| Protocol | Sensor | Events | Unique IPs | Max level |
|---|---|---|---|---|
| ssh | cowrie | 29785 | 133 | 12 |
| mysql | dionaea | 4877 | 58 | 8 |
| http | webtrap | 1507 | 113 | 10 |
| smb | dionaea | 608 | 38 | 8 |
| mssql | dionaea | 70 | 37 | 7 |
| ftp | dionaea | 67 | 42 | 9 |
| unknown | dionaea | 6 | 0 | 10 |
| Rule | Description | Level | MITRE | Hits |
|---|---|---|---|---|
| 100106 | SSH tunneling attempt | 12 | T1572 | 179 |
| 100150 | Honeypot breach — weak credential accepted | 10 | T1078 | 2905 |
| 100104 | Suspicious network command (wget/curl/nc) | 10 | T1105 | 602 |
| 100305 | Web exploit / traversal attempt | 10 | T1190 | 511 |
| 100208 | Known Windows exploit attempt | 10 | T1210 | 6 |
| 100211 | FTP file transfer on honeypot | 9 | T1105 | 1 |
| 100103 | Command executed in session | 8 | T1059 | 7526 |
| 100210 | Aggressive scanning (>=10 conns / 120s) | 8 | T1046 | 82 |
| 100306 | Aggressive web scanning (many requests / 60s) | 8 | T1595 | 10 |
| 100107 | Brute-force attack (>=5 fails / 60s) | 8 | T1110 | 3 |
| 100217 | FTP brute-force attack (>=5 logins / 60s) | 8 | T1110 | 1 |
| 100209 | MSSQL database service scan | 7 | T1046 | 4896 |
| 100102 | Honeypot session established | 7 | T1078 | 3097 |
| 100304 | Automated scanner / attack tool detected | 7 | T1595 | 89 |
| 100111 | Login attempt with default account | 7 | T1078 | 49 |
| 100303 | Credentials submitted to decoy login | 7 | T1110 | 4 |
| 100112 | SSH client detected (possible scan) | 6 | T1046 | 3015 |
| 100302 | Sensitive path / admin panel probed | 6 | T1595 | 372 |
| 100206 | Inbound FTP connection | 6 | T1046 | 53 |
| 100216 | FTP credential captured | 6 | T1110 | 8 |
| 100108 | Password captured on failed login | 6 | T1110 | 3 |
| 100201 | Inbound SMB connection (probe) | 5 | T1046 | 577 |
| 100301 | HTTP request to decoy web server | 3 | T1595 | 521 |
| IP | Country | Org | Events | Abuse |
|---|---|---|---|---|
| 45.153.34.165 | The Netherlands | VMHeaven.io | 6084 | |
| 45.156.87.34 | The Netherlands | VMHeaven.io | 6078 | |
| 213.209.159.115 | Germany | Feo Prest SRL | 4436 | |
| 91.92.42.52 | The Netherlands | 4004 | ||
| 195.178.110.227 | Andorra | Techoff SRV Limited | 2075 | |
| 2.57.122.150 | The Netherlands | Techoff SRV Limited | 1765 | |
| 92.118.39.49 | United States | Pptechnology Limited | 1675 | |
| 80.94.92.55 | The Netherlands | Techoff SRV Limited | 1231 | |
| 195.178.110.217 | Andorra | Techoff SRV Limited | 1197 | |
| 45.148.10.18 | The Netherlands | Techoff SRV Limited | 1106 |
| Username | Password | Attempts |
|---|---|---|
| admin | admin | 57 |
| user | 1234 | 42 |
| root | 12345 | 18 |
| root | 1234 | 17 |
| root | 123456 | 17 |
| root | admin | 17 |
| root | password | 17 |
| root | 12345678 | 15 |
| root | 111111 | 14 |
| root | 123123 | 14 |
| Command | Count |
|---|---|
| uname -s -v -n -r -m | 2017 |
| uname -s -v -n -m 2 > /dev/null | 602 |
| head -1 /proc/version | cut -d -f1 ) | 602 |
| export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" | 602 |
| busybox uname -s -v -n -m 2 > /dev/null | 602 |
| [ -f /proc/version ] | 602 |
| [ -f /etc/os-release ] | 602 |
| /usr/bin/uname -s -v -n -m 2 > /dev/null | 602 |
| /bin/uname -s -v -n -m 2 > /dev/null | 602 |
| ( [ -f /proc/version ] | 602 |