I built a honeypot project over the weekend and loved every second of it.
After seeing some videos from Josh Madakor, I had planned on building a honeypot project that opens up an unsecure VM in Azure infrastructure to the internet and connects logs to Sentinel, enriches them and finally maps failed logon attempts on a global map.
The video from Josh was immensely helpful but it was also a year old at this point and a lot has changed. Some notable portions where I was able to leave my own mark on this project (instead of blindly following a video tutorial) was picking the version of Windows for my VM. I was not able to use Win 10 Pro but decided to use Win 10 Enterprise instead.
I didn't want to use a Linux distro as I thought it might not accumulate attacks quickly enough. The Windows version I picked also didn't record failed logons by default so I had to do a little bit of troubleshooting to turn on log on and off Audit successes and failures.
Currently, I used a watchlist provided by Josh Madakor in his YouTube video to enrich the attack IPs with geodata but future plans include using APIs from a place like AbuseIPDB perhaps.
My VM was open roughly an hour and it was attacked close to 4000 times, which was mind blowing! I am sure most of these attacks were using software, based on the interval in between the attacks, multiple attacks being under 1 min time.
I also changed some color palettes in my final map to showcase all attacks in red, as the default color scheme used green and I didn't want to portray anything as a good/positive event - although the attacks were not successful.
Link to my project: https://lnkd.in/gMeQBAQc
Massive props to Josh for putting out such high quality content for free. If someone made it to my GitHub and read my project, you are a true MVP.
#SOCAnalyst #Honeypot #AzureSentinel #BlueTeam
That's honestly INCREDIBLE