They checked for a graphics card
Fifteen SSH sessions on the honeypot pasted the same fingerprint script before doing anything else. It harvests nine facts about the host - kernel, architecture, processor model, core count, uptime, last logins - and one field the attacker's own code labels as the graphics card, filled by listing PCI hardware and filtering for display adapters, with a busybox fallback for stripped-down systems. Hardware decides the payload: a machine with a real card earns more as a miner than as another node in a botnet.
Fifteen intruders logged in, and every one of them asked the same question first.
You expect a break-in to start with theft. Files, credentials, anything portable. That is not what these sessions did.
Each one pasted the same fingerprint script, and it harvests nine facts about the host before anything else happens. Kernel, architecture, processor model, core count, uptime, who logged in last.
And one field the attacker’s own code labels as the graphics card. It lists the hardware, filters for display adapters, and falls back to a cut-down toolset in case the normal one is missing.
A machine with a real card is worth more running a miner than sitting in a botnet. So they measure the hardware, then choose the payload.
That field is a statement of intent. It tells you what they came to do, before they got the chance to do it.
Log what runs after a login, not only who logged in.
#linux#security#selfhosted#infosec#sysadmin
❯ Log what runs after a login, not only who logged in.