tag: Honeypot · 3 items
- Engineer — Skip
- SOC/IR — Learn: The DShield honeypot TTY log parsing approach illustrates attacker command patterns post-login; useful context for tuning SSH session monitoring and understanding what commands adversaries run on compromised Linux hosts.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: Honeypot observations of unusual user agent strings can inform tuning of detection rules for scanning and reconnaissance activity, though no specific IOCs or TTPs are presented here.
- Leader — Skip
- Engineer — Learn: Honeypot diary entries occasionally surface new attacker tooling or techniques worth awareness, but the summary is too thin to determine engineering relevance; read if monitoring edge sensors or scripted attack patterns.
- SOC/IR — Learn: Honeypot telemetry can surface emerging TTPs or IOCs, but with no enrichment signals or extracted indicators provided here, there is no immediate detection action; worth reading for context on opportunistic attack patterns.
- Leader — Skip