SANS diary uses Kibana to hunt odd HTTP charsets in honeypot logs
Original title: Looking for a Language [Guest Diary], (Wed, Oct 21st)
A DShield honeypot logged about 960,000 events in three weeks, and Accept-Charset GBK stood out on SonicWall login probes.
An ISC guest diary walks through using Elastic Kibana Discover and Field Statistics on a SANS DShield honeypot index named cowrie. In a little more than three weeks the Raspberry Pi honeypot produced about 960,000 logs across only four rules, of which 15,271 records triggered a rule. The author narrows to the SonicWall Appliance Login Page rule, covering 41 hosts, then uses long-tail field distributions to spot an Accept-Charset preference for GBK over utf-8.
Unconfirmed: The diary treats the GBK charset preference as a lead, not confirmed attacker attribution.
- About 960,000 logs fell under only four detection rules.
- Without filters, 15,271 records triggered a rule and 944,866 did not.
- The SonicWall login-page rule matched 41 hosts.
- The notable header preferred GBK, then utf-8, then a wildcard.
- Other rules covered the index page, Git config scraping, and Fortinet emulation.
- Organizations
- SANS Internet Storm Center
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | leheedu.cn | et as extracted with this ESQL Query: source.domain values: leheedu[.]cn mail.,brossy.com[.]cn mail.brossy.com[.]cn tzrhxln[.]cn A |
| domain | tzrhxln.cn | discovered an obviously automated campaign. Interestingly, tzrhxln[.]cn ( 165[.]154.29.93 ) is a suspect high entropy domain. Sim |
| ipv4 | 165.154.11.140 | ame Canadian based AS-7456: 165[.]154.36.91 165[.]154.29.93 165[.]154.11.140 165[.]154.120.226 165[.]154.33.72 165[.]154.182.221 Value |
| ipv4 | 165.154.120.226 | d AS-7456: 165[.]154.36.91 165[.]154.29.93 165[.]154.11.140 165[.]154.120.226 165[.]154.33.72 165[.]154.182.221 Values for http.request |
| ipv4 | 165.154.182.221 | 54.29.93 165[.]154.11.140 165[.]154.120.226 165[.]154.33.72 165[.]154.182.221 Values for http.request.body.content were all consistent |
| ipv4 | 165.154.29.93 | s all from the same Canadian based AS-7456: 165[.]154.36.91 165[.]154.29.93 165[.]154.11.140 165[.]154.120.226 165[.]154.33.72 165[.] |
| ipv4 | 165.154.33.72 | 54.36.91 165[.]154.29.93 165[.]154.11.140 165[.]154.120.226 165[.]154.33.72 165[.]154.182.221 Values for http.request.body.content we |
| ipv4 | 165.154.36.91 | set of endpoints all from the same Canadian based AS-7456: 165[.]154.36.91 165[.]154.29.93 165[.]154.11.140 165[.]154.120.226 165[.] |
From the original article
9 min read at isc.sans.edu
[This is a Guest Diary by Jeffray Spence, an ISC intern as part of the SANS. edu BACS program]
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.