SentinelBrief
← Alert queue

125.82.67.84

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 98%Escalate: yes

Reasoning

The session shows a confirmed successful SSH login using root/chaumont. Per rubric, any successful login constitutes a foothold and maps to successful_intrusion with severity 4, even though no post-login commands, downloads, or uploads were observed before the session ended. The very short duration and zero commands suggest an incomplete or aborted intrusion rather than active compromise behavior.

Recommended action

Treat as a confirmed honeypot foothold: retain session artifacts, block or monitor the source IP, review for related attempts using the same credential, and watch for follow-on sessions with commands or payload delivery.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,657
Output tokens
284
Cost
$0.006276
Latency
6,032 ms
Verdict at
2026-10-19 14:09:29Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "dd0c7a04f80a"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "dd0c7a04f80a",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "125.82.67.84",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 125.82.67.84:53668 (172.18.0.2:2222) [session: dd0c7a04f80a]",
      "outfile": null,
      "session": "dd0c7a04f80a",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 53668,
      "username": null,
      "timestamp": "2026-10-19T14:09:26.033583Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "125.82.67.84",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-Go",
      "outfile": null,
      "session": "dd0c7a04f80a",
      "version": "SSH-2.0-Go",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 53668,
      "username": null,
      "timestamp": "2026-10-19T14:09:26.033883Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr",
        "aes128-gcm@openssh.com",
        "chacha20-poly1305@openssh.com",
        "arcfour256",
        "arcfour128",
        "arcfour",
        "aes128-cbc",
        "3des-cbc",
        "aes128-gcm@openssh.com",
        "aes128-cbc"
      ],
      "hassh": "01ca35584ad5a1b66cf6a9846b5b2821",
      "input": null,
      "macCS": [
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-256",
        "hmac-sha1",
        "hmac-sha1-96"
      ],
      "compCS": [
        "none"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "125.82.67.84",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "curve25519-sha256@libssh.org",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group14-sha1"
      ],
      "keyAlgs": [
        "ssh-rsa-cert-v01@openssh.com",
        "ssh-dss-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "ssh-ed25519-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "ssh-rsa",
        "ssh-dss",
        "ssh-ed25519"
      ],
      "message": "SSH client hassh fingerprint: 01ca35584ad5a1b66cf6a9846b5b2821",
      "outfile": null,
      "session": "dd0c7a04f80a",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 53668,
      "username": null,
      "timestamp": "2026-10-19T14:09:26.271203Z",
      "duration_ms": null,
      "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-gcm@openssh.com,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "125.82.67.84",
      "eventid": "cowrie.login.success",
      "message": "login attempt [root/chaumont] succeeded",
      "outfile": null,
      "session": "dd0c7a04f80a",
      "version": null,
      "dst_port": 2222,
      "password": "chaumont",
      "protocol": "ssh",
      "src_port": 53668,
      "username": "root",
      "timestamp": "2026-10-19T14:09:27.608185Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "125.82.67.84",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 2884 milliseconds",
      "outfile": null,
      "session": "dd0c7a04f80a",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 53668,
      "username": null,
      "timestamp": "2026-10-19T14:09:28.917479Z",
      "duration_ms": 2884
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "125.82.67.84",
  "session_id": "dd0c7a04f80a"
}