SentinelBrief
← Alert queue

106.12.120.171

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 98%Escalate: yes

Reasoning

The session shows a successful SSH login using root/debian, which constitutes a foothold on the honeypot and maps directly to severity 4. Post-login evidence shows no commands, downloads, or uploads before the session ended, so there is no indication of malware delivery, persistence, or broader compromise behavior. The very short duration suggests automated credential use rather than sustained hands-on activity, but the successful authentication is sufficient to classify this as a successful intrusion.

Recommended action

Escalate as a confirmed successful login; review surrounding sessions from this IP, preserve session artifacts, and ensure the exposed credential pattern is blocked or monitored.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,647
Output tokens
288
Cost
$0.006369
Latency
5,232 ms
Verdict at
2026-09-19 01:57:02Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "e83185d5dce3"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "e83185d5dce3",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "106.12.120.171",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 106.12.120.171:55176 (172.18.0.2:2222) [session: e83185d5dce3]",
      "outfile": null,
      "session": "e83185d5dce3",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 55176,
      "username": null,
      "timestamp": "2026-09-19T01:56:58.527421Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "106.12.120.171",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-Go",
      "outfile": null,
      "session": "e83185d5dce3",
      "version": "SSH-2.0-Go",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 55176,
      "username": null,
      "timestamp": "2026-09-19T01:56:58.527685Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "aes128-gcm@openssh.com",
        "chacha20-poly1305@openssh.com",
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr"
      ],
      "hassh": "98ddc5604ef6a1006a2b49a58759fbe6",
      "input": null,
      "macCS": [
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-256",
        "hmac-sha1",
        "hmac-sha1-96"
      ],
      "compCS": [
        "none"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "106.12.120.171",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "curve25519-sha256@libssh.org",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group14-sha1"
      ],
      "keyAlgs": [
        "rsa-sha2-512-cert-v01@openssh.com",
        "rsa-sha2-256-cert-v01@openssh.com",
        "ssh-rsa-cert-v01@openssh.com",
        "ssh-dss-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "ssh-ed25519-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "rsa-sha2-512",
        "rsa-sha2-256",
        "ssh-rsa",
        "ssh-dss",
        "ssh-ed25519"
      ],
      "message": "SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6",
      "outfile": null,
      "session": "e83185d5dce3",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 55176,
      "username": null,
      "timestamp": "2026-09-19T01:56:58.750713Z",
      "duration_ms": null,
      "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "106.12.120.171",
      "eventid": "cowrie.login.success",
      "message": "login attempt [root/debian] succeeded",
      "outfile": null,
      "session": "e83185d5dce3",
      "version": null,
      "dst_port": 2222,
      "password": "debian",
      "protocol": "ssh",
      "src_port": 55176,
      "username": "root",
      "timestamp": "2026-09-19T01:56:59.436020Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "106.12.120.171",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 2691 milliseconds",
      "outfile": null,
      "session": "e83185d5dce3",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 55176,
      "username": null,
      "timestamp": "2026-09-19T01:57:01.218698Z",
      "duration_ms": 2691
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "106.12.120.171",
  "session_id": "e83185d5dce3"
}