Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)
This guest diary details the creation and use of ‘batch.py’, a Python script designed to analyze logs and data related to honeypot-Omaha, a decoy system set up by the Internet Storm Center. The script automates the process of gathering intelligence from various log sources (cowrie, zeek, etc.) and presenting it in a structured format, allowing analysts to quickly identify threat actors, their methods, and potential vulnerabilities. The script is built around a pipeline of phases, each designed to extract and correlate specific types of data, from usernames and passwords to exploited vulnerabilities and command-and-control activity. It emphasizes a ‘long tail’ analysis approach, focusing on persistent activity and attempts to cover tracks.
This guest diary by Frank Igbokwe, an ISC intern, outlines the development and functionality of ‘batch.py’, a Python script used to analyze data collected from honeypot-Omaha, a decoy system managed by the Internet Storm Center. The primary goal of ‘batch.py’ is to automate the process of threat intelligence gathering and analysis, streamlining the work of security analysts. It is built around a multi-phase pipeline designed to extract and correlate various types of data from sources like cowrie (a tool emulating secure shell and telnet), zeek (a network traffic analyzer), and other log sources.
“Honeypot-Omaha” is intentionally designed to attract threat actors, and ‘batch.py’ is used to dissect the data generated during these interactions. The script begins with a master password generation phase, utilizing SHA-256 hashing, to protect sensitive data. Authentication is implemented to prevent unauthorized access.
The script then proceeds through several phases, each focusing on a specific aspect of threat analysis. Phase 1 gathers and converts data into a tab-separated value (TSV) format, incorporating intelligence from sources like ip-api.com, cve.org, and paloaltonetworks.com. Subsequent phases identify top internet addresses, usernames, passwords, and exploited vulnerabilities, presenting them in a structured format.
Key features include a ‘long tail’ analysis approach, emphasizing persistent activity and attempts to cover tracks by threat actors. The script identifies commands executed by threat actors, such as exporting system administration tools (e.g., ‘usr/local/sbin’) and attempting to delete evidence (e.g., using ‘rm -rf filter’). The diary details how ‘batch.py’ tracks session IDs, login attempts, and command execution, providing a comprehensive view of threat actor activity.
The script utilizes a ‘less’ program to display large amounts of data in a manageable way, and incorporates sorting functionality to facilitate analysis. The diary highlights the importance of identifying patterns and anomalies in the data, such as repeated login attempts, changes in passwords, and attempts to establish persistent connections. The script is designed to be a valuable tool for security analysts seeking to understand the tactics and techniques employed by threat actors targeting honeypot systems.