Binary Breadcrumbs: Correlating Malware Samples with Honeypot Logs Using PowerShell [Guest Diary], (Wed, Nov 5th)

A SANS ISC guest diary describes a practical method for reviewing Cowrie honeypot JSON logs on a restricted Windows laptop using PowerShell. It walks through a compact script that builds an array of malware hashes, recursively reads log files, and leverages Select-String and nested loops to locate matches, illustrating core techniques for traversing files, retrieving and searching text, and quickly extracting useful signals without installing additional tools.