SentinelBrief
← Alert queue

149.233.152.179

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 97%Escalate: yes

Reasoning

A successful SSH login occurred using default Raspberry Pi credentials (pi/raspberry), which establishes a foothold and meets severity 4 by rubric. Tool output confirms no post-login commands or payload transfer before the session ended, so there is no evidence for malware delivery or persistence. This is more than brute force because authentication succeeded, but attacker activity appears limited to initial access only.

Recommended action

Escalate as a confirmed honeypot compromise, retain session artifacts, and monitor for repeat attempts from this source or reuse of the same credentials pattern.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,705
Output tokens
275
Cost
$0.006201
Latency
7,485 ms
Verdict at
2026-11-03 22:56:44Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "3c1e51754d5c"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "3c1e51754d5c",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "149.233.152.179",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 149.233.152.179:64122 (172.18.0.2:2222) [session: 3c1e51754d5c]",
      "outfile": null,
      "session": "3c1e51754d5c",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 64122,
      "username": null,
      "timestamp": "2026-11-03T22:56:42.453997Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "149.233.152.179",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3",
      "outfile": null,
      "session": "3c1e51754d5c",
      "version": "SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 64122,
      "username": null,
      "timestamp": "2026-11-03T22:56:42.454332Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "chacha20-poly1305@openssh.com",
        "aes128-ctr",
        "aes192-ctr",
        "aes256-ctr",
        "aes128-gcm@openssh.com",
        "aes256-gcm@openssh.com"
      ],
      "hassh": "c11b200866cf918393e62ea25d851d90",
      "input": null,
      "macCS": [
        "umac-64-etm@openssh.com",
        "umac-128-etm@openssh.com",
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-512-etm@openssh.com",
        "hmac-sha1-etm@openssh.com",
        "umac-64@openssh.com",
        "umac-128@openssh.com",
        "hmac-sha2-256",
        "hmac-sha2-512",
        "hmac-sha1"
      ],
      "compCS": [
        "none",
        "zlib@openssh.com",
        "zlib"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "149.233.152.179",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "curve25519-sha256",
        "curve25519-sha256@libssh.org",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group-exchange-sha256",
        "diffie-hellman-group16-sha512",
        "diffie-hellman-group18-sha512",
        "diffie-hellman-group14-sha256",
        "ext-info-c",
        "kex-strict-c-v00@openssh.com"
      ],
      "keyAlgs": [
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ssh-ed25519-cert-v01@openssh.com",
        "sk-ssh-ed25519-cert-v01@openssh.com",
        "rsa-sha2-512-cert-v01@openssh.com",
        "rsa-sha2-256-cert-v01@openssh.com",
        "ssh-rsa-cert-v01@openssh.com",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "sk-ecdsa-sha2-nistp256@openssh.com",
        "ssh-ed25519",
        "sk-ssh-ed25519@openssh.com",
        "rsa-sha2-512",
        "rsa-sha2-256",
        "ssh-rsa"
      ],
      "message": "SSH client hassh fingerprint: c11b200866cf918393e62ea25d851d90",
      "outfile": null,
      "session": "3c1e51754d5c",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 64122,
      "username": null,
      "timestamp": "2026-11-03T22:56:42.548855Z",
      "duration_ms": null,
      "hasshAlgorithms": "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "149.233.152.179",
      "eventid": "cowrie.login.success",
      "message": "login attempt [pi/raspberry] succeeded",
      "outfile": null,
      "session": "3c1e51754d5c",
      "version": null,
      "dst_port": 2222,
      "password": "raspberry",
      "protocol": "ssh",
      "src_port": 64122,
      "username": "pi",
      "timestamp": "2026-11-03T22:56:43.024231Z",
      "duration_ms": null
    },
    {
      "url": null,
      "name": "LANG",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "value": "de_CH.UTF-8",
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "149.233.152.179",
      "eventid": "cowrie.client.var",
      "message": "request_env: LANG=de_CH.UTF-8",
      "outfile": null,
      "session": "3c1e51754d5c",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 64122,
      "username": null,
      "timestamp": "2026-11-03T22:56:43.381185Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "149.233.152.179",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 1203 milliseconds",
      "outfile": null,
      "session": "3c1e51754d5c",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 64122,
      "username": null,
      "timestamp": "2026-11-03T22:56:43.656955Z",
      "duration_ms": 1203
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "149.233.152.179",
  "session_id": "3c1e51754d5c"
}