SentinelBrief
← Alert queue

151.243.18.193

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 98%Escalate: yes

Reasoning

A successful SSH login occurred using admin/admin, which establishes a foothold and meets the severity-4 rubric. Retrieved session commands show no post-login commands and no downloads/uploads, so there is no evidence of malware delivery, persistence, or further hands-on activity in this session. The very short duration suggests an automated login check rather than deeper interaction, but the compromise threshold was still crossed.

Recommended action

Treat as confirmed honeypot compromise attempt: retain session artifacts, block or rate-limit the source if appropriate, and monitor for repeat logins or follow-on sessions from this IP using the same credentials.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,620
Output tokens
257
Cost
$0.006249
Latency
7,531 ms
Verdict at
2026-11-07 21:16:45Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "273f717bd462"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "273f717bd462",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "151.243.18.193",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 151.243.18.193:53150 (172.18.0.2:2222) [session: 273f717bd462]",
      "outfile": null,
      "session": "273f717bd462",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 53150,
      "username": null,
      "timestamp": "2026-11-07T21:16:44.724900Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "151.243.18.193",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-Go",
      "outfile": null,
      "session": "273f717bd462",
      "version": "SSH-2.0-Go",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 53150,
      "username": null,
      "timestamp": "2026-11-07T21:16:44.725170Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "aes128-gcm@openssh.com",
        "aes256-gcm@openssh.com",
        "chacha20-poly1305@openssh.com",
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr"
      ],
      "hassh": "16443846184eafde36765c9bab2f4397",
      "input": null,
      "macCS": [
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-512-etm@openssh.com",
        "hmac-sha2-256",
        "hmac-sha2-512",
        "hmac-sha1",
        "hmac-sha1-96"
      ],
      "compCS": [
        "none"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "151.243.18.193",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "mlkem768x25519-sha256",
        "curve25519-sha256",
        "curve25519-sha256@libssh.org",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group14-sha256",
        "diffie-hellman-group14-sha1",
        "ext-info-c",
        "kex-strict-c-v00@openssh.com"
      ],
      "keyAlgs": [
        "rsa-sha2-256-cert-v01@openssh.com",
        "rsa-sha2-512-cert-v01@openssh.com",
        "ssh-rsa-cert-v01@openssh.com",
        "ssh-dss-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "ssh-ed25519-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "rsa-sha2-256",
        "rsa-sha2-512",
        "ssh-rsa",
        "ssh-dss",
        "ssh-ed25519"
      ],
      "message": "SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397",
      "outfile": null,
      "session": "273f717bd462",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 53150,
      "username": null,
      "timestamp": "2026-11-07T21:16:44.728409Z",
      "duration_ms": null,
      "hasshAlgorithms": "mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "151.243.18.193",
      "eventid": "cowrie.login.success",
      "message": "login attempt [admin/admin] succeeded",
      "outfile": null,
      "session": "273f717bd462",
      "version": null,
      "dst_port": 2222,
      "password": "admin",
      "protocol": "ssh",
      "src_port": 53150,
      "username": "admin",
      "timestamp": "2026-11-07T21:16:44.744188Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "151.243.18.193",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 25 milliseconds",
      "outfile": null,
      "session": "273f717bd462",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 53150,
      "username": null,
      "timestamp": "2026-11-07T21:16:44.749660Z",
      "duration_ms": 25
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "151.243.18.193",
  "session_id": "273f717bd462"
}