{"ip":"45.153.34.212","data_as_of":"2026-10-27T22:53:16+00:00","observed":true,"total_events":1,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"10 interactive session(s) ran commands after logging in","confidence":"high","network_type":null,"why":["10 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 1 event(s) from this address as well.","Not in any known-scanner range.","Sent 6,621 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,621 bytes sent","bytes_sent":6621,"session_seconds":7,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-19T04:10:34","last_seen":"2026-10-20T13:47:46","events_24h":0,"events_7d":0,"interactive_sessions":12,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"telnet","sessions":12}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":197170,"org":"TechTies Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"3e0cbab1a0983a942993e00f5e32dda1faf66ee701b96affab7a4189a4b54e3a","family":"cling","vt_name":"oW5sF9eQ3rM","malicious":14,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":1,"last_seen":"2026-10-19 04:10:34"}],"udp":null,"interaction":{"window_days":90,"sessions":12,"first_seen":"2026-10-19T04:10:34","last_seen":"2026-10-20T13:47:46","verdicts":[{"verdict":"post-exploitation","sessions":10},{"verdict":"unknown","sessions":1},{"verdict":"credential","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":12}],"services":[{"protocol":"telnet","port":23,"sessions":12}],"logins":[{"username":"root","password":"root","password_sent":true,"service":"telnet","outcome":"success","tries":10,"last_seen":"2026-10-20T13:47:45"},{"username":"root","password":"","password_sent":true,"service":"telnet","outcome":"failure","tries":1,"last_seen":"2026-10-19T04:11:18"}],"commands":[{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cp /bin/busybox 19ju3d; >19ju3d; /bin/busybox chmod 777 19ju3d; /bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox rm -rf 19ju3d 902i13","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/usr/.ptmx && cd /usr/","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/boot/.ptmx && cd /boot/","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/etc/.ptmx && cd /etc/","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/bin/.ptmx && cd /bin/","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/shm/.ptmx && cd /dev/shm/","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/netslink/.ptmx && cd /dev/netslink/","exit_code":1},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/.ptmx && cd /","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/tmp/.ptmx && cd /var/tmp/","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.ptmx && cd /var/run/","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/mnt/.ptmx && cd /mnt/","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/.ptmx && cd /dev/","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/.ptmx && cd /var/","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/tmp/.ptmx && cd /tmp/","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-20T13:47:46","session_id":"a8912a70-730e-417e-ad13-375a5b3c8bbd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0},{"ts":"2026-10-20T12:43:00","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-20T12:43:00","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cp /bin/busybox 19ju3d; >19ju3d; /bin/busybox chmod 777 19ju3d; /bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox rm -rf 19ju3d 902i13","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/usr/.ptmx && cd /usr/","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/boot/.ptmx && cd /boot/","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/etc/.ptmx && cd /etc/","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/bin/.ptmx && cd /bin/","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/shm/.ptmx && cd /dev/shm/","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/netslink/.ptmx && cd /dev/netslink/","exit_code":1},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/.ptmx && cd /","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/tmp/.ptmx && cd /var/tmp/","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.ptmx && cd /var/run/","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/mnt/.ptmx && cd /mnt/","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/.ptmx && cd /dev/","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/.ptmx && cd /var/","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/tmp/.ptmx && cd /tmp/","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-20T12:42:59","session_id":"98f9ec6a-cc1a-46ee-8175-1e72d713aa40","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0},{"ts":"2026-10-20T10:53:48","session_id":"33466db3-e206-42d9-982e-9b5659aaa667","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-20T10:53:47","session_id":"33466db3-e206-42d9-982e-9b5659aaa667","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox","exit_code":0},{"ts":"2026-10-20T10:53:47","session_id":"33466db3-e206-42d9-982e-9b5659aaa667","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cp /bin/busybox 19ju3d; >19ju3d; /bin/busybox chmod 777 19ju3d; /bin/busybox AK1K2","exit_code":127},{"ts":"2026-10-20T10:53:47","session_id":"33466db3-e206-42d9-982e-9b5659aaa667","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox rm -rf 19ju3d 902i13","exit_code":0},{"ts":"2026-10-20T10:53:47","session_id":"33466db3-e206-42d9-982e-9b5659aaa667","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/usr/.ptmx && cd /usr/","exit_code":0},{"ts":"2026-10-20T10:53:47","session_id":"33466db3-e206-42d9-982e-9b5659aaa667","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/boot/.ptmx && cd /boot/","exit_code":0},{"ts":"2026-10-20T10:53:47","session_id":"33466db3-e206-42d9-982e-9b5659aaa667","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/shm/.ptmx && cd /dev/shm/","exit_code":0},{"ts":"2026-10-20T10:53:47","session_id":"33466db3-e206-42d9-982e-9b5659aaa667","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/bin/.ptmx && cd /bin/","exit_code":0}],"downloads":[{"url":"[http]://45[.]153[.]34[.]212:80/bins/sora.x86","host":"45[.]153[.]34[.]212","sessions":4,"first_seen":"2026-10-19T04:10:34","last_seen":"2026-10-19T07:46:19","virustotal":{"sha256":"3e0cbab1a0983a942993e00f5e32dda1faf66ee701b96affab7a4189a4b54e3a","status":"known","malicious":14,"total":75,"name":"oW5sF9eQ3rM"}}],"files":[{"sha256":"7593b5d4bb6b7cb02db71aca1b4f3de251cd6c7a6c2be624e524e6cdc6536499","name":"19ju3d","size":22954,"mime_type":"application/x-executable","kind":"sample","times":8,"first_seen":"2026-10-19T04:10:33","last_seen":"2026-10-19T07:46:18","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":10},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":10},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":11},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":4}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":12},{"port":80,"proto":"tcp","label":"HTTP","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun010_00040000_c4b2c4aa"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun010_00040000_c4b2c4aa":970},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-19","count":0,"sessions":8},{"date":"2026-10-20","count":1,"sessions":4}],"recent_events":[{"timestamp":"2026-10-20T13:47:46","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox AK1K2","payload_hex":"2f62696e2f62757379626f7820414b314b32","method":"","user_agent":"","ja3":"","session":"a8912a70-730e-417e-ad13-375a5b3c8bbd-44","seq":44,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"091fb95f1271acf0","strings":["/bin/busybox AK1K2"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-20T13:47:46","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox","payload_hex":"2f62696e2f62757379626f7820636174202f62696e2f62757379626f78207c7c207768696c65207265616420693b20646f206563686f2024693b20646f6e65203c202f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"a8912a70-730e-417e-ad13-375a5b3c8bbd-42","seq":42,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e4737c9bfea146c1","strings":["/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-20T13:47:46","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox cp /bin/busybox 19ju3d; >19ju3d; /bin/busybox chmod 777 19ju3d; /bin/busybox AK1K2","payload_hex":"2f62696e2f62757379626f78206370202f62696e2f62757379626f782031396a7533643b203e31396a7533643b202f62696e2f62757379626f782063686d6f64203737372031396a7533643b202f62696e2f62757379626f7820414b314b32","method":"","user_agent":"","ja3":"","session":"a8912a70-730e-417e-ad13-375a5b3c8bbd-40","seq":40,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3023aae3df5568b2","strings":["/bin/busybox cp /bin/busybox 19ju3d; >19ju3d; /bin/busybox chmod 777 19ju3d; /bi…"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-20T13:47:46","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/etc/.ptmx && cd /etc/","payload_hex":"3e2f6574632f2e70746d78202626206364202f6574632f","method":"","user_agent":"","ja3":"","session":"a8912a70-730e-417e-ad13-375a5b3c8bbd-32","seq":32,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"06ac445a7ddd1808","strings":[">/etc/.ptmx && cd /etc/"],"iocs":{"paths":["/etc/.ptmx"]}},"interactive":true},{"timestamp":"2026-10-20T13:47:46","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/boot/.ptmx && cd /boot/","payload_hex":"3e2f626f6f742f2e70746d78202626206364202f626f6f742f","method":"","user_agent":"","ja3":"","session":"a8912a70-730e-417e-ad13-375a5b3c8bbd-34","seq":34,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5e969ecbb8727c7c","strings":[">/boot/.ptmx && cd /boot/"],"iocs":{"paths":["/boot/.ptmx"]}},"interactive":true},{"timestamp":"2026-10-20T13:47:46","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/usr/.ptmx && cd /usr/","payload_hex":"3e2f7573722f2e70746d78202626206364202f7573722f","method":"","user_agent":"","ja3":"","session":"a8912a70-730e-417e-ad13-375a5b3c8bbd-36","seq":36,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3380e53aff72d470","strings":[">/usr/.ptmx && cd /usr/"],"iocs":{"paths":["/usr/.ptmx"]}},"interactive":true},{"timestamp":"2026-10-20T13:47:46","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox rm -rf 19ju3d 902i13","payload_hex":"2f62696e2f62757379626f7820726d202d72662031396a75336420393032693133","method":"","user_agent":"","ja3":"","session":"a8912a70-730e-417e-ad13-375a5b3c8bbd-38","seq":38,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1d442c489e376fd5","strings":["/bin/busybox rm -rf 19ju3d 902i13"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-20T13:47:46","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/dev/netslink/.ptmx && cd /dev/netslink/","payload_hex":"3e2f6465762f6e6574736c696e6b2f2e70746d78202626206364202f6465762f6e6574736c696e6b2f","method":"","user_agent":"","ja3":"","session":"a8912a70-730e-417e-ad13-375a5b3c8bbd-26","seq":26,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"169db9708cf4c937","strings":[">/dev/netslink/.ptmx && cd /dev/netslink/"],"iocs":{"paths":["/dev/netslink/.ptmx","/dev/netslink"]}},"interactive":true},{"timestamp":"2026-10-20T13:47:46","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/dev/shm/.ptmx && cd /dev/shm/","payload_hex":"3e2f6465762f73686d2f2e70746d78202626206364202f6465762f73686d2f","method":"","user_agent":"","ja3":"","session":"a8912a70-730e-417e-ad13-375a5b3c8bbd-28","seq":28,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c4c03adab34dc0b2","strings":[">/dev/shm/.ptmx && cd /dev/shm/"],"iocs":{"paths":["/dev/shm/.ptmx","/dev/shm"]}},"interactive":true},{"timestamp":"2026-10-20T13:47:46","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/bin/.ptmx && cd /bin/","payload_hex":"3e2f62696e2f2e70746d78202626206364202f62696e2f","method":"","user_agent":"","ja3":"","session":"a8912a70-730e-417e-ad13-375a5b3c8bbd-30","seq":30,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"af257ca4ae153ae3","strings":[">/bin/.ptmx && cd /bin/"],"iocs":{"paths":["/bin/.ptmx"]}},"interactive":true}],"http_methods":[{"method":"GET","count":1}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":10},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":10},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":4},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":11}]}