# SANS Diary Details Cowrie Honeypot Brute-Force Analysis Tool

Published: 2026-09-03 · Severity: routine
Canonical: https://vorant.io/reports/49c905bf-5da3-5419-a044-1fae05547ac7/sans-diary-details-cowrie-honeypot-brute-force-analysis-tool

> A SANS ISC guest diary describes a custom Python tool (batch.py) used to analyze SSH/Telnet brute-force attacks captured by the Cowrie honeypot on DShield Sensor Honeypot-Omaha.

This SANS Internet Storm Center guest diary, authored by a SANS.edu BACS intern, is primarily a methodology write-up rather than a new threat disclosure. It describes 'batch.py', a Python script built to consolidate and correlate logs from a DShield honeypot sensor (Honeypot-Omaha) running Cowrie, which emulates SSH (22) and Telnet (23) services to attract automated credential-based attacks. The tool ingests JSON/log/gzip data, queries ip-api.com, cve.org, and paloaltonetworks.com APIs, and produces TSV reports, pie charts, and menu-driven summaries of top attacking IPs, usernames, passwords, protocols, and exploit/threat-rating correlations.

The diary walks through a representative attack session captured by the honeypot: a threat actor made 28 connection attempts using guessed/brute-forced credentials, successfully authenticated multiple times, ran reconnaissance commands (uname, busybox, listing /usr/local/sbin), and attempted anti-forensic cleanup via 'rm -rf filter' before disconnecting and reconnecting repeatedly. The author frames this behavior using a Reconnaissance-Initial Exploitation-Persistence/Privilege Escalation-Lateral Movement-Exfiltration (RIPLE) model. The observed activity is consistent with routine automated SSH/Telnet credential-stuffing/brute-force bots rather than a targeted or novel intrusion.

The author also notes that traffic in this case originated from an IP block associated with 'PPTECHNOLOGY LIMITED,' a now-dissolved UK shell company previously referenced in third-party research (e.g., Team Cymru's 'Jingle Shells' reporting) as an administrative front for anonymous/bulletproof-style hosting infrastructure. No specific CVEs, malware families, or novel exploitation techniques are disclosed; this is an informational piece on honeypot data analysis tradecraft and typical opportunistic brute-force activity against exposed SSH/Telnet services.

## Detection guidance (public sample)

### Multiple Failed SSH/Telnet Authentication Attempts

ATT&CK: T1110

Detects multiple failed login attempts over SSH (port 22) or Telnet (port 23) within a short time window, consistent with credential brute-force attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Multiple Failed SSH/Telnet Authentication Attempts
description: Detects multiple failed authentication attempts on SSH (port 22) or Telnet
  (port 23) ports, characteristic of credential brute-force attacks captured in honeypot
  telemetry.
tags:
- attack.credential-access
- attack.t1110
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
    - /sshd
    - /in.telnetd
    CommandLine|contains:
    - Failed password
    - Invalid user
  condition: selection
falsepositives:
- Legitimate users mistyping credentials multiple times
- Automated monitoring/scanning tools checking service availability
level: medium
id: e3f18ea7-e5c5-5b1e-b8bf-150d537ab041
status: experimental
author: Vorant
```

### SSH/Telnet Session Reconnaissance Commands

ATT&CK: T1082

Detects execution of system information discovery commands (uname, busybox, ls /usr/local/sbin) immediately following successful SSH/Telnet authentication, typical of post-compromise reconnaissance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SSH/Telnet Session Reconnaissance Commands
description: Detects execution of system discovery commands (uname, busybox, directory
  listing) within an SSH/Telnet session following authentication, consistent with
  post-exploitation reconnaissance activity.
tags:
- attack.discovery
- attack.t1082
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /sshd
    - /in.telnetd
    Image|endswith:
    - /uname
    - /busybox
    - /ls
    CommandLine|contains:
    - uname
    - busybox
    - /usr/local/sbin
  condition: selection
falsepositives:
- Legitimate remote users running diagnostic commands
- System administration scripts performing inventory checks
level: medium
id: e61860e1-3d52-5ac4-9dd9-68e651f56a1d
status: experimental
author: Vorant
```

### File Deletion via rm Command in SSH/Telnet Session

ATT&CK: T1070.004

Detects execution of rm -rf commands within SSH/Telnet sessions to delete files or directories, typical anti-forensic cleanup behavior. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: File Deletion via rm Command in SSH/Telnet Session
description: Detects rm command execution with recursive/force flags within an SSH/Telnet
  session, consistent with anti-forensic cleanup attempts by compromised accounts.
tags:
- attack.defense-evasion
- attack.t1070.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /sshd
    - /in.telnetd
    Image|endswith: /rm
    CommandLine|contains: -rf
  condition: selection
falsepositives:
- Legitimate system maintenance scripts removing temporary files
- Storage cleanup automation running over SSH
level: medium
id: 6bbdfbb8-fd13-5ad5-a474-0dfc78c3f775
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Source reporting: https://isc.sans.edu/diary/rss/33306

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/49c905bf-5da3-5419-a044-1fae05547ac7/sans-diary-details-cowrie-honeypot-brute-force-analysis-tool.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup