About

Imported from Singtreb/Sword-Riding (internal/tools/skills/data/deception-technology/implementing-deception-based-detection-with-canarytoken/SKILL.md). Install upstream with npx skills add Singtreb/Sword-Riding --skill implementing-deception-based-detection-with-canarytoken. Copyright stays with the author (Apache-2.0).

Implementing Deception-Based Detection with Canarytoken

Name: implementing-deception-based-detection-with-canarytoken
Author: Singtreb

Overview

Canary Tokens are lightweight tripwire mechanisms that alert when an attacker accesses a resource. This skill uses the Thinkst Canary REST API to programmatically create tokens (web bugs, DNS tokens, MS Word documents, AWS API keys), deploy them to strategic locations, monitor for triggered alerts, and generate deception coverage reports.

When to Use

When deploying or configuring implementing deception based detection with canarytoken capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Common Misconfigurations & Verification

Canarytokens fail when they are placed where no attacker will look, or when the trigger path is broken so the alert never reaches anyone:

Token too obvious or mislabeled: a file named passwords_REAL.docx on the desktop screams trap. Name tokens to match genuine bait (AWS_prod_keys.txt, VPN-config-backup) and seed them where lateral movement actually lands - file shares, .aws/credentials, browser history, config repos.
DNS/HTTP egress blocked: DNS tokens never fire if internal resolvers can't reach the canarytokens domain, and web-bug tokens die behind an egress-filtering proxy. Verify the token's callback path resolves from the segment where it is deployed.
AWS key token without CloudTrail context: the token alerts on use, but confirm the alerting channel (Console/webhook) is actually monitored.
Document tokens stripped: DLP or Office sanitizers can remove the embedded web bug; confirm the token survives the document's real storage path.
How to confirm a hit: trip each token yourself - open the Word doc, resolve the DNS hostname, curl the web bug, run aws sts get-caller-identity with the decoy key - and verify the alert lands in the console and downstream channel with correct source attribution.

Prerequisites

Thinkst Canary Console or canarytokens.org account
API auth token from Canary Console
Python 3.9+ with requests
File system access for deploying document and file tokens

Steps

Authenticate to the Canary Console API using auth_token
Create web bug (HTTP) tokens for embedding in documents and web pages
Create DNS tokens for monitoring DNS resolution attempts
Create MS Word document tokens for file share deployment
List all active tokens and their trigger history
Query recent alerts for triggered token events
Generate deception coverage report with deployment recommendations

Expected Output

JSON report listing all deployed Canary Tokens, trigger history, alert details, and coverage analysis
Deployment map showing token types across network segments

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/singtreb-sword-riding-implementing-deception-based-detec-8cf0d2/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

singtreb-sword-riding-implementing-deception-based-detec-8cf0d2.ocm.jsonjson

{
  "ocm": "1",
  "id": "singtreb-sword-riding-implementing-deception-based-detec-8cf0d2",
  "kind": "skill",
  "name": "implementing-deception-based-detection-with-canarytoken",
  "description": "Deploy and monitor Canary Tokens via the Thinkst Canary API for deception-based breach detection using web bug tokens, DNS tokens, document tokens, and AWS key tokens.",
  "publisher": "Singtreb",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "canarytoken",
      "deception",
      "honeytokens",
      "breach-detection",
      "thinkst-canary",
      "tripwire",
      "early-warning",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Deploy and monitor Canary Tokens via the Thinkst Canary API for deception-based breach detection using web bug tokens, DNS tokens, document tokens, and AWS key tokens."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/Singtreb/Sword-Riding",
      "path": "internal/tools/skills/data/deception-technology/implementing-deception-based-detection-with-canarytoken/SKILL.md",
      "ref": "d377c9f69fc4dc195dbed5065a7c4ab6adb1ae9a",
      "url": "https://github.com/Singtreb/Sword-Riding/blob/d377c9f69fc4dc195dbed5065a7c4ab6adb1ae9a/internal/tools/skills/data/deception-technology/implementing-deception-based-detection-with-canarytoken/SKILL.md",
      "key": "Singtreb/Sword-Riding/internal/tools/skills/data/deception-technology/implementing-deception-based-detection-with-canarytoken/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Implementing Deception-Based Detection with Canarytoken\n\n## Overview\n\nCanary Tokens are lightweight tripwire mechanisms that alert when an attacker accesses a resource. This skill uses the Thinkst Canary REST API to programmatically create tokens (web bugs, DNS tokens, MS Word documents, AWS API keys), deploy them to strategic locations, monitor for triggered alerts, and generate deception coverage reports.\n\n\n## When to Use\n\n- When deploying or configuring implementing deception based detection with canarytoken capabilities in your environment\n- When establishing security controls aligned to",
  "cost": {
    "context_tokens": 727
  }
}

Fetch it by URL: GET /api/v1/registry/singtreb-sword-riding-implementing-deception-based-detec-8cf0d2/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.