<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-deception-technology
description: >-
  Deploy enterprise deception technology beyond basic honeypots. Covers breadcrumb
  placement, decoy credential injection, fake network services, Active Directory
  deception objects, and integration with detection pipelines.
domain: cybersecurity
subdomain: blue-team
tags:
  - deception
  - active-defense
  - breadcrumbs
  - canary-tokens
  - detection-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1036"]
---

# Implementing Deception Technology

## Overview

Deception technology extends honeypots into a layered strategy that plants false
artifacts throughout the environment — credentials, files, services, and AD objects
that real users never touch. Any interaction is a confirmed indicator of compromise
with near-zero false positive rate.

## Prerequisites

| Requirement | Install |
|---|---|
| Active Directory | For deception AD objects |
| Canarytokens | `canarytokens.org` or self-hosted |
| Honey accounts | AD user objects with monitoring |
| Network decoys | Docker-based fake services |
| SIEM integration | Alert pipeline for deception triggers |

## Key Concepts

### Deception Layers

| Layer | Technique | Detection Signal |
|---|---|---|
| Endpoint | Fake credentials in memory/files | Credential use from deception account |
| Network | Decoy services on unused IPs | Any connection to decoy IP |
| Active Directory | Honey users, SPNs, groups | Authentication or SPN query for honey objects |
| File system | Canary documents (Word/PDF) | Document opened (phones home) |
| DNS | Fake internal DNS records | Resolution of deception hostname |
| Cloud | Decoy S3 buckets, API keys | Access to deception cloud resource |

### Active Directory Deception

```powershell
# Create honey admin account
New-ADUser -Name "svc_sqlbackup" -SamAccountName "svc_sqlbackup" `
  -Description "SQL Backup Service Account" `
  -Enabled $true -PasswordNeverExpires $true `
  -AccountPassword (ConvertTo-SecureString "D3c0y!P@ss2026" -AsPlainText -Force)

# Set SPN for Kerberoasting detection
Set-ADUser -Identity "svc_sqlbackup" `
  -ServicePrincipalNames @{Add="MSSQLSvc/sqlbackup.corp.local:1433"}

# Monitor: any TGS request for this SPN = Kerberoasting attempt
# EID 4769 with ServiceName=svc_sqlbackup

# Create honey admin group
New-ADGroup -Name "Domain Admins - Backup" -GroupScope Global `
  -Description "Backup domain admin group"
# Monitor: any enumeration of this group = recon activity
```

### Canarytoken Types

```bash
# Web bug — triggers on HTTP request
curl -X POST https://canarytokens.org/generate \
  -d "type=web_bug&memo=DC-share-access&email=soc@corp.com"

# DNS token — triggers on DNS resolution
curl -X POST https://canarytokens.org/generate \
  -d "type=dns&memo=internal-recon&email=soc@corp.com"

# AWS key — triggers on AWS API call
curl -X POST https://canarytokens.org/generate \
  -d "type=aws_keys&memo=leaked-key-test&email=soc@corp.com"

# Office document — triggers on open
curl -X POST https://canarytokens.org/generate \
  -d "type=doc-msword&memo=share-canary&email=soc@corp.com"
```

### Sigma Detection for Deception Triggers

```yaml
title: Authentication Attempt with Honey Account
id: a7b8c9d0-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects authentication attempts using deception accounts
logsource:
  category: authentication
  product: windows
detection:
  selection:
    TargetUserName:
      - 'svc_sqlbackup'
      - 'admin_backup'
      - 'svc_exchange'
  condition: selection
falsepositives:
  - None — these accounts should never be used legitimately
level: critical
tags:
  - attack.credential_access
  - attack.t1003
```

### Breadcrumb Placement

```powershell
# Plant fake RDP credentials in Windows Credential Manager
cmdkey /add:fileserver.corp.local /user:svc_sqlbackup /pass:D3c0y!P@ss2026

# Plant fake SSH config
echo "Host prod-db" >> C:\Users\admin\.ssh\config
echo "  HostName 10.99.0.50" >> C:\Users\admin\.ssh\config
echo "  User svc_sqlbackup" >> C:\Users\admin\.ssh\config

# Plant fake credentials file on network share
echo "Server: 10.99.0.50" > \\fileserver\IT-Share\credentials.txt
echo "Username: svc_sqlbackup" >> \\fileserver\IT-Share\credentials.txt
echo "Password: D3c0y!P@ss2026" >> \\fileserver\IT-Share\credentials.txt
```

## Workflow

1. **Map attack paths** — Identify likely attacker lateral movement routes
2. **Select deception types** — Match deception to expected attacker TTPs
3. **Deploy decoys** — Place deception objects at strategic chokepoints
4. **Plant breadcrumbs** — Scatter false credentials and documents
5. **Wire alerting** — Any deception interaction triggers critical alert
6. **Test** — Validate that interaction generates alert in <60 seconds
7. **Document** — Maintain inventory of all deception objects (SOC-only access)
8. **Rotate** — Update deception objects quarterly to avoid staleness

## Verification

| Check | Method |
|---|---|
| Honey accounts monitored | EID 4625/4624 alerts for deception users |
| Canarytokens active | Test token triggers callback |
| Breadcrumbs discoverable | Attacker enumeration would find planted artifacts |
| Alerts firing | Simulated interaction triggers SOC alert |
| Inventory current | Deception object list reviewed quarterly |

## References

- [Canarytokens](https://canarytokens.org/)
- [MITRE Shield / D3FEND](https://d3fend.mitre.org/)
- [Active Directory Deception](https://adsecurity.org/)
- [Deception Technology Best Practices](https://www.sans.org/white-papers/deception-technology/)
