id: mailoney-honeypot-detect

info:
  name: Mailoney Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: |
    A Mailoney (SMTP) honeypot has been identified.
    The response to the 'HELP' command differs from real installations, signaling a possible deceptive setup.
  metadata:
    max-request: 1
    vendor: mailoney
    product: exim
    shodan-query: cpe:"cpe:2.3:a:exim:exim"
  tags: mailoney,exim,smtp,honeypot,ir,cti,network,tcp
tcp:
  - inputs:
      - data: "HELP\r\n"
        read: 1024

    host:
      - "{{Hostname}}"
    port: 25
    read-size: 1024

    matchers:
      - type: word
        words:
          - "502 Error: command \"HELP\" not implemented"
# digest: 4a0a00473045022100e8e945714f5d28fa391be7ef51e1b62c993b81de3dffaf9aa62a0af740b12bd10220367c9c1aa0526b6dd422e9c7bb31d2a83fed5a4aa3682f1878b27be85a701837:922c64590222798bb761d5b6d8e72950