<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-network-deception
description: >-
  Deploy network deception technologies including honeypots, honeynets, decoy services,
  breadcrumbs, and canary tokens to detect lateral movement, reconnaissance, and
  unauthorized access using tools like OpenCanary, Artillery, and custom Zeek scripts.
domain: cybersecurity
subdomain: network-security
tags:
  - honeypot
  - deception
  - canary
  - honeynet
  - detection
  - lateral-movement
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1046", "T1021", "T1570"]
  nist-csf: ["DE.CM-1", "DE.CM-7", "DE.AE-2"]
  uuid: a1b2c3d4-1007-4a00-b007-f00d00000007
---

# Implementing Network Deception

## Overview

Network deception creates fake services, credentials, and network artifacts that legitimate
users never access. Any interaction with deception assets is a high-fidelity indicator of
compromise or unauthorized reconnaissance. This skill covers honeypot deployment, decoy
service configuration, canary token placement, breadcrumb trails, and integration with
detection pipelines.

Mode: `[MODE: BLUE]` for deployment; `[MODE: PURPLE]` for coverage validation.

## Prerequisites

| Requirement | Details |
|---|---|
| OpenCanary for lightweight honeypot deployment | Required |
| Dedicated VLAN or IP space for deception assets | Required |
| Zeek/Suricata for monitoring interactions | Required |
| SIEM integration for high-priority alerting | Required |
| Canary token generation service (canarytokens.org or self-hosted) | Required |

## Key Concepts

### OpenCanary Honeypot Deployment

```bash
# Install OpenCanary
pip install opencanary

# Generate config
opencanaryd --copyconfig

# Configure services in /etc/opencanaryd/opencanary.conf
cat > /etc/opencanaryd/opencanary.conf << 'CONF'
{
    "device.node_id": "honeypot-dmz-01",
    "server.ip": "0.0.0.0",
    "ssh.enabled": true,
    "ssh.port": 22,
    "ssh.version": "SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u2",
    "http.enabled": true,
    "http.port": 80,
    "http.banner": "Apache/2.4.41 (Ubuntu)",
    "http.skin": "nasLogin",
    "smb.enabled": true,
    "smb.filelist": [{"name": "Confidential", "type": "r"}],
    "ftp.enabled": true,
    "ftp.port": 21,
    "ftp.banner": "FTP server ready",
    "rdp.enabled": true,
    "rdp.port": 3389,
    "logger": {
        "class": "PyLogger",
        "kwargs": {
            "formatters": {"plain": {"format": "%(message)s"}},
            "handlers": {
                "file": {"class": "logging.FileHandler",
                         "filename": "/var/log/opencanary/alerts.json"}
            }
        }
    }
}
CONF

# Start honeypot
opencanaryd --start
```

### Suricata Rules for Deception Network

```
# Any traffic TO honeypot subnet is suspicious
alert ip any any -> $HONEYPOT_NET any ( \
  msg:"DECEPTION - traffic to honeypot network detected"; \
  flow:to_server; \
  threshold:type limit, track by_src, count 1, seconds 60; \
  classtype:attempted-recon; \
  sid:3001050; rev:1; \
  metadata:mitre_attack_technique T1046;)

# SSH brute force against honeypot
alert tcp any any -> $HONEYPOT_NET 22 ( \
  msg:"DECEPTION - SSH connection to honeypot"; \
  flow:to_server,established; \
  content:"SSH"; \
  sid:3001051; rev:1;)

# SMB enumeration of honeypot shares
alert tcp any any -> $HONEYPOT_NET 445 ( \
  msg:"DECEPTION - SMB access to honeypot share"; \
  flow:to_server,established; \
  sid:3001052; rev:1;)
```

### Zeek Deception Monitoring

```zeek
# deception-monitor.zeek — alert on any connection to deception assets
@load base/frameworks/notice

module Deception;

export {
    redef enum Notice::Type += {
        Honeypot_Connection,
        Decoy_Credential_Used,
    };
    const honeypot_hosts: set[addr] = { 10.99.0.10, 10.99.0.11, 10.99.0.12 } &redef;
}

event connection_established(c: connection) {
    if ( c$id$resp_h in honeypot_hosts ) {
        NOTICE([$note=Honeypot_Connection,
                $msg=fmt("Connection to honeypot %s:%s from %s",
                         c$id$resp_h, c$id$resp_p, c$id$orig_h),
                $conn=c,
                $identifier=cat(c$id$orig_h)]);
    }
}
```

### DNS Canary Tokens

```bash
# Create DNS canary — any resolution triggers alert
# Use nmap to verify deception infrastructure is visible
nmap -sV -p 22,80,445,3389 10.99.0.10

# Monitor canary hits
tail -f /var/log/opencanary/alerts.json | jq '.logdata'
```

## Workflow

### Step 1: Design Deception Architecture

Place honeypots in each network segment. Match services to real infrastructure.

### Step 2: Deploy Deception Assets

Configure honeypots with realistic banners and services.

### Step 3: Plant Breadcrumbs

Place decoy credentials, files, and DNS entries pointing to deception assets.

### Step 4: Integrate Alerting

Route all deception alerts to high-priority SIEM channel.

### Step 5: Validate Coverage

Test that scanning and lateral movement triggers deception alerts.

## Detection

```yaml
title: Network Deception Detection
id: ac36354e-f521-4128-861f-65f0b5df7a65
status: experimental
description: Detects suspicious activity related to implementing network deception techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1046
  - attack.t1021
  - attack.t1570
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Network Deception Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1046, T1021, T1570 |

## Verification

- [ ] Honeypots respond realistically to service enumeration
- [ ] Any connection to honeypot generates immediate alert
- [ ] Canary tokens trigger on access
- [ ] Breadcrumb credentials point to monitored honeypots
- [ ] Alerts routed as high-priority to SOC
- [ ] No legitimate traffic reaches deception assets

## References

- [OpenCanary Documentation](https://opencanary.readthedocs.io/)
- MITRE ATT&CK — D3FEND Deception Techniques
- MITRE Engage — Adversary Engagement Framework
- CIS Controls v8 — Control 13: Network Monitoring and Defense
