We have talked about the attack chain and the path attackers take.
Unless we're dealing with script kiddies who are just throwing the
kitchen sink at you fast and furious, a well‑seasoned hacker is going
to slowly and, more importantly, quietly recon the environment.
This will start with actions like using tools like Nmap to enumerate
the services and ports on the systems available, so we combat ports
scanning with honeyport techniques.
The original script that I have since forked can be
found on Greg Foss' GitHub account.
You can use this script directly, but I will caution it is a
few years old and is built with Windows PowerShell, which is
fine, but it will need some tweaking.
My forked version can be found in the exercise files of this course.
Now among the minor updates,
I changed two important items in order to make the script work
for PowerShell 7. First, I imported the
Microsoft.PowerShell.Management module, which will allow me to
use the Write‑EventLog function throughout the script.
There are new functions in PowerShell 7 for this, but it is easier to
just add this one line of code for the import for now.
I also need to replace the deprecated Get‑WmiObject function. As you see
in the original script, these calls are peppered throughout the script
for capturing the IP address of the machine performing the scan. By
simply updating these to the supported Get‑CimInstance function, you
don't lose any functionality.
WMI are always based on the Common Information Model, or CIM,
so really it is a one‑for‑one switch here.
Okay,
so I'll be running on the Windows desktop virtual machine
I want to monitor port scanning for.
I have my PowerShell 7 interface open, and I'm navigating to the folder
that the scripts are stored in here, on the C drive.
I also have opened off screen on my host machine a copy of
Nmap that I will use to scan a few ports on my VM to generate
the traffic I am looking for here.
I will drop a link on the screen here below with where
you can go and get that Nmap tool.
I'm running it off a Windows Nmap application, but really any
tool you have that will connect and enumerate ports on this
system should generate the desired traffic.
When I kick off this tool, I can drop the parameters for the ports I
want to open, but if I leave the parameters empty,
it will prompt me for them. For this demo, I am opening just port 21, an FTP
port. If I hit Enter again on the blank port parameter,
it will continue to kick off the script.
Now, one important note here. This script basically cycles,
waits for a minute,
then processes any open request and loops through that cycle again.
If upon one of those cycles, as you see here,
it sees there's a stop.txt file in the home folder of
the script, it kills the run process.
So for now, I place an x‑ and the name that I can quickly
edit when I'm ready to kill the script.
Okay, I now have the script up.
I am also going to open the Event Viewer, and under the
Applications I have the HoneyPort log.
If you have not ran the script up to this point yet,
it is okay if you don't see this. The script will create it for you.
It is the reason back here on the execution results it shows that
the HoneyPort Event‑type already exists for me. In the Event
Viewer, a 1001 event is starting the script.
I'm now going to kick off the scan here offscreen, and I should see in
a second or two a few of the 1002 events of it actually capturing the
port scan. Okay, for now I can kill the script and stop the service
running by updating that file name, as you see here in the code on
line 158 through 165.
It looks like it will look for that stop file and send me a final
event of 1003 to signify the end of the script.
Okay,
so a couple of notes on this. You'll want to pull these logs into a central
aggregator, SIEM, or ERD/MDR/XDR service, and you'll be looking for two
event IDs, 1003, that the listener has closed.
You want to make sure that there is a subsequent 1001,
that it started back up again.
And you're also going to look for 1002 as the actual events
of the actual port scan being detected.
Now one thing I will say, this can get noisy,
especially in a work‑from‑home environment. I have had countless false
positives at the desktop level from home networking equipment. You maybe better
running this on one specific server or honeypot servers.