SentinelBrief
← Alert queue

125.82.67.84

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 97%Escalate: yes

Reasoning

A successful SSH login occurred using root/246801, which establishes a foothold and meets severity 4 by rubric. Session telemetry and command retrieval show no post-login commands, downloads, uploads, or persistence activity, so there is no evidence to raise this to malware delivery or persistence attempt. The very short session suggests opportunistic automation rather than deeper hands-on activity, but the successful authentication alone makes this a successful intrusion.

Recommended action

Escalate and review the exposed credential path; block or monitor the source IP, verify no real systems accept this credential, and hunt for similar successful logins across sensors.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,640
Output tokens
286
Cost
$0.006317
Latency
6,212 ms
Verdict at
2026-10-19 14:00:29Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "dd55b0a42595"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "dd55b0a42595",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "125.82.67.84",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 125.82.67.84:22650 (172.18.0.2:2222) [session: dd55b0a42595]",
      "outfile": null,
      "session": "dd55b0a42595",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 22650,
      "username": null,
      "timestamp": "2026-10-19T14:00:27.617864Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "125.82.67.84",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-Go",
      "outfile": null,
      "session": "dd55b0a42595",
      "version": "SSH-2.0-Go",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 22650,
      "username": null,
      "timestamp": "2026-10-19T14:00:27.618190Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr",
        "aes128-gcm@openssh.com",
        "chacha20-poly1305@openssh.com",
        "arcfour256",
        "arcfour128",
        "arcfour",
        "aes128-cbc",
        "3des-cbc",
        "aes128-gcm@openssh.com",
        "aes128-cbc"
      ],
      "hassh": "01ca35584ad5a1b66cf6a9846b5b2821",
      "input": null,
      "macCS": [
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-256",
        "hmac-sha1",
        "hmac-sha1-96"
      ],
      "compCS": [
        "none"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "125.82.67.84",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "curve25519-sha256@libssh.org",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group14-sha1"
      ],
      "keyAlgs": [
        "ssh-rsa-cert-v01@openssh.com",
        "ssh-dss-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "ssh-ed25519-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "ssh-rsa",
        "ssh-dss",
        "ssh-ed25519"
      ],
      "message": "SSH client hassh fingerprint: 01ca35584ad5a1b66cf6a9846b5b2821",
      "outfile": null,
      "session": "dd55b0a42595",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 22650,
      "username": null,
      "timestamp": "2026-10-19T14:00:27.852874Z",
      "duration_ms": null,
      "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-gcm@openssh.com,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "125.82.67.84",
      "eventid": "cowrie.login.success",
      "message": "login attempt [root/246801] succeeded",
      "outfile": null,
      "session": "dd55b0a42595",
      "version": null,
      "dst_port": 2222,
      "password": "246801",
      "protocol": "ssh",
      "src_port": 22650,
      "username": "root",
      "timestamp": "2026-10-19T14:00:28.557072Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "125.82.67.84",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 1643 milliseconds",
      "outfile": null,
      "session": "dd55b0a42595",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 22650,
      "username": null,
      "timestamp": "2026-10-19T14:00:29.261092Z",
      "duration_ms": 1643
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "125.82.67.84",
  "session_id": "dd55b0a42595"
}