Delilah

Delilah is a honeypot system designed to mimic vulnerable Elasticsearch instances and attract attackers exploiting the CVE-2015-1427 Groovy vulnerability. It detects attack commands, reconnaissance attempts, and download commands (like wget and curl), while attempting to download malicious files for later analysis. The system sends real-time email notifications to analysts upon detecting attacks.

Key Features

• Attack Detection — Identifies exploit attempts, recon commands, and malicious downloads targeting Elasticsearch vulnerabilities.
• File Retrieval — Attempts to download files attackers try to introduce on victim systems for forensic analysis.
• Real-time Alerts — Sends email notifications to configured addresses when attacks are detected.
• Configurable Deception — Offers adjustable parameters to mimic real Elasticsearch instances and avoid easy detection.
• Sensor Network Support — Multiple Delilah nodes can be deployed as a distributed sensor network.
• Web Monitoring Interface — Delilah Monitor provides a simple web interface to view chronological events across all sensors.

Philosophy

Delilah is built to provide security analysts with actionable intelligence on active threats by safely emulating vulnerable systems and capturing attacker behavior in detail.