<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-honeypot-deployment
description: >-
  Deploy and manage honeypot infrastructure for intrusion detection and threat
  intelligence. Covers honeypot types, placement strategy, monitoring integration,
  alert generation, and operational security considerations.
domain: cybersecurity
subdomain: blue-team
tags:
  - honeypot
  - deception
  - intrusion-detection
  - threat-intelligence
  - canary
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1018"]
---

# Implementing Honeypot Deployment

## Overview

Honeypots are decoy systems designed to attract and detect unauthorized access.
Any interaction with a honeypot is inherently suspicious since legitimate users
have no reason to access them. This makes honeypots high-fidelity, low-false-positive
detection sensors. This skill covers deployment strategy, tooling, monitoring, and OPSEC.

## Prerequisites

| Requirement | Install |
|---|---|
| Docker | Container-based honeypot deployment |
| Cowrie | `pip install cowrie` or Docker image |
| OpenCanary | `pip install opencanary` |
| T-Pot | Full honeypot platform via Docker Compose |
| Network segment | Isolated VLAN for honeypot placement |

## Key Concepts

### Honeypot Classification

| Type | Interaction | Use Case |
|---|---|---|
| Low-interaction | Emulated services | Internal trip wires, breadcrumbs |
| Medium-interaction | Partial protocol | Protocol-specific threat intel |
| High-interaction | Full OS/service | Advanced adversary research |
| Honey tokens | Fake credentials/files | Credential abuse detection |
| Honey accounts | Fake AD accounts | Lateral movement detection |

### OpenCanary Configuration

```json
{
  "device.node_id": "dc-honeypot-01",
  "server.ip": "0.0.0.0",
  "ftp.enabled": true,
  "ftp.port": 21,
  "ftp.banner": "Microsoft FTP Service",
  "ssh.enabled": true,
  "ssh.port": 22,
  "ssh.version": "SSH-2.0-OpenSSH_7.6p1",
  "http.enabled": true,
  "http.port": 80,
  "http.skin": "nasLogin",
  "smb.enabled": true,
  "smb.filelist": [
    {"name": "Passwords.xlsx", "type": "xlsx"},
    {"name": "IT-Credentials.docx", "type": "docx"}
  ],
  "rdp.enabled": true,
  "rdp.port": 3389,
  "logger": {
    "class": "PyLogger",
    "kwargs": {
      "formatters": {
        "plain": {"format": "%(message)s"}
      },
      "handlers": {
        "syslog-unix": {
          "class": "logging.handlers.SysLogHandler",
          "address": ["siem.internal", 514]
        }
      }
    }
  }
}
```

### Placement Strategy

```
Internet ──┬── DMZ Honeypots (high-interaction)
            │   └── Emulate web servers, mail servers
            │
Internal ───┬── Workstation VLANs
            │   └── Low-interaction canaries (SMB, RDP shares)
            │
            ├── Server VLANs
            │   └── Fake database servers, admin panels
            │
            └── Domain Controllers
                └── Honey accounts, honey SPNs
```

### Sigma Detection for Honeypot Alerts

```yaml
title: Honeypot SSH Login Attempt
id: c3d4e5f6-7a8b-9c0d-e1f2-3a4b5c6d7e8f
status: experimental
description: Detects SSH login attempts to honeypot systems
logsource:
  category: authentication
  product: linux
detection:
  selection:
    dst_ip|cidr: '10.99.0.0/24'
    event_type: 'ssh_login'
  condition: selection
falsepositives:
  - Vulnerability scanners targeting honeypot subnet (should be excluded)
level: high
tags:
  - attack.discovery
  - attack.t1046
```

## Workflow

1. **Plan placement** — Identify high-value network segments for honeypot sensors
2. **Select type** — Match honeypot interaction level to detection goals
3. **Deploy** — Spin up honeypots using Docker/VM in isolated VLAN
   ```bash
   docker run -d --name opencanary -p 21:21 -p 22:22 -p 80:80 -p 3389:3389 \
     -v /etc/opencanary/config.json:/etc/opencanary/opencanary.conf \
     thinkst/opencanary
   ```
4. **Configure logging** — Forward all honeypot events to SIEM
5. **Create breadcrumbs** — Plant fake credentials, shares, and links that lead to honeypots
6. **Build alerts** — Any honeypot interaction triggers immediate alert
7. **Monitor** — Review alerts for reconnaissance and lateral movement indicators
8. **Maintain OPSEC** — Ensure honeypots are indistinguishable from real assets

## Verification

| Check | Method |
|---|---|
| Services responding | `nmap -sV <honeypot_ip>` shows expected services |
| Logs forwarding | Honeypot events appear in SIEM within 60s |
| Alerts firing | Test interaction triggers alert in SOC |
| OPSEC solid | Honeypot indistinguishable from production assets |
| Breadcrumbs planted | Fake credentials resolve to honeypot IPs |

## References

- [OpenCanary Documentation](https://opencanary.readthedocs.io/)
- [Cowrie SSH/Telnet Honeypot](https://github.com/cowrie/cowrie)
- [T-Pot Honeypot Platform](https://github.com/telekom-security/tpotce)
- [Thinkst Canary](https://canary.tools/)
