195.178.110.227
- Sensor
- hp-use-01
- Source
- cowrie
- Status
- triaged
- Event time
- Received
Verdict
S4successful_intrusionConfidence 97%Escalate: yesReasoning
The session shows a confirmed SSH login success using root/000000, which establishes a foothold on the honeypot. Per the rubric, any successful login is at least severity 4 and falls under successful_intrusion unless there is evidence of malware delivery or persistence. Retrieved session commands show no post-login commands, downloads, or uploads, so there is no evidence to raise severity to 5.
Recommended action
Escalate for review, retain full session telemetry, and correlate this source with other successful logins or follow-on activity; no malware or persistence actions were observed in this session.
Routing
- Primary model
- gpt-4o-mini
- Final model
- gpt-5.4
- Escalated to strong model
- yes
- Prompt version
- triage-v4
- Input tokens
- 4,647
- Output tokens
- 281
- Cost
- $0.006278
- Latency
- 6,586 ms
- Verdict at
- 2026-11-07 10:01:31Z
Tool trace
0. get_session_commands· 0 ms
Arguments{ "session_id": "6ac0332c6e78" }Result{ "commands": [], "downloads": [], "session_id": "6ac0332c6e78", "command_count": 0, "download_count": 0, "clipped_commands": 0, "commands_truncated": false, "downloads_truncated": false }
Raw session JSON
{
"events": [
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.227",
"eventid": "cowrie.session.connect",
"message": "New connection: 195.178.110.227:57832 (172.18.0.2:2222) [session: 6ac0332c6e78]",
"outfile": null,
"session": "6ac0332c6e78",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 57832,
"username": null,
"timestamp": "2026-11-07T10:01:13.518298Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.227",
"eventid": "cowrie.client.version",
"message": "Remote SSH version: SSH-2.0-Go",
"outfile": null,
"session": "6ac0332c6e78",
"version": "SSH-2.0-Go",
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 57832,
"username": null,
"timestamp": "2026-11-07T10:01:13.902890Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"encCS": [
"aes128-ctr",
"aes192-ctr",
"aes256-ctr",
"aes128-gcm@openssh.com",
"aes256-gcm@openssh.com",
"chacha20-poly1305@openssh.com",
"arcfour256",
"arcfour128",
"arcfour",
"3des-cbc",
"aes128-cbc"
],
"hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
"input": null,
"macCS": [
"hmac-sha2-256-etm@openssh.com",
"hmac-sha2-512-etm@openssh.com",
"hmac-sha2-256",
"hmac-sha2-512",
"hmac-sha1",
"hmac-sha1-96"
],
"compCS": [
"none"
],
"dst_ip": "172.18.0.2",
"langCS": [
""
],
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.227",
"eventid": "cowrie.client.kex",
"kexAlgs": [
"curve25519-sha256@libssh.org",
"ecdh-sha2-nistp256",
"ecdh-sha2-nistp384",
"ecdh-sha2-nistp521",
"diffie-hellman-group-exchange-sha256",
"diffie-hellman-group-exchange-sha1",
"diffie-hellman-group16-sha512",
"diffie-hellman-group14-sha256",
"diffie-hellman-group14-sha1",
"diffie-hellman-group1-sha1",
"ext-info-c",
"kex-strict-c-v00@openssh.com"
],
"keyAlgs": [
"ssh-rsa",
"rsa-sha2-256",
"rsa-sha2-512",
"ssh-dss",
"ecdsa-sha2-nistp256",
"ecdsa-sha2-nistp384",
"ecdsa-sha2-nistp521",
"ssh-ed25519"
],
"message": "SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5",
"outfile": null,
"session": "6ac0332c6e78",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 57832,
"username": null,
"timestamp": "2026-11-07T10:01:13.903342Z",
"duration_ms": null,
"hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none"
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.227",
"eventid": "cowrie.login.success",
"message": "login attempt [root/000000] succeeded",
"outfile": null,
"session": "6ac0332c6e78",
"version": null,
"dst_port": 2222,
"password": "000000",
"protocol": "ssh",
"src_port": 57832,
"username": "root",
"timestamp": "2026-11-07T10:01:15.513201Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"width": 240,
"dst_ip": "172.18.0.2",
"height": 24,
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.227",
"eventid": "cowrie.client.size",
"message": "Terminal Size: 240 24",
"outfile": null,
"session": "6ac0332c6e78",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 57832,
"username": null,
"timestamp": "2026-11-07T10:01:16.209291Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.227",
"eventid": "cowrie.session.closed",
"message": "Connection lost after 17383 milliseconds",
"outfile": null,
"session": "6ac0332c6e78",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 57832,
"username": null,
"timestamp": "2026-11-07T10:01:30.901875Z",
"duration_ms": 17383
}
],
"sensor": "hp-use-01",
"source": "cowrie",
"src_ip": "195.178.110.227",
"session_id": "6ac0332c6e78"
}