🖥️Reconnaissance: Active Network Scanning
Detects active network scanning patterns observed in honeypot targeting smart home devices
🖥️Exploitation: Command Injection via IoT Protocol
Detects command injection attempts through CoAP/MQTT payloads
📄Malware: Mirai Variant Detection
YARA rule for detecting Mirai botnet variant payloads
🌐Lateral Movement: Internal Network Probe
Detects lateral movement attempts from compromised IoT devices
🖥️Credential Theft: Default Password Attempt
Detects attempts to authenticate with known default IoT credentials
🖥️Discovery: Account Enumeration
Detects account enumeration attempts via API endpoints
T1087auto
#discovery#enumeration+1 🌐C2: Beaconing Activity Detection
Zeek script for detecting periodic C2 beaconing patterns