Goal: To identify and gather information about attackers attempting to brute force SSH credentials.
Approach: Monitoring connections to the deceptive SSH server and analyzing attacker behavior.
This element involves creating fake cron jobs that mimic legitimate tasks but trigger alerts or execute harmless commands.
Attackers who attempt to modify or utilize cron jobs for malicious purposes will trigger alerts, revealing their presence and intentions.