SentinelBrief
← Alert queue

109.63.177.113

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 98%Escalate: yes

Reasoning

A successful SSH login occurred for user root using password authentication, which constitutes a foothold on the honeypot. Per the rubric, any successful login is at least severity 4 and falls under successful_intrusion unless there is evidence of malware delivery or persistence. Session command retrieval shows no post-login commands, downloads, or uploads before the session ended, so there is no basis to raise severity to 5.

Recommended action

Escalate for review, retain session artifacts, and block or monitor the source IP for follow-on activity; no malware or persistence actions were observed in this session.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,676
Output tokens
285
Cost
$0.006292
Latency
6,819 ms
Verdict at
2026-10-13 18:36:53Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "63c70163a39f"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "63c70163a39f",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "109.63.177.113",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 109.63.177.113:33308 (172.18.0.2:2222) [session: 63c70163a39f]",
      "outfile": null,
      "session": "63c70163a39f",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 33308,
      "username": null,
      "timestamp": "2026-10-13T18:36:49.955285Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "109.63.177.113",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-libssh2_1.11.1",
      "outfile": null,
      "session": "63c70163a39f",
      "version": "SSH-2.0-libssh2_1.11.1",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 33308,
      "username": null,
      "timestamp": "2026-10-13T18:36:49.955581Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "chacha20-poly1305@openssh.com",
        "aes256-ctr",
        "aes192-ctr",
        "aes128-ctr",
        "aes256-cbc",
        "rijndael-cbc@lysator.liu.se",
        "aes192-cbc",
        "aes128-cbc",
        "blowfish-cbc",
        "arcfour128",
        "arcfour",
        "cast128-cbc",
        "3des-cbc"
      ],
      "hassh": "f45fb203c31069bb280067b71ed92ccb",
      "input": null,
      "macCS": [
        "hmac-sha2-256",
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha2-512",
        "hmac-sha2-512-etm@openssh.com",
        "hmac-sha1",
        "hmac-sha1-etm@openssh.com",
        "hmac-sha1-96",
        "hmac-md5",
        "hmac-md5-96",
        "hmac-ripemd160",
        "hmac-ripemd160@openssh.com"
      ],
      "compCS": [
        "none"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "109.63.177.113",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group-exchange-sha256",
        "diffie-hellman-group16-sha512",
        "diffie-hellman-group18-sha512",
        "diffie-hellman-group14-sha256",
        "diffie-hellman-group14-sha1",
        "diffie-hellman-group1-sha1",
        "diffie-hellman-group-exchange-sha1",
        "ext-info-c",
        "kex-strict-c-v00@openssh.com"
      ],
      "keyAlgs": [
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "ecdsa-sha2-nistp256-cert-v01@openssh.com",
        "ecdsa-sha2-nistp384-cert-v01@openssh.com",
        "ecdsa-sha2-nistp521-cert-v01@openssh.com",
        "rsa-sha2-512",
        "rsa-sha2-256",
        "rsa-sha2-512-cert-v01@openssh.com",
        "rsa-sha2-256-cert-v01@openssh.com",
        "ssh-rsa",
        "ssh-rsa-cert-v01@openssh.com"
      ],
      "message": "SSH client hassh fingerprint: f45fb203c31069bb280067b71ed92ccb",
      "outfile": null,
      "session": "63c70163a39f",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 33308,
      "username": null,
      "timestamp": "2026-10-13T18:36:50.098846Z",
      "duration_ms": null,
      "hasshAlgorithms": "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "109.63.177.113",
      "eventid": "cowrie.login.success",
      "message": "login attempt [root/uwqQqTF7] succeeded",
      "outfile": null,
      "session": "63c70163a39f",
      "version": null,
      "dst_port": 2222,
      "password": "uwqQqTF7",
      "protocol": "ssh",
      "src_port": 33308,
      "username": "root",
      "timestamp": "2026-10-13T18:36:52.481966Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "109.63.177.113",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 2672 milliseconds",
      "outfile": null,
      "session": "63c70163a39f",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 33308,
      "username": null,
      "timestamp": "2026-10-13T18:36:52.627168Z",
      "duration_ms": 2672
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "109.63.177.113",
  "session_id": "63c70163a39f"
}