implementing-network-deception-with-honeypots
$
npx mdskill add mukul975/Anthropic-Cybersecurity-Skills/implementing-network-deception-with-honeypotsDeploy deception tools to catch intruders and map attacker tactics.
- Detects unauthorized access and lateral movement attempts in real time.
- Integrates with OpenCanary, T-Pot, Cowrie, and SIEM alerting systems.
- Analyzes attacker behavior patterns to recommend specific honeypot configurations.
- Generates detailed threat intelligence reports on reconnaissance and exploitation methods.
SKILL.md
.github/skills/implementing-network-deception-with-honeypotsView on GitHub ↗
--- name: implementing-network-deception-with-honeypots description: Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance. domain: cybersecurity subdomain: deception-technology tags: [deception, honeypot, opencanary, cowrie, t-pot, detection, lateral-movement, network-security] version: "1.0" author: mahipal license: Apache-2.0 --- # Implementing Network Deception with Honeypots ## When to Use - When deploying deception technology to detect lateral movement - To create early warning indicators for network intrusion - During security architecture design to add detection depth - When monitoring for unauthorized internal scanning or credential theft - To gather threat intelligence on attacker techniques and tools ## Prerequisites - Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended) - Python 3.8+ with pip for OpenCanary installation - Docker for T-Pot or containerized deployment - Network segment with appropriate VLAN configuration - SIEM integration for alert forwarding (syslog, webhook, or file-based) - Firewall rules allowing inbound connections to honeypot services ## Workflow 1. **Plan Deployment**: Select honeypot types and network placement strategy. 2. **Install Honeypot**: Deploy OpenCanary, Cowrie, or T-Pot on dedicated host. 3. **Configure Services**: Enable emulated services (SSH, HTTP, SMB, FTP, RDP). 4. **Set Up Alerting**: Configure log forwarding to SIEM and alert channels. 5. **Deploy Canary Tokens**: Place credential files, shares, and DNS entries. 6. **Monitor Interactions**: Analyze honeypot logs for attacker activity. 7. **Tune and Maintain**: Update configurations based on detection results. ## Key Concepts | Concept | Description | |---------|-------------| | OpenCanary | Lightweight Python honeypot with modular service emulation | | Cowrie | Medium-interaction SSH/Telnet honeypot capturing commands | | T-Pot | Multi-honeypot platform with ELK stack visualization | | Canary Token | Tripwire credential or file that alerts when accessed | | Low-Interaction | Emulates services at protocol level without full OS | | High-Interaction | Full OS honeypot capturing complete attacker sessions | ## Tools & Systems | Tool | Purpose | |------|---------| | OpenCanary | Modular honeypot daemon with service emulation | | Cowrie | SSH/Telnet honeypot with session recording | | T-Pot | All-in-one multi-honeypot platform | | Dionaea | Malware-capturing honeypot for exploit detection | | Splunk/Elastic | SIEM for honeypot alert aggregation | ## Output Format ``` Alert: HONEYPOT-[SERVICE]-[DATE]-[SEQ] Honeypot: [Hostname/IP] Service: [SSH/HTTP/SMB/FTP/RDP] Source IP: [Attacker IP] Interaction: [Login attempt/Port scan/File access] Credentials Used: [Username:Password if applicable] Commands Executed: [For SSH honeypots] Risk Level: [Critical/High/Medium/Low] ```