Adventures of an RDP Honeypot – Part Three: Creation of…

This blog post describes building and operating a free RDP honeypot using VirtualBox and a Microsoft evaluation Windows VM, including system configuration and lures, enabling Sysmon and PowerShell logging, forwarding logs to Humio, capturing network traffic with Zeek, and lessons learned (password visibility gaps, failed desktop recording, and network address correlation). The author provides a tl;dr step list to reproduce the environment and plans improvements for future iterations.