NOS-SSH_version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: product:"3Com WX2200 or WX4400 NOS sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "NOS-SSH"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-NOS-SSH_([0-9.]+)"

network/detection/SSH/adtran-netvanta-romclisecure-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: adtran-netvanta-romclisecure-ssh-detect
+
+info:
+  name: Adtran Netvanta RomCliSecure SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Adtran Netvanta RomCliSecure SSH server detection. Adtran Netvanta devices use RomCliSecure for SSH functionality. It can be identified by the SSH banner format SSH-2.0-RomCliSecure_version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: product:"Adtran Netvanta RomCliSecure sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "RomCliSecure"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-RomCliSecure_([0-9.]+)"

network/detection/SSH/allegrosoft-romsshell-detect.yaml

@@ -0,0 +1,32 @@
+id: allegrosoft-romsshell-detect
+
+info:
+  name: AllegroSoft RomSShell SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    AllegroSoft RomSShell SSH server detection. AllegroSoft RomSShell is an embedded SSH server implementation for embedded systems and IoT devices. It can be identified by the SSH banner format SSH-2.0-RomSShell_version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: product:"AllegroSoft RomSShell sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "RomSShell"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-RomSShell_([0-9.]+)"

network/detection/SSH/apc-aos-cryptlib-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: apc-aos-cryptlib-ssh-detect
+
+info:
+  name: APC AOS cryptlib SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    APC AOS cryptlib SSH server detection. APC (American Power Conversion) AOS (Advanced Operating System) uses cryptlib for SSH functionality. It can be identified by the SSH banner format SSH-2.0-cryptlib.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: product:"APC AOS cryptlib sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "cryptlib"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-cryptlib"

network/detection/SSH/bitvise-winsshd-detect.yaml

@@ -0,0 +1,33 @@
+id: bitvise-winsshd-detect
+
+info:
+  name: Bitvise WinSSHD - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Bitvise WinSSHD SSH server detection. Bitvise WinSSHD is a Windows-based SSH server implementation that can be identified by the SSH banner format SSH-2.0-version sshlib: WinSSHD version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: product:"Bitvise WinSSHD"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "WinSSHD"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.-]+) FlowSsh: WinSSHD ([0-9.:]+)"
+          - "SSH-([0-9.-]+) FlowSsh: Bitvise SSH Server (WinSSHD) ([0-9.:]+)"

network/detection/SSH/cerberus-ftp-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: cerberus-ftp-ssh-detect
+
+info:
+  name: Cerberus FTP Server SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Cerberus FTP Server SSH detection. Cerberus FTP Server is a Windows-based FTP/SFTP server that includes SSH functionality. It can be identified by the SSH banner format SSH-2.0-CerberusFTPServer_version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"Cerberus FTP Server sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "CerberusFTPServer"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-CerberusFTPServer_([0-9]+)"

network/detection/SSH/cisco-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: cisco-ssh-detect
+
+info:
+  name: Cisco SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Cisco SSH server detection. Cisco devices use a custom SSH implementation that can be identified by the SSH banner format SSH-2.0-Cisco-version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: product:"Cisco SSH"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "Cisco-"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-Cisco-([0-9.]+)"

network/detection/SSH/coreftp-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: coreftp-ssh-detect
+
+info:
+  name: CoreFTP SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    CoreFTP SSH server detection. CoreFTP is a Windows-based FTP/SFTP client and server that includes SSH functionality. It can be identified by the SSH banner format SSH-2.0-CoreFTP-version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"CoreFTP sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "CoreFTP"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-CoreFTP-([0-9.]+)"

network/detection/SSH/draytek-vigor-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: draytek-vigor-ssh-detect
+
+info:
+  name: DrayTek Vigor SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    DrayTek Vigor SSH server detection. DrayTek Vigor routers use a custom SSH implementation called DraySSH that can be identified by the SSH banner format SSH-2.0-DraySSH_version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"DrayTek Vigor 2820n ADSL router sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "DraySSH"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-DraySSH_([0-9.]+)"

network/detection/SSH/f-secure-winnt-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: f-secure-winnt-ssh-detect
+
+info:
+  name: F-Secure WinNT SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    F-Secure WinNT SSH server detection. F-Secure SSH is a commercial SSH server implementation for Windows that can be identified by the SSH banner format SSH-2.0-version F-Secure SSH Windows NT Server.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: product:"F-Secure WinNT sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "F-Secure"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.-]+) F-Secure SSH Windows NT Server"

network/detection/SSH/force10-switch-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: force10-switch-ssh-detect
+
+info:
+  name: Force10 Switch SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Force10 switch SSH server detection. Force10 network switches use a custom SSH implementation that can be identified by the SSH banner format [email protected].
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"Force10 switch sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "force10networks"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-SSH_v([0-9.]+)@force10networks\\.com"

network/detection/SSH/forti-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: forti-ssh-detect
+
+info:
+  name: FortiSSH SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    FortiSSH SSH server detection. FortiSSH is the SSH implementation used in Fortinet network security devices. It can be identified by the SSH banner format SSH-2.0-FortiSSH_version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"FortiSSH"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "FortiSSH"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-FortiSSH_([0-9.]+)"

network/detection/SSH/fressh-detect.yaml

@@ -0,0 +1,32 @@
+id: fressh-detect
+
+info:
+  name: FreSSH SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    FreSSH SSH server detection. FreSSH is a free SSH server implementation for Windows that can be identified by the SSH banner format SSH-2.0-FreSSH.version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: product:"FreSSH"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "FreSSH"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-FreSSH\\.([0-9.]+)"

network/detection/SSH/ftp-masquerading-sftpcloud-detect.yaml

@@ -0,0 +1,27 @@
+id: ftp-masquerading-sftpcloud-detect
+
+info:
+  name: FTP Masquerading as SFTPCloud - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    FTP masquerading as SFTPCloud detection. Some FTP servers masquerade as SFTPCloud.io by using a misleading SSH banner. This can be identified by the SSH banner format SSH-2.0-SSH-2.0-SFTPCloud.io.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: product:"FTP masquerading as SFTPCloud"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "SFTPCloud"
+        condition: and

network/detection/SSH/globalscape-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: globalscape-ssh-detect
+
+info:
+  name: Globalscape SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Globalscape SSH server detection. Globalscape uses a custom SSH implementation based on OpenSSH that can be identified by the SSH banner format SSH-2.0-version_openssh Globalscape.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: product:"SCS sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "Globalscape"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-([0-9.]+)_openssh Globalscape"

network/detection/SSH/huawei-vrp-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: huawei-vrp-ssh-detect
+
+info:
+  name: Huawei VRP SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Huawei VRP SSH server detection. Huawei VRP (Versatile Routing Platform) is the operating system used in Huawei network devices. It uses a custom SSH implementation that can be identified by the SSH banner format SSH-1.99-VRP-version or SSH-2.0-VRP-version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"Huawei VRP sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "VRP"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-VRP-([0-9.]+)"

network/detection/SSH/kojoney-ssh-honeypot-detect.yaml

@@ -0,0 +1,32 @@
+id: kojoney-ssh-honeypot-detect
+
+info:
+  name: Kojoney SSH Honeypot - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Kojoney SSH honeypot detection. Kojoney is a low-interaction SSH honeypot written in Python using the Twisted framework. It can be identified by the SSH banner format SSH-2.0-Twisted.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"Kojoney SSH honeypot"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "Twisted"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-Twisted"

network/detection/SSH/lancom-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: lancom-ssh-detect
+
+info:
+  name: Lancom SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Lancom SSH server detection. Lancom devices use a custom SSH implementation that can be identified by the SSH banner format SSH-2.0-lancom.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"lancom sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "lancom"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-lancom"

network/detection/SSH/libssh-detect.yaml

@@ -0,0 +1,32 @@
+id: libssh-detect
+
+info:
+  name: libssh SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    libssh SSH server detection. libssh is a multiplatform C library implementing the SSH protocol that can be used to build SSH clients and servers. It can be identified by the SSH banner format SSH-2.0-libssh-version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"libssh"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "libssh"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-libssh-([0-9.]+)"

network/detection/SSH/mikrotik-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: mikrotik-ssh-detect
+
+info:
+  name: MikroTik RouterOS SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    MikroTik RouterOS SSH server detection. MikroTik RouterOS uses a custom SSH implementation that can be identified by the SSH banner format SSH-2.0-ROSSSH.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: product:"MikroTik RouterOS sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "ROSSSH"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-ROSSSH"

network/detection/SSH/mocana-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: mocana-ssh-detect
+
+info:
+  name: Mocana SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Mocana embedded SSH server detection. Mocana provides embedded SSH implementations for IoT and embedded devices that can be identified by the SSH banner format SSH-2.0-Mocana SSH.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: product:"Mocana embedded SSH"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "Mocana"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-Mocana SSH"

network/detection/SSH/netapp-data-ontap-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: netapp-data-ontap-ssh-detect
+
+info:
+  name: NetApp Data ONTAP SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    NetApp Data ONTAP SSH server detection. NetApp Data ONTAP is the operating system used in NetApp storage systems. It uses a custom SSH implementation that can be identified by the SSH banner format SSH-2.0-Data ONTAP SSH version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"NetApp Data ONTAP sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "Data ONTAP"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-Data ONTAP SSH ([0-9.]+)"

network/detection/SSH/netscreen-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: netscreen-ssh-detect
+
+info:
+  name: NetScreen SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    NetScreen SSH server detection. NetScreen firewalls use a custom SSH implementation that can be identified by the SSH banner format SSH-2.0-NetScreen.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"NetScreen sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "NetScreen"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-NetScreen"

network/detection/SSH/paramiko-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: paramiko-ssh-detect
+
+info:
+  name: Paramiko Python SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Paramiko Python SSH server detection. Paramiko is a Python implementation of the SSHv2 protocol that provides both client and server functionality. It can be identified by the SSH banner format SSH-2.0-paramiko.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"Paramiko Python sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "paramiko"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-paramiko(_([0-9.]+))?"

network/detection/SSH/pragma-fortressssh-detect.yaml

@@ -0,0 +1,32 @@
+id: pragma-fortressssh-detect
+
+info:
+  name: Pragma FortressSSH SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Pragma FortressSSH SSH server detection. Pragma FortressSSH is a commercial SSH server implementation for Windows that can be identified by the SSH banner format SSH-2.0-Pragma FortressSSH version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"Pragma FortessSSH"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "FortressSSH"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-Pragma FortressSSH ([0-9.]+)"

network/detection/SSH/proftpd-mod-sftp-detect.yaml

@@ -0,0 +1,32 @@
+id: proftpd-mod-sftp-detect
+
+info:
+  name: ProFTPD mod_sftp SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    ProFTPD mod_sftp SSH server detection. ProFTPD mod_sftp is an SFTP module for ProFTPD that provides SSH/SFTP functionality and can be identified by the SSH banner format SSH-2.0-mod_sftp/version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"ProFTPD mod_sftp"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "mod_sftp"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-mod_sftp/([0-9.]+)"

network/detection/SSH/radware-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: radware-ssh-detect
+
+info:
+  name: Radware SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Radware SSH server detection. Radware network security devices use a custom SSH implementation that can be identified by the SSH banner format SSH-2.0-Radware_version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"Radware sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "Radware"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-Radware_([0-9.]+)"

network/detection/SSH/serv-u-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: serv-u-ssh-detect
+
+info:
+  name: Serv-U SSH Server - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Serv-U SSH Server detection. Serv-U is a Windows-based FTP/SFTP server that includes SSH functionality. It can be identified by the SSH banner format SSH-2.0-Serv-U_version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"Serv-U SSH Server"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "Serv-U"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-Serv-U_([0-9.]+)"

network/detection/SSH/sunssh-detect.yaml

@@ -0,0 +1,32 @@
+id: sunssh-detect
+
+info:
+  name: SunSSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    SunSSH SSH server detection. SunSSH is the SSH implementation used in Solaris and other Sun Microsystems operating systems. It can be identified by the SSH banner format SSH-2.0-Sun_SSH_version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"SunSSH"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "Sun_SSH"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-Sun_SSH_([0-9.]+)"

network/detection/SSH/vandyke-vshell-detect.yaml

@@ -0,0 +1,32 @@
+id: vandyke-vshell-detect
+
+info:
+  name: VanDyke VShell SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    VanDyke VShell SSH server detection. VanDyke VShell is a commercial SSH/SFTP server for Windows that can be identified by the SSH banner format SSH-2.0-VShell_version VShell.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"VanDyke VShell sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "VShell"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-VShell_([0-9_]+) VShell"

network/detection/SSH/weonlydo-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: weonlydo-ssh-detect
+
+info:
+  name: WeOnlyDo SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    WeOnlyDo SSH server detection. WeOnlyDo is a commercial SSH/SFTP server implementation that can be identified by the SSH banner format SSH-2.0-WeOnlyDo version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"WeOnlyDo sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "WeOnlyDo"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-WeOnlyDo ([0-9.]+)"

network/detection/SSH/wrq-reflection-secure-it-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: wrq-reflection-secure-it-ssh-detect
+
+info:
+  name: WRQ Reflection for Secure IT SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    WRQ Reflection for Secure IT SSH server detection. WRQ Reflection for Secure IT is a commercial SSH/SFTP server implementation that can be identified by the SSH banner format SSH-2.0-WRQReflectionForSecureIT_version Build buildnumber.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"WRQ Reflection for Secure IT sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "WRQReflectionForSecureIT"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-WRQReflectionForSecureIT_([0-9.]+) Build ([0-9]+)"

network/detection/SSH/ws-ftp-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: ws-ftp-ssh-detect
+
+info:
+  name: WS_FTP SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    WS_FTP SSH server detection. WS_FTP is a Windows-based FTP/SFTP client and server that includes SSH functionality. It can be identified by the SSH banner format SSH-2.0-WS_FTP-SSH_version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"WS_FTP sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "WS_FTP"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-WS_FTP-SSH_([0-9.]+)"

network/detection/SSH/xlight-ftp-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: xlight-ftp-ssh-detect
+
+info:
+  name: Xlight FTP Server SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    Xlight FTP Server SSH detection. Xlight FTP Server is a Windows-based FTP/SFTP server that includes SSH functionality. It can be identified by the SSH banner format SSH-2.0-xlightftpd_release_version.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"Xlight FTP Server sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "xlightftpd"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-xlightftpd_release_([0-9.]+)"

network/detection/SSH/zyxel-zywall-ssh-detect.yaml

@@ -0,0 +1,32 @@
+id: zyxel-zywall-ssh-detect
+
+info:
+  name: ZyXEL ZyWALL SSH - Detection
+  author: pussycat0x
+  severity: info
+  description: |
+    ZyXEL ZyWALL SSH server detection. ZyXEL ZyWALL devices use a custom SSH implementation that can be identified by the SSH banner format SSH-2.0-Zyxel SSH server.
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: ssh product:"ZyXEL ZyWALL sshd"
+  tags: network,ssh,detect
+
+tcp:
+  - inputs:
+      - data: "\n"
+    host:
+      - "{{Hostname}}"
+    port: 22
+
+    matchers:
+      - type: word
+        words:
+          - "SSH-"
+          - "Zyxel"
+        condition: and
+
+    extractors:
+      - type: regex
+        regex:
+          - "SSH-([0-9.]+)-Zyxel SSH server"