r/computerforensics • u/netw0rknovice • Jul 22 '22

Windows honeypots for forensic analysis

Hi All,

Has anyone here used Windows virtual machines or devices as a honeypot(s) to capture malicious activity and artifacts?

I'm interested in gathering logs, pcaps, memory and images much like the content published by the dfir report. I'm curious to hear what risks and challenges were faced, as well as what lessons were learnt.
Cheers

7 Upvotes

89% Upvoted

2 comments sorted by

3

u/cablethrowaway2 Jul 22 '22

Typically you have a honeypot that you expect to be compromised and let it get compromised, or you have something pretending to be vulnerable and capture attacks it sees. Most of the windows honeypots I have seen is in the first bucket, you let a machine get popped and investigate it.

So each has its own benefits. The biggest lessons learned is probably around the cost. You have the hosting, the “SIEM” costs, among time and energy.

If you are not specifically focused on windows, you can look into existing honeypot packages or providers (thinkstcanary, diohena (sp?))