SANS Diary Details Cowrie Honeypot Brute-Force Analysis Tool
A SANS ISC guest diary describes a custom Python tool (batch.py) used to analyze SSH/Telnet brute-force attacks captured by the Cowrie honeypot on DShield Sensor Honeypot-Omaha.
This SANS Internet Storm Center guest diary, authored by a SANS.edu BACS intern, is primarily a methodology write-up rather than a new threat disclosure. It describes 'batch.py', a Python script built to consolidate and correlate logs from a DShield honeypot sensor (Honeypot-Omaha) running Cowrie, which emulates SSH (22) and Telnet (23) services to attract automated credential-based attacks. The tool ingests JSON/log/gzip data, queries ip-api.com, cve.org, and paloaltonetworks.com APIs, and produces TSV reports, pie charts, and menu-driven summaries of top attacking IPs, usernames, passwords, protocols, and exploit/threat-rating correlations.
The diary walks through a representative attack session captured by the honeypot: a threat actor made 28 connection attempts using guessed/brute-forced credentials, successfully authenticated multiple times, ran reconnaissance commands (uname, busybox, listing /usr/local/sbin), and attempted anti-forensic cleanup via 'rm -rf filter' before disconnecting and reconnecting repeatedly. The author frames this behavior using a Reconnaissance-Initial Exploitation-Persistence/Privilege Escalation-Lateral Movement-Exfiltration (RIPLE) model. The observed activity is consistent with routine automated SSH/Telnet credential-stuffing/brute-force bots rather than a targeted or novel intrusion.
The author also notes that traffic in this case originated from an IP block associated with 'PPTECHNOLOGY LIMITED,' a now-dissolved UK shell company previously referenced in third-party research (e.g., Team Cymru's 'Jingle Shells' reporting) as an administrative front for anonymous/bulletproof-style hosting infrastructure. No specific CVEs, malware families, or novel exploitation techniques are disclosed; this is an informational piece on honeypot data analysis tradecraft and typical opportunistic brute-force activity against exposed SSH/Telnet services.
Detection guidance
Multiple Failed SSH/Telnet Authentication Attempts
Detects multiple failed login attempts over SSH (port 22) or Telnet (port 23) within a short time window, consistent with credential brute-force attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Multiple Failed SSH/Telnet Authentication Attempts
description: Detects multiple failed authentication attempts on SSH (port 22) or Telnet
(port 23) ports, characteristic of credential brute-force attacks captured in honeypot
telemetry.
tags:
- attack.credential-access
- attack.t1110
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /sshd
- /in.telnetd
CommandLine|contains:
- Failed password
- Invalid user
condition: selection
falsepositives:
- Legitimate users mistyping credentials multiple times
- Automated monitoring/scanning tools checking service availability
level: medium
id: e3f18ea7-e5c5-5b1e-b8bf-150d537ab041
status: experimental
author: Vorant
SSH/Telnet Session Reconnaissance Commands
Detects execution of system information discovery commands (uname, busybox, ls /usr/local/sbin) immediately following successful SSH/Telnet authentication, typical of post-compromise reconnaissance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSH/Telnet Session Reconnaissance Commands
description: Detects execution of system discovery commands (uname, busybox, directory
listing) within an SSH/Telnet session following authentication, consistent with
post-exploitation reconnaissance activity.
tags:
- attack.discovery
- attack.t1082
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /sshd
- /in.telnetd
Image|endswith:
- /uname
- /busybox
- /ls
CommandLine|contains:
- uname
- busybox
- /usr/local/sbin
condition: selection
falsepositives:
- Legitimate remote users running diagnostic commands
- System administration scripts performing inventory checks
level: medium
id: e61860e1-3d52-5ac4-9dd9-68e651f56a1d
status: experimental
author: Vorant
File Deletion via rm Command in SSH/Telnet Session
Detects execution of rm -rf commands within SSH/Telnet sessions to delete files or directories, typical anti-forensic cleanup behavior. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Deletion via rm Command in SSH/Telnet Session
description: Detects rm command execution with recursive/force flags within an SSH/Telnet
session, consistent with anti-forensic cleanup attempts by compromised accounts.
tags:
- attack.defense-evasion
- attack.t1070.004
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /sshd
- /in.telnetd
Image|endswith: /rm
CommandLine|contains: -rf
condition: selection
falsepositives:
- Legitimate system maintenance scripts removing temporary files
- Storage cleanup automation running over SSH
level: medium
id: 6bbdfbb8-fd13-5ad5-a474-0dfc78c3f775
status: experimental
author: Vorant
2 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33306
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free