performing-deception-technology-deployment

name	performing-deception-technology-deployment
description	Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates. Use when SOC teams need early warning of lateral movement, credential abuse, or internal reconnaissance by deploying convincing traps across the network.
domain	cybersecurity
subdomain	soc-operations
tags	["soc","deception","honeypot","honeytoken","canary","lateral-movement","detection"]
version	1.0
author	mahipal
license	Apache-2.0

Performing Deception Technology Deployment

When to Use

Use this skill when:

• SOC teams need high-fidelity detection of post-compromise lateral movement with near-zero false positives
• Existing detection tools miss advanced attackers who avoid triggering threshold-based alerts
• The organization wants to detect credential abuse by planting fake credentials as honeytokens
• Network segmentation gaps need compensating detection controls

Do not use as a replacement for fundamental security controls (patching, EDR, network segmentation) — deception is a detection layer, not a prevention mechanism.

Prerequisites

• Network segments identified for honeypot/decoy deployment (server VLANs, DMZ, OT networks)
• Deception platform (Thinkst Canary, Attivo/SentinelOne Hologram, or open-source alternatives)
• SIEM integration for deception alerts (any interaction with deception assets is suspicious)
• Active Directory access for honeytoken account and credential creation
• Network team coordination for IP allocation and traffic routing

Workflow

Step 1: Map Attack Surface for Deception Placement

Identify high-value network segments where attackers would traverse:

DECEPTION DEPLOYMENT MAP
━━━━━━━━━━━━━━━━━━━━━━━━
Segment              Decoy Type          Rationale
Server VLAN          Fake file server    Attackers enumerate SMB shares during recon
Database VLAN        Fake DB server      SQL scanning detected in past incidents
AD/DC Segment        Honeytoken account  Credential theft detection
Executive Subnet     Fake workstation    Targeted attacks pivot through exec systems
DMZ                  Honeypot web app    External attacker detection
OT Network           Fake PLC/HMI        Industrial threat detection
Cloud (AWS VPC)      Canary EC2 + S3     Cloud lateral movement detection

Step 2: Deploy Thinkst Canary Devices

Configure Canary devices mimicking real infrastructure:

Windows File Server Canary:

{
  "device_name": "FILESERVER-BK04",
  "personality": "windows-server-2019",
  "services": {
    "smb"