Using HTTP Language Headers to Find Anomalous Honeypot Scanning

Summary

A SANS diary demonstrates using Kibana field distributions and HTTP charset/language headers to narrow DShield honeypot logs, identify anomalous requests, and surface repeated endpoint scans from hosts in AS-7456.

Key points

The author used Kibana Discover field statistics to reduce roughly 960,000 honeypot logs collected over three weeks to smaller, reviewable datasets.
Long-tail analysis of field values surfaced unusual HTTP charset and language preferences, including GBK and zh-CN.
Filtering for the relevant headers identified 31 records associated with AS-7456; the author reports 121 records for that autonomous system overall.
The 31 records came from five source IPs and repeatedly requested common endpoints such as /cgi-bin/login, /config.json, and /robots.txt.
The author interpreted the repeated requests as automated scanning and presents iterative feature selection as a way to find related activity in large SIEM datasets.

Article Details

Defense Focus: Use unusual HTTP language and character-set preferences to narrow SIEM data and identify coordinated internet scanning.
Detection Methods: Use Kibana Field Statistics and long-tail distribution analysis to find uncommon values across honeypot records.
Filter on unusual Accept-Charset values, including GBK, then compare matching records across indexes.
Correlate Accept-Language preferences with source region and autonomous system number to identify related traffic.
Review user agents, source domains, and repeated requested endpoints for patterns across matching records.
Data Sources: DShield honeypot web-server logs in the Elastic SIEM, including the cowrie and webhoneypot indexes
HTTP Accept-Charset and Accept-Language headers
HTTP request body content, including requested paths
Source geolocation region and autonomous system fields
User-Agent and source-domain fields
Rule Types: Kibana filter expressions using field:value criteria and OR
ESQL query for extracting source.domain values
Platforms: Elastic SIEM
Kibana
DShield SIEM
Defensive Actions: Hunt for the reported unusual GBK and zh-CN language-preference patterns in HTTP logs.
Compare matching requests across indexes and group them by source ASN, region, domain, and user agent.
Investigate repeated requests for /cgi-bin/login, /config.json, /sitemap.xml, /robots.txt, /favicon.ico, and / as possible coordinated scanning.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`leheedu[.]cn`	Listed among domains operating from AS-7456 that the article describes as actively scanning.
DOMAIN	`tzrhxln[.]cn`	Described as a suspect high-entropy domain associated with a listed scanning host; the article says the domains in this set were actively scanning.
IPV4	`165[.]154[.]11[.]140`	Listed as one of the hosts regularly scanning internet-facing endpoints in the observed activity.
IPV4	`165[.]154[.]120[.]226`	Listed as one of the hosts regularly scanning internet-facing endpoints in the observed activity.
IPV4	`165[.]154[.]182[.]221`	Listed as one of the hosts regularly scanning internet-facing endpoints in the observed activity.
IPV4	`165[.]154[.]29[.]93`	Listed as a regularly scanning host and associated in the article with the suspect high-entropy domain tzrhxln[.]cn.
IPV4	`165[.]154[.]33[.]72`	Listed as one of the hosts regularly scanning internet-facing endpoints in the observed activity.
IPV4	`165[.]154[.]36[.]91`	Listed as one of the hosts regularly scanning internet-facing endpoints in the observed activity.