id: redis-honeypot-detect

info:
  name: Redis Honeypot - Detect
  author: UnaPibaGeek
  severity: info
  description: |
    A Redis honeypot has been identified.
    The response to the 'QUIT' command differs from real installations, signaling a possible deceptive setup.
  classification:
    cpe: cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: redis
    product: redis
    shodan-query:
      - redis
      - redis_version
  tags: redis,honeypot,ir,cti,network,tcp
tcp:
  - inputs:
      - data: "QUIT"

    host:
      - "{{Hostname}}"
    port: 6379
    read-size: 1024

    matchers:
      - type: word
        words:
          - "-ERR unknown command `QUIT`, with args beginning with:"
# digest: 4a0a0047304502201dbdc5a2df54f948d0f2ad115773f465ae19354783fdfdfba4d2b6e7d641e9ef022100edf766db687fd54b66f62addadf75f946679f6b5509ace01cce721d7398c7f68:922c64590222798bb761d5b6d8e72950