Skip to content

ogurexxx@root:~$ attack-coverage --honest

Defence coverage

Which attacker techniques are blocked on this server, which are only visible and which are not covered at all. These are the techniques seen in the honeypot. No defence is without gaps, so they stay in plain sight.

0 / 19techniques covered

0blocked

0detected

0not covered

19not assessed

Credential Access

T1110.001 Password Guessing not assessed in the honeypot: 334 addresses

T1003.008 /etc/passwd and /etc/shadow not assessed

T1552.004 Private Keys not assessed

Discovery

T1082 System Information Discovery not assessed in the honeypot: 37 addresses

T1033 System Owner/User Discovery not assessed in the honeypot: 9 addresses

T1057 Process Discovery not assessed in the honeypot: 9 addresses

T1016 System Network Configuration Discovery not assessed

T1083 File and Directory Discovery not assessed in the honeypot: 13 addresses

Command and Control

T1105 Ingress Tool Transfer not assessed in the honeypot: 1 addresses

Execution

T1059.004 Unix Shell not assessed in the honeypot: 16 addresses

Persistence

T1098.004 SSH Authorized Keys not assessed in the honeypot: 259 addresses

T1053.003 Cron not assessed in the honeypot: 9 addresses

T1136.001 Create Local Account not assessed

T1098 Account Manipulation not assessed in the honeypot: 9 addresses

Defense Evasion

T1222.002 Linux File and Directory Permissions Modification not assessed in the honeypot: 267 addresses

T1070.003 Clear Command History not assessed

T1562.004 Disable or Modify System Firewall not assessed

Impact

T1496 Resource Hijacking not assessed

T1489 Service Stop not assessed in the honeypot: 5 addresses

Statuses are the author's own assessment, not an external audit. Honeypot numbers show what bots try, not what succeeds.