SentinelBrief
← Alert queue

109.160.32.78

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 97%Escalate: yes

Reasoning

A successful SSH login occurred using credential deploy/user, which establishes a foothold and meets the threshold for successful_intrusion. Tooled command retrieval shows no post-login commands, downloads, or uploads, so there is no evidence of malware delivery or persistence activity. The short session with zero commands suggests either automated credential validation or an abandoned foothold rather than deeper hands-on activity.

Recommended action

Escalate as a confirmed honeypot compromise; block or monitor the source IP, review nearby sessions for reuse of the same credentials, and hunt for similar successful logins across sensors.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,630
Output tokens
283
Cost
$0.006204
Latency
4,377 ms
Verdict at
2026-09-22 00:16:02Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "740bf00066f1"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "740bf00066f1",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "109.160.32.78",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 109.160.32.78:51428 (172.18.0.2:2222) [session: 740bf00066f1]",
      "outfile": null,
      "session": "740bf00066f1",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 51428,
      "username": null,
      "timestamp": "2026-09-22T00:15:48.458636Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "109.160.32.78",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-Go",
      "outfile": null,
      "session": "740bf00066f1",
      "version": "SSH-2.0-Go",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 51428,
      "username": null,
      "timestamp": "2026-09-22T00:15:49.413358Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "aes128-gcm@openssh.com",
        "aes256-gcm@openssh.com",
        "chacha20-poly1305@openssh.com",
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr"
      ],
      "hassh": "0a07365cc01fa9fc82608ba4019af499",
      "input": null,
      "macCS": [
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-512-etm@openssh.com",
        "hmac-sha2-256",
        "hmac-sha2-512",
        "hmac-sha1",
        "hmac-sha1-96"
      ],
      "compCS": [
        "none"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "109.160.32.78",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "curve25519-sha256",
        "curve25519-sha256@libssh.org",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group14-sha256",
        "diffie-hellman-group14-sha1",
        "ext-info-c",
        "kex-strict-c-v00@openssh.com"
      ],
      "keyAlgs": [
        "rsa-sha2-256-cert-v01@openssh.com",
        "rsa-sha2-512-cert-v01@openssh.com",
        "ssh-rsa-cert-v01@openssh.com",
        "ssh-dss-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "ssh-ed25519-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "rsa-sha2-256",
        "rsa-sha2-512",
        "ssh-rsa",
        "ssh-dss",
        "ssh-ed25519"
      ],
      "message": "SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499",
      "outfile": null,
      "session": "740bf00066f1",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 51428,
      "username": null,
      "timestamp": "2026-09-22T00:15:49.413887Z",
      "duration_ms": null,
      "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "109.160.32.78",
      "eventid": "cowrie.login.success",
      "message": "login attempt [deploy/user] succeeded",
      "outfile": null,
      "session": "740bf00066f1",
      "version": null,
      "dst_port": 2222,
      "password": "user",
      "protocol": "ssh",
      "src_port": 51428,
      "username": "deploy",
      "timestamp": "2026-09-22T00:15:55.358325Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "109.160.32.78",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 13247 milliseconds",
      "outfile": null,
      "session": "740bf00066f1",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 51428,
      "username": null,
      "timestamp": "2026-09-22T00:16:01.705736Z",
      "duration_ms": 13247
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "109.160.32.78",
  "session_id": "740bf00066f1"
}