[This is a Guest Diary by Matthew Presnal, an ISC intern as part of the SANS.edu BACS program] Cryptojacking and botnets can pose a greater threat than a simple drain of resources. These organizations have been known to engage in “DDoS for Hire” or even selling off footholds, acting as Initial Access Brokers (IABs). To better understand how to get ahead of the adversary, I am going to walk you through the real-world attacks observed on my DShield honeypot and attempt to better predict their next steps. Early Recognition As we know from a certain company's model for stopping attacks (I'll let you fill in the blanks), the earlier you are able to break the chain, the better the outcome. While the ideal situation is to have impenetrable defenses, thus making it so you have nothing to worry…