Cowrie Honeypot Interaction
Attack scenariogeneric:bruteforceMITRE T1110MITRE T1059.004
- By
- PumbaLP
- Version
- 0.1
- Name
- PumbaLP/cowrie-precision
- Remediation
- Ban
Detect repeated logins or shell commands from one source on a Cowrie honeypot (SSH/telnet)
Install with a top-level collection
1 collection include itsudo cscli collections install PumbaLP/cowrieInstalls 2 parsers and 4 scenarios.
View Cowrie Honeypot →Installation
sudo cscli scenarios install PumbaLP/cowrie-precisionThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
type: leakyname: PumbaLP/cowrie-precisiondescription: "Detect repeated logins or shell commands from one source on a Cowrie honeypot (SSH/telnet)"filter: |evt.Parsed.program == 'cowrie' &&evt.Meta.log_type in ['cowrie_login_success', 'cowrie_login_failed', 'ssh_failed-auth', 'cowrie_command_input', 'cowrie_command_failed']groupby: evt.Meta.source_ipcapacity: 2leakspeed: 5mblackhole: 1mlabels:service: cowrieconfidence: 3spoofable: 0classification:- attack.T1110- attack.T1059.004behavior: "generic:bruteforce"label: "Cowrie Honeypot Interaction"remediation: true
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
Cowrie Precision Detection
Detects a source that logs in to, or runs shell commands on, a Cowrie SSH/telnet honeypot.
Description
Cowrie is a honeypot: no legitimate user has a reason to connect to it. Instead of waiting for a long brute-force run, this scenario counts login attempts (successful or failed) and shell commands (cowrie.login.*, cowrie.command.*) per source IP. The bucket has a capacity of 2 and leaks one event every 5 minutes, so the scenario triggers on the third such event from the same IP within that window.
It relies on the PumbaLP/cowrie-json-logs parser.
Usage
To install the parser, this scenario and the related hub brute-force scenarios:
1cscli collections install PumbaLP/cowrie
Configuration
Point CrowdSec at Cowrie's JSON log in acquis.d/cowrie.yaml:
1filenames:2 - /opt/cowrie/var/log/cowrie/cowrie.json3labels:4 type: cowrie