About the Lab

Here is a demonstration video I made for this lab:

Lab Objectives

Setup a honeypot virtual machine that is wide exposed to the internet (zero-inbound rules)
- A honeypot is a computer with weak security.
- Just like how honey bees are attracted to honey, we can attract hackers from around the world to try to hack into our computer.
  
  Hackers love weakly configured computers. And unlike bees, hackers use automated tools to find goodies
Analyze incoming traffic
- While hackers are busy trying to break into our computer (or virtual machine), we can quietly extract data about them - like their IP address, location and few other information
- In this lab, I’m only interested in plotting the location of the attackers on a world map in real time!

HoneyPot Network Diagram (3).png

Untitled

Essentially we a trying to detect failed RDP logon attempts to our honeypot VM. Windows OS tags such events with an ID of 4625 and they are added to a centralized pool of logs (that also includes other event IDs).
Since we are only interested in RDP failed logons, we filter events (from the ‘centralized pool’) with the ID 4625 and store them onto a separate log file under C:\ProgramData\<custom log file name> in our VM
With the help of a third-party service we discover the latitude and longitude of the IP that is embedded in each of the filtered logs.
<describe the entire steps in the lab>