by Adam Cann, SANS.edu BACS Student (Version: 1) [This is a Guest Diary by Adam Cann, an ISC intern as part of the SANS.edu BACS program] Introduction Most of what an internet-facing SSH honeypot records is noise. Endless password guessing, and bots that log in, immediately pull down a payload, and move on. On 27 June 2026 my honeypot caught something quieter, and to me more interesting. A bot logged in as root, ran a careful survey of the machine's hardware, and then disconnected without downloading or running anything at all. No malware, no persistence, no second stage. At first glance that looks like a failed or pointless attack. It is not. The bot was doing something deliberate: grading the target before deciding whether to send a payload on it. This post walks through what it…