← LeaderboardThe Skill Leaderboard

implementing-network-deception-with-honeypots

Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.

Published by mukul975 ↗mukul975/Anthropic-Cybersecurity-Skills

Try your first task

implementing-network-deception-with-honeypots

Start a fresh conversation. Replace the highlighted placeholders.

Use implementing-network-deception-with-honeypots to implementing-network-deception-with-honeypots to design a honeypot deployment and alerting plan for [network segment, available dedicated host, intended services, and SIEM destination], then stop for my final confirmation before deploying, changing firewall or VLAN settings, or forwarding alerts.

Required inputs

  • [network segment, available dedicated host, intended services, and SIEM destination]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: implementing-network-deception-with-honeypotsdescription: Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie  to detect unauthorized access, lateral movement, and attacker reconnaissance.domain: cybersecuritysubdomain: deception-technologytags: - deception- honeypot- opencanary- cowrie- t-pot- detection- lateral-movement- network-securityversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - DE.CM-01- DE.AE-06- PR.IR-01mitre_attack: - T1078- T1190- T1059- T1021- T1550

Implementing Network Deception with Honeypots

When to Use

  • When deploying deception technology to detect lateral movement
  • To create early warning indicators for network intrusion
  • During security architecture design to add detection depth
  • When monitoring for unauthorized internal scanning or credential theft
  • To gather threat intelligence on attacker techniques and tools

Prerequisites

  • Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)
  • Python 3.8+ with pip for OpenCanary installation
  • Docker for T-Pot or containerized deployment
  • Network segment with appropriate VLAN configuration
  • SIEM integration for alert forwarding (syslog, webhook, or file-based)
  • Firewall rules allowing inbound connections to honeypot services

Workflow

  1. Plan Deployment: Select honeypot types and network placement strategy.
  2. Install Honeypot: Deploy OpenCanary, Cowrie, or T-Pot on dedicated host.
  3. Configure Services: Enable emulated services (SSH, HTTP, SMB, FTP, RDP).
  4. Set Up Alerting: Configure log forwarding to SIEM and alert channels.
  5. Deploy Canary Tokens: Place credential files, shares, and DNS entries.
  6. Monitor Interactions: Analyze honeypot logs for attacker activity.
  7. Tune and Maintain: Update configurations based on detection results.

Key Concepts

ConceptDescription
OpenCanaryLightweight Python honeypot with modular service emulation
CowrieMedium-interaction SSH/Telnet honeypot capturing commands
T-PotMulti-honeypot platform with ELK stack visualization
Canary TokenTripwire credential or file that alerts when accessed
Low-InteractionEmulates services at protocol level without full OS
High-InteractionFull OS honeypot capturing complete attacker sessions

Tools & Systems

ToolPurpose
OpenCanaryModular honeypot daemon with service emulation
CowrieSSH/Telnet honeypot with session recording
T-PotAll-in-one multi-honeypot platform
DionaeaMalware-capturing honeypot for exploit detection
Splunk/ElasticSIEM for honeypot alert aggregation

Output Format

Alert: HONEYPOT-[SERVICE]-[DATE]-[SEQ]
Honeypot: [Hostname/IP]
Service: [SSH/HTTP/SMB/FTP/RDP]
Source IP: [Attacker IP]
Interaction: [Login attempt/Port scan/File access]
Credentials Used: [Username:Password if applicable]
Commands Executed: [For SSH honeypots]
Risk Level: [Critical/High/Medium/Low]