In this project, I built a simple honeynet in Microsoft Azure to see what happens when a machine is exposed to the internet.
I created a Windows virtual machine, opened it up to incoming traffic, and used Microsoft Sentinel to monitor and analyze real attack activity (mainly RDP brute-force attempts).
- Microsoft Azure (VMs, Networking)
- Microsoft Sentinel
- Log Analytics Workspace
- Windows Event Logs
- KQL (Kusto Query Language)
The setup includes:
- A Windows VM exposed to the internet
- Logs sent to Log Analytics
- Microsoft Sentinel for monitoring
- GeoIP mapping to visualize attacker locations
- Created a resource group and virtual network in Azure
- Deployed a Windows VM with a public IP
- Opened RDP (port 3389) to allow inbound traffic named= "DANGER-ANYTRAFFIC"
- Left the VM exposed on purpose (Disabled Firewall)
- Allowed anyone on the internet to attempt login
- This attracted real-world attack traffic
- Connected the VM to Log Analytics
- Enabled Windows Security logs
- Focused (filtered) on failed login attempts (Event ID 4625)
- Connected Log Analytics to Microsoft Sentinel
- Wrote simple KQL queries to find:
- Failed login attempts
- Repeated login attempts from the same IP
- Identified clear brute-force behavior
- Used GeoIP data to map attacker locations
- Built a workbook to show:
- Where attacks were coming from
- How often they were happening
- The VM started getting attacked About 2 hours after being exposed, and inceased as time goes on
- Most activity was repeated failed RDP logins
- Many attempts came from the same IPs (likely automated)
- Exposed systems get targeted very quickly
- Logs are critical for understanding what’s happening
- SIEM tools like Sentinel make it much easier to detect patterns
- Even simple setups can show real attack behavior
- Setting up a SIEM (Microsoft Sentinel)
- Analyzing logs using KQL
- Detecting brute-force attacks
- Working with Azure cloud services
- Visualizing security data