SANS Diary Details Cowrie Honeypot Brute-Force Analysis Tool
A SANS ISC guest diary describes a custom Python tool (batch.py) used to analyze SSH/Telnet brute-force attacks captured by the Cowrie honeypot on DShield Sensor Honeypot-Omaha.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This SANS Internet Storm Center guest diary, authored by a SANS.edu BACS intern, is primarily a methodology write-up rather than a new threat disclosure. It describes 'batch.py', a Python script built to consolidate and correlate logs from a DShield honeypot sensor (Honeypot-Omaha) running Cowrie, which emulates SSH (22) and Telnet (23) services to attract automated credential-based attacks. The tool ingests JSON/log/gzip data, queries ip-api.com, cve.org, and paloaltonetworks.com APIs, and produces TSV reports, pie charts, and menu-driven summaries of top attacking IPs, usernames, passwords, protocols, and exploit/threat-rating correlations.
The diary walks through a representative attack session captured by the honeypot: a threat actor made 28 connection attempts using guessed/brute-forced credentials, successfully authenticated multiple times, ran reconnaissance commands (uname, busybox, listing /usr/local/sbin), and attempted anti-forensic cleanup via 'rm -rf filter' before disconnecting and reconnecting repeatedly. The author frames this behavior using a Reconnaissance-Initial Exploitation-Persistence/Privilege Escalation-Lateral Movement-Exfiltration (RIPLE) model. The observed activity is consistent with routine automated SSH/Telnet credential-stuffing/brute-force bots rather than a targeted or novel intrusion.
The author also notes that traffic in this case originated from an IP block associated with 'PPTECHNOLOGY LIMITED,' a now-dissolved UK shell company previously referenced in third-party research (e.g., Team Cymru's 'Jingle Shells' reporting) as an administrative front for anonymous/bulletproof-style hosting infrastructure. No specific CVEs, malware families, or novel exploitation techniques are disclosed; this is an informational piece on honeypot data analysis tradecraft and typical opportunistic brute-force activity against exposed SSH/Telnet services.
Detection guidance
Multiple Failed SSH/Telnet Authentication Attempts
A behavioural hunt for the technique in general.
Detects multiple failed login attempts over SSH (port 22) or Telnet (port 23) within a short time window, consistent with credential brute-force attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Multiple Failed SSH/Telnet Authentication Attempts
description: Detects multiple failed authentication attempts on SSH (port 22) or Telnet
(port 23) ports, characteristic of credential brute-force attacks captured in honeypot
telemetry.
tags:
- attack.credential-access
- attack.t1110
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /sshd
- /in.telnetd
CommandLine|contains:
- Failed password
- Invalid user
condition: selection
falsepositives:
- Legitimate users mistyping credentials multiple times
- Automated monitoring/scanning tools checking service availability
level: medium
id: e3f18ea7-e5c5-5b1e-b8bf-150d537ab041
status: experimental
author: Vorant
SSH/Telnet Session Reconnaissance Commands
A behavioural hunt for the technique in general.
Detects execution of system information discovery commands (uname, busybox, ls /usr/local/sbin) immediately following successful SSH/Telnet authentication, typical of post-compromise reconnaissance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSH/Telnet Session Reconnaissance Commands
description: Detects execution of system discovery commands (uname, busybox, directory
listing) within an SSH/Telnet session following authentication, consistent with
post-exploitation reconnaissance activity.
tags:
- attack.discovery
- attack.t1082
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /sshd
- /in.telnetd
Image|endswith:
- /uname
- /busybox
- /ls
CommandLine|contains:
- uname
- busybox
- /usr/local/sbin
condition: selection
falsepositives:
- Legitimate remote users running diagnostic commands
- System administration scripts performing inventory checks
level: medium
id: e61860e1-3d52-5ac4-9dd9-68e651f56a1d
status: experimental
author: Vorant
File Deletion via rm Command in SSH/Telnet Session
A behavioural hunt for the technique in general.
Detects execution of rm -rf commands within SSH/Telnet sessions to delete files or directories, typical anti-forensic cleanup behavior. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Deletion via rm Command in SSH/Telnet Session
description: Detects rm command execution with recursive/force flags within an SSH/Telnet
session, consistent with anti-forensic cleanup attempts by compromised accounts.
tags:
- attack.stealth
- attack.t1070.004
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /sshd
- /in.telnetd
Image|endswith: /rm
CommandLine|contains: -rf
condition: selection
falsepositives:
- Legitimate system maintenance scripts removing temporary files
- Storage cleanup automation running over SSH
level: medium
id: 6bbdfbb8-fd13-5ad5-a474-0dfc78c3f775
status: experimental
author: Vorant
2 more detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33306
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs