Analysis of a Year of Files Uploaded to DShield Sensors, (Wed, May 27th)
ID: 48917edc-e50f-50a1-9c1a-5b8aa95933af
STIX ID: report--48917edc-e50f-50a1-9c1a-5b8aa95933af
Feed Name: SANS ISC Diary
This note documents ES|QL queries and supporting scripts for summarizing file uploads to Cowrie honeypots feeding DShield sensors, showing observed file types (ELF, shell, PowerShell, HTML, text, unknown, DOS batch, JavaScript) and monthly activity trends over the past year; it is an operational telemetry/methodology write-up rather than an incident report.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.