Honeypot-Omaha Deploys Cowrie to Capture Threat Actor Tactics
The SANS Internet Storm Center's Honeypot-Omaha sensor uses the Cowrie tool to emulate SSH and Telnet, attracting and logging detailed threat actor activities for analysis.
The Internet Storm Center (ISC) is employing a decoy system known as Honeypot-Omaha, a DShield Sensor designed to lure and record the actions of malicious actors. This intentionally vulnerable system serves as a critical data aggregator, capturing valuable intelligence that security analysts can use to understand emerging threats.
Honeypot-Omaha utilizes a suite of tools, prominently featuring Cowrie, an open-source tool that emulates SSH (port 22) and Telnet (port 23) services. By presenting these common entry points to the public internet, Cowrie effectively acts as a digital trap, waiting to log any interaction from threat actors. This allows researchers to observe automated activities such as brute-force attacks, credential scraping, and data gathering attempts, which are increasingly prevalent due to advancements in automation tools.
When a threat actor attempts to compromise the Honeypot-Omaha sensor, Cowrie meticulously records their every move. This includes identifying the methods used for access, the specific vulnerabilities exploited, the success or failure of their attempts, and the commands executed. This granular data enables analysts to construct a precise timeline of malicious activity, from its inception to its conclusion.
Correlating the vast amounts of data generated by such a honeypot is a significant challenge. Honeypot-Omaha collects logs from various sources, including web servers, firewalls, and Cowrie itself. To make sense of this information, analysts often turn to tools like Zeek for network traffic analysis and behavior correlation, and tcpdump for packet-level inspection. However, the need for a consolidated, efficient analysis tool led to the development of custom scripts.
To streamline the analysis process, ISC intern Frank Igbokwe developed a Python script named 'batch.py'. This script is designed to consolidate logs from different sources, filter relevant data, and answer specific analytical questions. It aims to synthesize diverse data points into a focused, comprehensive view, enabling analysts to efficiently gather threat intelligence, identify common vulnerabilities (CVEs), map to MITRE ATT&CK tactics, and assess threat scores.
The 'batch.py' script operates in four integrated phases, processing raw logs typically stored in the same directory. Before analysis, it incorporates authentication mechanisms, including master password and guest passcode generation using SHA-256, to ensure data security and adhere to the principle of least privilege. This ensures that only authorized personnel can access and analyze the sensitive threat intelligence gathered.
After successful authentication, the script proceeds through its analytical pipeline. While the specifics of each phase are detailed in the full guest diary, the overall goal is to transform raw log data into actionable intelligence. This includes recursively querying APIs for information related to specific IP addresses or domain names, converting data into a usable format like TSV, and correlating findings with threat intelligence databases.
The Honeypot-Omaha project, coupled with the 'batch.py' analysis script, represents a proactive approach to cybersecurity research. By actively attracting and meticulously analyzing threat actor behavior, the ISC gains invaluable insights into the evolving tactics, techniques, and procedures (TTPs) used by adversaries, ultimately contributing to a stronger collective defense.