GreedyBear
GreedyBear copied to clipboard
Collect samples extracted from T-POTs [blocked by T-POT issue]
At this time this is not possible through Elastic. However, there's an issue open for that: https://github.com/telekom-security/tpotce/discussions/1653
At the time of writing, the T-POT collects the downloaded samples in dedicated folders of each of the honeypots that are able to do that.
Example (~/tpotce/data):
- adbhoney: data/adbhoney/downloads
- cowrie: data/cowrie/downloads
- log4pot: data/log4pot/payloads
- honeytrap: data/honeytrap/[downloads,attacks]
But this data is not indexed into Elastic. When this will be available there, we could collect these samples in GreedyBear too in a new dedicated section. To avoid being flagged as malicious, we shouldn't simply host them for the public, we should keep a separated authenticated API.
Plus, we could send those samples to MalwareBazaar in the same way we do for payload requests for Threatfox.