From USB Dongle to Threat Intelligence: Building a Production-Grade Cowrie Honeypot on Raspberry Pi Zero + Video

By /

Listen to this Post

Featured Image

Introduction:

In the cat-and-mouse game of cybersecurity, deception is one of the most powerful weapons available to defenders. A honeypot—a deliberately vulnerable system designed to lure attackers—transforms the traditional reactive security posture into an active intelligence-gathering operation. By deploying Cowrie, a medium-interaction SSH and Telnet honeypot, on a Raspberry Pi Zero configured as a USB Ethernet gadget, security professionals can create a portable, low-cost threat sensor that captures real attacker behavior, logs every command, and feeds actionable intelligence directly into a SIEM for real-time monitoring and threat hunting.

Learning Objectives:

  • Deploy and configure Cowrie SSH honeypot on Raspberry Pi OS with full command emulation and session logging
  • Configure Raspberry Pi Zero as a USB Ethernet gadget for headless, network-free SSH access
  • Implement iptables port redirection to expose the honeypot without interfering with host SSH services
  • Integrate Cowrie JSON logs with Wazuh SIEM using Filebeat for centralized alerting and visualization
  • Analyze attacker behavior through log queries, event correlation, and custom detection rules aligned with MITRE ATT&CK

You Should Know:

  1. USB Gadget Mode: Turning Your Pi Zero into a Plug-and-Play Threat Sensor

The Raspberry Pi Zero’s USB gadget capability allows it to masquerade as an Ethernet adapter when connected to a host computer via its micro-USB port. This eliminates the need for Wi-Fi or a physical network cable, making the honeypot truly portable and deployable anywhere with a USB port.

Step-by-Step Guide:

Step 1: Flash Raspberry Pi OS Lite – Use Raspberry Pi Imager to install Raspberry Pi OS Lite onto a microSD card. Enable SSH by creating an empty `ssh` file in the boot partition.

Step 2: Enable USB Gadget Mode – Edit the `config.txt` file on the boot partition and add the following line at the end:

dtoverlay=dwc2

Then edit `cmdline.txt` and insert `modules-load=dwc2,g_ether` after `rootwait`.

Step 3: Configure Static IP – On the Pi, edit `/etc/dhcpcd.conf` to assign a static IP to the USB interface:

interface usb0
static ip_address=10.55.0.2/24
static routers=10.55.0.1

This ensures the Pi always appears at the same address.

Step 4: Connect to the Pi – Plug the Pi into your computer via the USB port (not the power port). On Linux/macOS, find the USB interface and assign an IP:

USBIF=$(ip -o link show | awk -F': ' '$2 ~ /enx[0-9a-f]{12}|u[0-9]i[0-9]/ {print $2}'| head -1)
sudo ip addr add 10.55.0.1/24 dev $USBIF
ssh [email protected]

On Windows, open PowerShell as Administrator, locate the “USB Ethernet/RNDIS Gadget” adapter via ipconfig /all, then assign a static IP:

netsh interface ip set address name="Ethernet 2" static 10.55.0.1 255.255.255.0
ssh [email protected]
  1. Cowrie Installation and Configuration: Building the Deceptive Shell

Cowrie emulates a vulnerable SSH server, logging all login attempts, executed commands, and file transfers. It creates a realistic but entirely fake Linux environment where attackers believe they have gained shell access.

Step-by-Step Guide:

Step 1: Install Dependencies

sudo apt update
sudo apt install git python3 python3-dev libssl-dev libffi-dev build-essential libpython3-dev python3-minimal authbind virtualenv

Step 2: Change Host SSH Port – Since Cowrie will occupy port 22, move the real SSH service to an alternate port:

sudo vi /etc/ssh/sshd_config
 Change Port 22 to Port 2222 or another high port
sudo systemctl restart ssh

Step 3: Create Cowrie User and Clone Repository

sudo adduser --disabled-password cowrie
sudo su cowrie
git clone https://github.com/cowrie/cowrie ~/
cd ~/cowrie

Step 4: Set Up Python Virtual Environment

virtualenv --python=python3 ~/cowrie/cowrie-env
source ~/cowrie/cowrie-env/bin/activate
pip install -r requirements.txt

Step 5: Configure Cowrie – Copy the default configuration and user database:

cp ~/cowrie/etc/cowrie.cfg.dist ~/cowrie/etc/cowrie.cfg
cp ~/cowrie/etc/userdb.example ~/cowrie/etc/userdb.txt

Edit `~/cowrie/etc/cowrie.cfg` to customize the hostname, log path, and enable JSON logging:

hostname = vulnerable-server
log_path = /home/cowrie/cowrie/var/log/cowrie
[bash]
enabled = true

Step 6: Set Permissions and Start Cowrie

exit  exit cowrie user
sudo chown -R cowrie /home/cowrie/
sudo su cowrie
cd ~/cowrie
source cowrie-env/bin/activate
./bin/cowrie start

Step 7: Redirect Traffic with iptables – As root, forward external port 22 to Cowrie’s listening port (default 2222):

sudo iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2222
sudo iptables -t nat -A PREROUTING -p tcp --dport 23 -j REDIRECT --to-port 2223

3. Log Analysis: Extracting Intelligence from Attacker Interactions

Cowrie logs every action in JSON format, providing a rich dataset for analysis. Understanding these logs is critical for threat intelligence and incident response.

Key Log Locations and Commands:

  • Live log tailing: 
    tail -f ~/cowrie/var/log/cowrie/cowrie.json

  • List log files:

    ls -lah ~/cowrie/var/log/cowrie/

  • Extract failed login attempts using jq:

    cat ~/cowrie/var/log/cowrie/cowrie.json | jq 'select(.eventid == "cowrie.login.failed") | {src_ip, username, password}'

  • Analyze command input from attackers:

    cat ~/cowrie/var/log/cowrie/cowrie.json | jq 'select(.eventid == "cowrie.command.input") | {input, src_ip}'

Key Cowrie Event IDs:

| Event ID | Description |

|-|-|

| `cowrie.session.connect` | New SSH connection |

| `cowrie.login.failed` | Failed login attempt |

| `cowrie.command.input` | Command executed by attacker |

| `cowrie.command.failed` | Command execution failed |

| `cowrie.session.file_upload` | File uploaded via SFTP/SCP |

| `cowrie.session.file_download` | File downloaded |

4. SIEM Integration: Feeding Cowrie Logs into Wazuh

Connecting Cowrie to Wazuh transforms raw logs into actionable security alerts. Wazuh can correlate failed logins, detect brute-force patterns, and map events to the MITRE ATT&CK framework.

Step-by-Step Integration Guide:

Step 1: Install Wazuh – On a dedicated server or VM, run the official installer:

curl -sO https://packages.wazuh.com/4.7/wazuh-install.sh && sudo bash ./wazuh-install.sh -a

Step 2: Install Filebeat on the Cowrie Machine – Filebeat ships logs from Cowrie to Wazuh:

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.17.13-amd64.deb
sudo dpkg -i filebeat-7.17.13-amd64.deb

Step 3: Configure Filebeat – Edit `/etc/filebeat/filebeat.yml` to read Cowrie JSON logs and forward them to Wazuh:

filebeat.inputs:
- type: log
enabled: true
paths:
- /home/cowrie/cowrie/var/log/cowrie/cowrie.json
json.keys_under_root: true
json.add_error_key: true

output.logstash:
hosts: ["<WAZUH_SERVER_IP>:5000"]

Step 4: Configure Wazuh Agent – Install the Wazuh agent on the Cowrie machine and authenticate it to the manager:

sudo apt install wazuh-agent
sudo /var/ossec/bin/agent-auth -m <WAZUH_MANAGER_IP> -A cowrie-agent -k '<AGENT_KEY>'

Step 5: Add Custom Detection Rules – Create `/var/ossec/etc/rules/local_rules.xml` on the Wazuh manager to detect brute-force attacks:

<group name="cowrie,ssh,attack">
<rule id="100010" level="5">
<field name="eventid">cowrie.login.failed</field>
<description>Cowrie SSH login failed</description>
<group>authentication_failed</group>
</rule>
<rule id="100020" level="12" frequency="5" timeframe="60">
<if_matched_sid>100010</if_matched_sid>
<description>Cowrie SSH Brute Force Attack</description>
<group>bruteforce,attack</group>
</rule>
</group>

Step 6: Restart Services

sudo systemctl restart wazuh-manager
sudo systemctl restart filebeat
  1. Threat Hunting in Practice: Analyzing Real Attacker Behavior

With the honeypot live and logs flowing into Wazuh, security analysts can begin threat hunting—proactively searching for malicious activity rather than waiting for alerts.

Real-World Attack Pattern Observed:

In one documented case, an attacker from IP `43.166.245.172` successfully authenticated using credentials `jon:jon` and immediately attempted to establish persistence. The attacker executed:

cd ~; chattr -ia .ssh; lockr -ia .ssh

This command attempts to remove immutable file attributes before modifying SSH configuration. When `lockr` failed (as it’s not available in the Cowrie environment), the attacker pivoted to SSH key injection:

mkdir .ssh
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
chmod -R go= ~/.ssh

Threat Hunting Queries for Wazuh Dashboard:

  • Top attacking IPs: 
    index="cowrie" eventid="cowrie.login.failed" | stats count by src_ip | sort -count

  • Most targeted usernames and passwords:

    index="cowrie" eventid="cowrie.login.failed" | stats count by username, password | sort -count

  • Commands executed by successful logins:

    index="cowrie" eventid="cowrie.command.input" | table _time, src_ip, input

  • File downloads (potential malware staging):

    index="cowrie" eventid="cowrie.session.file_download" | table _time, src_ip, url, outfile

What Undercode Say:

  • Deception is a force multiplier – A well-placed honeypot doesn’t just detect attacks; it actively shapes the adversary’s perception, forcing them to reveal their tools, techniques, and objectives while believing they have the upper hand. This intelligence gap is invaluable for proactive defense.

  • Low-cost infrastructure delivers enterprise-grade insights – The combination of a $15 Raspberry Pi Zero, open-source Cowrie, and Wazuh SIEM demonstrates that effective threat intelligence collection is no longer the exclusive domain of well-funded security teams. This democratization of security tools empowers students, researchers, and small teams to build production-grade detection capabilities.

  • Logs are raw data; context is intelligence – Simply collecting logs is insufficient. The real value emerges from correlation, enrichment, and human analysis. The attacker’s SSH key injection attempt—disguised as a benign file download event—highlights the critical need for context-aware alerting and thorough investigation rather than blind reliance on automated labels.

  • Automation bridges the gap between detection and response – Integrating the honeypot with Wazuh and custom rules enables automated alerting and, with further development, automated response actions. This transforms the honeypot from a passive sensor into an active component of a security operations center.

  • Hands-on projects accelerate cybersecurity learning – Building and operating a honeypot from scratch provides experiential learning that textbooks cannot replicate. Understanding attacker behavior through real-world data—not just simulated exercises—develops the intuition essential for both offensive and defensive roles.

Prediction:

  • +1 The proliferation of low-cost, portable honeypots like the Raspberry Pi Zero USB gadget will accelerate the decentralization of threat intelligence, enabling organizations of all sizes to deploy distributed sensor networks that capture regional and industry-specific attack patterns previously invisible to centralized threat feeds.

  • +1 AI-powered log analysis and automated threat hunting will become standard extensions of honeypot deployments. Local LLMs integrated with SIEM platforms will provide real-time attack summarization, reducing analyst fatigue and enabling faster incident response.

  • -1 As honeypots become more widespread, attackers will increasingly adapt by developing fingerprinting techniques to detect emulated environments, potentially leading to an arms race where deception technologies must continuously evolve to maintain effectiveness.

  • -1 The ease of deployment may lead to careless exposure of poorly configured honeypots that inadvertently become genuine attack vectors if not properly isolated, emphasizing the need for rigorous network segmentation and regular security reviews of honeypot infrastructure.

  • +1 Educational institutions and cybersecurity bootcamps will increasingly adopt honeypot labs as core pedagogical tools, bridging the gap between theoretical knowledge and practical threat intelligence, ultimately producing more job-ready graduates.

  • +1 The integration of honeypots with SOAR (Security Orchestration, Automation, and Response) platforms will enable automated threat blocking and indicator sharing across organizations, transforming individual honeypot deployments into nodes of a global early-warning system.

▶️ Related Video (78% Match):

https://www.youtube.com/watch?v=-P2dN1GSKz0

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Romain Zhang – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: