Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates. Use when SOC teams need early warning of lateral movement, credential abuse, or internal reconnaissance by deploying convincing traps across the network.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
Instruções da origem · Visualização somente leitura
name
performing-deception-technology-deployment
description
Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates. Use when SOC teams need early warning of lateral movement, credential abuse, or internal reconnaissance by deploying convincing traps across the network.
SOC teams need high-fidelity detection of post-compromise lateral movement with near-zero false positives
Existing detection tools miss advanced attackers who avoid triggering threshold-based alerts
The organization wants to detect credential abuse by planting fake credentials as honeytokens
Network segmentation gaps need compensating detection controls
Do not use as a replacement for fundamental security controls (patching, EDR, network segmentation) — deception is a detection layer, not a prevention mechanism.
Common Misconfigurations & Verification
Decoy too obvious: hostnames like HONEYPOT01, sequential MACs, default Canary banners, or a "server" with zero historical traffic scream fake to any attacker doing recon. Name decoys to match your real scheme (FILESERVER-BK04), register them in DNS/AD, and seed light background traffic so they appear in scans as legitimate hosts.
Decoy never touched (no breadcrumbs): a honeypot nobody can find never fires. Without planted breadcrumbs — cached creds via cmdkey, .aws/credentials keys, bookmarks, mapped-drive entries — attackers never pivot to it. Verify each decoy has at least one breadcrumb on a real reachable host pointing to it.
Honeytoken collides with real use: a honeytoken account included in real logon scripts, GPO, or backup jobs, or one that password-expires, generates constant "critical" false alerts and destroys the zero-FP premise. Confirm 4624/4625/4768/4769 for TargetUserName shows zero events during a baseline window before going live.
Alert path broken: Canary alert_webhook unreachable, SIEM not ingesting index=canary, or auto-isolate SOAR action wired to the wrong asset means a trip produces no response. Verify the full chain works.
Verify by running a controlled trip: from an authorized test host, touch each decoy (SMB read of the canary file, login attempt to the honeytoken, use the AWS token) and confirm a high-fidelity alert reaches the SIEM and the SOAR isolate/block fires on the correct source — then re-baseline so the test itself isn't mistaken for an intrusion.
Prerequisites
Network segments identified for honeypot/decoy deployment (server VLANs, DMZ, OT networks)
Deception platform (Thinkst Canary, Attivo/SentinelOne Hologram, or open-source alternatives)
SIEM integration for deception alerts (any interaction with deception assets is suspicious)
Active Directory access for honeytoken account and credential creation
Network team coordination for IP allocation and traffic routing
Workflow
Step 1: Map Attack Surface for Deception Placement
Identify high-value network segments where attackers would traverse:
DECEPTION DEPLOYMENT MAP
━━━━━━━━━━━━━━━━━━━━━━━━
Segment Decoy Type Rationale
Server VLAN Fake file server Attackers enumerate SMB shares during recon
Database VLAN Fake DB server SQL scanning detected in past incidents
AD/DC Segment Honeytoken account Credential theft detection
Executive Subnet Fake workstation Targeted attacks pivot through exec systems
DMZ Honeypot web app External attacker detection
OT Network Fake PLC/HMI Industrial threat detection
Cloud (AWS VPC) Canary EC2 + S3 Cloud lateral movement detection
Step 2: Deploy Thinkst Canary Devices
Configure Canary devices mimicking real infrastructure:
