cscli scenarios install thespad/sshesame-honeypotScenarios for sshesame honeypot logs.
1# sshesame bruteforce2type: leaky3name: thespad/sshesame-bf4description: "Detect sshesame bruteforce"5filter: "evt.Meta.log_type == 'sshesame_login'"6leakspeed: "30m"7capacity: 38groupby: evt.Meta.source_ip9blackhole: 1m10labels:11 service: sshesame12 confidence: 313 spoofable: 014 classification:15 - attack.T111016 behavior: "ssh:bruteforce"17 label: "SSHesame Bruteforce"18 remediation: true19---20# sshesame commands21type: trigger22name: thespad/sshesame-cmd23description: "Detect sshesame commands"24filter: "evt.Meta.log_type == 'sshesame_cmd'"25groupby: evt.Meta.source_ip26blackhole: 1m27labels:28 service: sshesame29 type: command30 behavior: "ssh:bruteforce"31 classification:32 - attack.T105933 spoofable: 034 confidence: 335 remediation: true36---37# sshesame input38type: leaky39name: thespad/sshesame-input40description: "Detect sshesame input spam"41filter: "evt.Meta.log_type == 'sshesame_input'"42leakspeed: "5m"43capacity: 544groupby: evt.Meta.source_ip45blackhole: 1m46labels:47 service: sshesame48 behavior: "ssh:bruteforce"49 spoofable: 050 confidence: 351 classification:52 - attack.T105953 remediation: true54