Imported from mukul975/anthropic-cybersecurity-skills (skills/implementing-network-deception-with-honeypots/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill implementing-network-deception-with-honeypots. Copyright stays with the author (Apache-2.0).

Implementing Network Deception with Honeypots

Name: implementing-network-deception-with-honeypots
Author: mukul975

When to Use

When deploying deception technology to detect lateral movement
To create early warning indicators for network intrusion
During security architecture design to add detection depth
When monitoring for unauthorized internal scanning or credential theft
To gather threat intelligence on attacker techniques and tools

Prerequisites

Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)
Python 3.8+ with pip for OpenCanary installation
Docker for T-Pot or containerized deployment
Network segment with appropriate VLAN configuration
SIEM integration for alert forwarding (syslog, webhook, or file-based)
Firewall rules allowing inbound connections to honeypot services

Workflow

Plan Deployment: Select honeypot types and network placement strategy.
Install Honeypot: Deploy OpenCanary, Cowrie, or T-Pot on dedicated host.
Configure Services: Enable emulated services (SSH, HTTP, SMB, FTP, RDP).
Set Up Alerting: Configure log forwarding to SIEM and alert channels.
Deploy Canary Tokens: Place credential files, shares, and DNS entries.
Monitor Interactions: Analyze honeypot logs for attacker activity.
Tune and Maintain: Update configurations based on detection results.

Key Concepts

Concept	Description
OpenCanary	Lightweight Python honeypot with modular service emulation
Cowrie	Medium-interaction SSH/Telnet honeypot capturing commands
T-Pot	Multi-honeypot platform with ELK stack visualization
Canary Token	Tripwire credential or file that alerts when accessed
Low-Interaction	Emulates services at protocol level without full OS
High-Interaction	Full OS honeypot capturing complete attacker sessions

Tools & Systems

Tool	Purpose
OpenCanary	Modular honeypot daemon with service emulation
Cowrie	SSH/Telnet honeypot with session recording
T-Pot	All-in-one multi-honeypot platform
Dionaea	Malware-capturing honeypot for exploit detection
Splunk/Elastic	SIEM for honeypot alert aggregation

Output Format

Alert: HONEYPOT-[SERVICE]-[DATE]-[SEQ]
Honeypot: [Hostname/IP]
Service: [SSH/HTTP/SMB/FTP/RDP]
Source IP: [Attacker IP]
Interaction: [Login attempt/Port scan/File access]
Credentials Used: [Username:Password if applicable]
Commands Executed: [For SSH honeypots]
Risk Level: [Critical/High/Medium/Low]

{ "ocm": "1", "id": "mukul975-anthropic-cybersecurity-skills-implementing-net-780e17", "kind": "skill", "name": "implementing-network-deception-with-honeypots", "description": "Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.", "publisher": "mukul975", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "deception", "honeypot", "opencanary", "cowrie", "t-pot", "detection", "lateral-movement", "network-security", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills", "path": "skills/implementing-network-deception-with-honeypots/SKILL.md", "ref": "HEAD", "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/implementing-network-deception-with-honeypots/SKILL.md", "key": "mukul975/anthropic-cybersecurity-skills/skills/implementing-network-deception-with-honeypots/SKILL.md" }, "license": "Apache-2.0" }, "instructions": "# Implementing Network Deception with Honeypots\n\n## When to Use\n\n- When deploying deception technology to detect lateral movement\n- To create early warning indicators for network intrusion\n- During security architecture design to add detection depth\n- When monitoring for unauthorized internal scanning or credential theft\n- To gather threat intelligence on attacker techniques and tools\n\n## Prerequisites\n\n- Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)\n- Python 3.8+ with pip for OpenCanary installation\n- Docker for T-Pot or containerized deployment\n- Network segment with", "cost": { "context_tokens": 627 } }

implementing-network-deception-with-honeypots

About

Implementing Network Deception with Honeypots

When to Use

Prerequisites

Workflow

Key Concepts

Tools & Systems

Output Format

Use it

Manifest

Reviews