Cowrie Logs Report Suspicious Echo Command

TL;DR

A suspicious echo command was discovered in Cowrie logs. The activity indicates potential malicious intent with an Iranian bot possibly involved.

What happened

['Echo command found', 'Cowrie logs analyzed']

Why it matters for ops

['Identify and respond to suspicious activities', 'Monitor for signs of intrusion attempts']

Mitigation

• Enhance monitoring of Cowrie logs
• Review and update firewall rules to block suspicious IPs

Action items

• Analyze incident reports from DShield sensors
• Investigate related activity in webhoneypot and iptables logs

Detection IOCs

• 64.89.161.198
• MAGIC_PAYLOAD_KILLER_HERE_OR_LEAVE_EMPTY_iranbot_was_here

Source link

https://isc.sans.edu/diary/rss/32810