Honeypot, IOC Feed and Basic OSINT in a Containerized Environment

Introduction

I would to share one of my last homelab project. I was looking for a simple project to build a self-hosted IOC feed enriched through an honey-pot to used then in a home-lab SIEM. thought: why not leverage my existing skills while picking up some new ones? Let’s do it.

Environment

My hw HomeLab is composed by one Beelink MiniServer with Ryzen9 6900HX, 32GB of DDR5 Ram and 1TB SSD. Inside, virtualized by ProxMox, we can find:

• 3x K3s Rancher nodes that goes to compose the main Kubernetes cluster
• 1x NFS Server to expose the Storage Class for Kubernetes
• 1x Cloudflare VM with cloudflared tunnel daemon, to expose over internet(in my case to bypas CGNAT gently offered by my internet provider)

Outside of my home hardware there is too:

• 1x free tier AWS EC2 micro

Project components

To develop that it was inside my brain i needed 3 main component: one is Honeypot, a SIEM to get the logs-metrics from the latter and SOAR to automate stuff. I chosen these solution:

• SIEM-> Wazuh. One of the Open Sorce solution and lot of supported customization. Installed on my K3s cluster following the official KB(https://documentation.wazuh.com/current/deployment-options/deploying-with-kubernetes/kubernetes-deployment.html, modifying where it need the different engine from docker to containerd — default of K3s)
• SOAR-> Obvioulsy Shuffle. Best (and the only one i suppose) SOAR Open Source. Even here installed and ran on K3s cluster. A bit tricky to configure because the apps deploy is based on docker. You must to provide an local docker repository(you could follow samething like this: https://medium.com/@miladr0r/complete-guide-set-up-a-private-docker-registry-in-your-local-k3s-ddd03066a51e)
• HONEYPOT-> Belzebub. I have wanted to test this toy made by the excellent work of my compatriot Mario Candela(which i thank).

Scenarios

First of all i started with Honeypot configuration. I have read the official doc for Belzebub Honeypot and i configured the environment in AWS EC2. First thing: to close the original SSH access opening it on high randomic port number constrait with dedicated certificate. Second step, open common ssh port and have managed them by Belzebub. You can leave the SSH response control to the Honepot with LLm integration but being poor and not having subscription to major AI Chatboot I settled for pre-generated SSH responses (ironically generated with free ChatGPT).

Last step, make an plausible but not too likely E-Commerce static web page:

Now the honeypot was configured for my purpose. Now i needed who catch the Belzebub logs. And so i started with Wazuh configuration. I decided to install it on my K3s env. Followed the official documentation the installation process was quite easy if you are familiar with Kubernetes(the official doc here:https://documentation.wazuh.com/current/deployment-options/deploying-with-kubernetes/index.html). Once i hade done that, i installed the WARP client(to tunneling the connection from my EC2 and my K3s cluster) and the WAZUH agent with monitor configuration on Belzebub logs. When the logs started coming in on Belzebub i needed a new rule to open new cases on Wazuh when the new connection had been established. And so i created two WAZUH correlation rule, one for SSH new connection and one for HTTPS one:

And boom, we already have some new events:

and already parsed, since they are in JSON format.

Great, I said, now how we can I use all of this information to get what I want? An automated, homemade IOC feed of potential attackers?

So the second part of my flight of fancy was, I wanted to automate a port scan against the visitor’s IP, but only if it wasn’t already flagged in common threat databases and store all findings in my personal MISP instance ready to published or use as feed integration on the SIEM.

And for it i needed SOAR, and Shuffle was perfect. I installed this one too on my K3s cluster(but this time with several issue, since my K3s cluster runs containerd rather than Docker, which Orborus requires).

Now there is all of I need, quite. First i have to write a simple Py based Pod with simple API that would scan for open ports when i provided it with an IP address. The major relevant ports for both blue and red team use ( For example the C2/RAT presence, SOCKS/Proxy, TOR, VNC and so on) and the most relevant general info as ASN, Geo info, x509 cert etc. But that’s not all, i needed a threat score indicator for MISP(as a default object template). I probably could have done better but basically i adding threat score based on the possible malicious port opened detected by the scanner, from 0 to 100.

So i created and tested this and leave the Repo link here.

I think a lot about how automation maintains this flow, keeping it so simple and i create this Shuffle WorkFlow:

1. Wazuh_Get_Honey_Alerts: Webhook From Wazuh filtering only for Honeypot dedicate rules
2. AbuseIPDB: Node for Checking if SourceIp already exist on AbuseIPDB
3. Search_If_Ip_Exist: Node for Checking if SourceIP is already list on MISP (no multiple insert)
4. NMAP_Scanner_API_Request: Node for API call to Pod dedicated for scanning
5. Polling_Scan_Engine_Results: Script Node dedicated for Polling the Scan API to wait the scan result. Unfortunally in Shuffle the loops are so limited so i created an waiting structure in PY, trying to adhere to Orborus’ timeouts.
6. Mapping_MISP_Attribute: Script Node dedicate to Mapping every single fields as MISP template, ready to push objects on MISP.(network-connection, http-request, ip-port ecc.)
7. Create_Event_MISP: Node dedicated to create a MISP new Event.
8. Add_Object_To_New_Event: Node Script dedicated to push the objects on the event ID created before. Also this because not exist in Shuffle a decent node loops.

Here the reporitory with all Node Script.

Ok, now that i’ve done everything all that’s left is to wait for new bots and the result was similar to this in MISP:

And for each events, the catched object:

Now ready to integrate as feed on my SIEM or publish MISP Event when the score is larger than 70, for example.

I already know that in the real world all of this would be “pointless”, but it was so fun to do.

At the end obviouly is ALL FOR TESTING PORPOUS and in my HomeLab, I do not encourage anyone to replicate this setup — active scanning of third-party IPs raises legal concerns. Everything here was tested in isolated, controlled cases only and only for IP that actually attacked my honeypot.

Peace

Jacopo.