Deploy a Honeypot VM

Create the Honeypot VM

Go to Azure Portal > Create a resource

Choose Virtual Machine

Configure:

  • Image: Ubuntu LTS (20.04 or later)
  • Size: B1s (low-cost)
  • Authentication: Use SSH or password
  • Public IP: Yes (we want it visible)
  • NSG (Firewall):
    • Open custom ports like: 22, 23, 445, 3389, 8080, 3306
    • Purpose: attract potential scans and brute-force attempts

Security Note: This VM must not be used for production—it’s intentionally vulnerable.

Install Honeypot Software

Install Dionaea (Malware capture honeypot)

Check configuration at /etc/dionaea/dionaea.conf

It listens on multiple ports (80, 443, 445, 1433, 3306, etc.) and captures binaries.

Enable Logging and Monitoring
tail -f /var/log/dionaea/dionaea.log

You can also send logs to Azure Monitor

Go to Log Analytics Workspace in Azure

Create a new workspace

In the VM panel, go to Monitoring > Insights

Enable Diagnostics settings and connect it to your workspace

Now your VM logs (including syslog and custom logs if configured) will be streamed to Azure Monitor.

Add NSG Logging

Go to Network Security Group linked to the VM

Under Diagnostic settings, enable NSG flow logs (v2)

Send logs to:

  • Log Analytics
  • Storage Account
  • Event Hub (if using SIEM)

You can now track all traffic hitting your honeypot, even if it's blocked.

Analyze Attacks

Using KQL in Log Analytics, run queries like:

AzureNetworkAnalytics_CL
| where Direction_s == "Inbound"
| summarize count() by DestinationPort_s, RemoteIP_s

This tells you which IPs are trying to connect to suspicious ports.

Final Warnings

Use a low-cost VM (B1s or spot instance) with budget limits

Lock down your actual SSH access with IP restrictions (or better: use Bastion)

Clean up the VM when done to avoid charges