Cybersecurity articles tagged #DShield on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/dshield-honeypot-tty-log-analysis-reveals-common-crontab-attackshttps://runtimerebel.com/blog/dshield-honeypot-tty-log-analysis-reveals-common-crontab-attacksRuntime Rebel analyzes SANS ISC's report on TTY log collection from DShield honeypots, revealing common crontab commands executed by over 3,130 unique actors.Mon, 05 Oct 2026 03:03:17 GMTDShieldHoneypotsLog AnalysisThreat IntelligenceTTY Logshttps://runtimerebel.com/blog/dshield-siem-update-elk-stack-8-19-15-and-enhanced-logginghttps://runtimerebel.com/blog/dshield-siem-update-elk-stack-8-19-15-and-enhanced-loggingSANS ISC updates the DShield SIEM to ELK stack 8.19.15, introducing enhanced logging capabilities and new dashboards for improved honeypot data analysis.Wed, 15 Jul 2026 10:11:13 GMTDShieldSIEMELK StackSANS ISCHoneypotLog Analysishttps://runtimerebel.com/blog/dshield-sensor-analysis-a-year-of-observed-threat-upload-trendshttps://runtimerebel.com/blog/dshield-sensor-analysis-a-year-of-observed-threat-upload-trendsRuntime Rebel analyzes a year of file uploads to DShield sensors, revealing peak threat activity from December 2025 to February 2026 and subsequent decline.Thu, 28 May 2026 20:55:02 GMTDShieldThreat IntelligenceSensor DataThreat TrendsKibanaESQLhttps://runtimerebel.com/blog/dshield-honeypot-updates-ensuring-timely-threat-data-collectionhttps://runtimerebel.com/blog/dshield-honeypot-updates-ensuring-timely-threat-data-collectionSANS ISC announces upcoming updates for DShield honeypots. Learn why these automatic updates are crucial for maintaining effective threat intelligence collection.Mon, 04 May 2026 16:47:53 GMTDShieldHoneypotSANS ISCThreat IntelligenceSecurity Updateshttps://runtimerebel.com/blog/emerging-reconnaissance-attackers-actively-probe-ai-modelshttps://runtimerebel.com/blog/emerging-reconnaissance-attackers-actively-probe-ai-modelsDShield sensors detect increasing scanning activity targeting popular AI models like Claude and Hugging Face, signaling a potential new attack vector for threat actors.Wed, 15 Apr 2026 00:46:56 GMTAI ModelsScanningReconnaissanceThreat IntelligenceDShieldHugging FaceClaudeOpenClawhttps://runtimerebel.com/blog/cowrie-honeypot-analysis-detecting-automated-session-disconnectshttps://runtimerebel.com/blog/cowrie-honeypot-analysis-detecting-automated-session-disconnectsAnalyze DShield Cowrie honeypot data to distinguish between automated bot traffic and manual actor activity through session duration and exit commands.Mon, 30 Mar 2026 00:41:28 GMTCowrieDShieldHoneypotsSsh SecurityTelnet Traffichttps://runtimerebel.com/blog/analysis-of-iranbot-message-in-cowrie-honeypot-logshttps://runtimerebel.com/blog/analysis-of-iranbot-message-in-cowrie-honeypot-logsA peculiar 'iranbot_was_here' message, alongside Telnet logins and portscans, was observed in Cowrie honeypot logs, signaling potential reconnaissance activity.Thu, 19 Mar 2026 04:43:57 GMTCowrieHoneypotTelnetReconnaissanceIranbotDShieldLogginghttps://runtimerebel.com/blog/optimizing-honeypot-log-analysis-using-ai-and-llm-orchestrationhttps://runtimerebel.com/blog/optimizing-honeypot-log-analysis-using-ai-and-llm-orchestrationAn analysis of how AI-assisted log processing reduces noise in DShield and Cowrie honeypot data, enabling analysts to identify sophisticated threat patterns.Thu, 26 Feb 2026 04:39:18 GMTAI MLHoneypotsCowrieDShieldLog AnalysisThreat Hunting