DESCRIPTION LAST UPDATED: 2023-12-06
DEFAULT SEVERITY LEVEL: CRITICAL
This report contains information about DDoS attack commands observed by honeypot drones. These drones emulate malware bot infected machines and can listen to commands given to those bots. These commands include the C2 issuing the command and target information, malware family, protocol being used for C2 and attack destination as well as various attack parameters.
The src_ip below is the C2 IP issuing the commands, the dst_ip is the IP of the attack victim. If you are getting this report, it means a C2 (src_ip) issuing the attack command was located on your network or constituency.
The activity reported is typically related to Mirai like bots. The naming convention and description is consistent with the Mirai source code published.
This report has its sister version that contains the same information but filtered by dst_ip (address of attack victims): Honeypot DDoS Target Events Report.
You can learn more on the report in our Honeypot DDoS Events Report tutorial.
You can learn more on our reports in general in our Overview of Free Public Benefit Shadowserver Reports presentation, which also explains example Use Cases.
Severity levels are described here.
This report was enabled as part of the European Union HaDEA CEF VARIoT project.
File name: event4_honeypot_ddos
