TTY Logs and the Data it Captures, (Sun, Oct 4th)
SANS diary correlates DShield honeypot TTY logs, finding one crontab pattern used by over 3,130 IPs.
32
Product
Cowrie
- Mentions · 7d0
- Mentions · 30d1
- All mentions3
- First seenSep 3, 2026
- Last mentioned26d ago
Timeline
3 articles · newest firstRedtail Payload Analysis [Guest Diary], (Wed, Sep 9th)
SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.
33
Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)
A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.
14
Appears with
- SANS Internet Storm Centerorganization · 2
- RedTailproduct · 1
- Zeekproduct · 1
- DShieldorganization · 1
- Proxmoxproduct · 1
- DShieldproduct · 1
- INetSimproduct · 1
- RedTailmalware · 1
- SANSorganization · 1
- tcpdumpproduct · 1
- batch.pyproduct · 1
- Elasticsearchproduct · 1
- SANSvendor · 1
- DShieldvendor · 1
- SANS Internet Storm Centervendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.