mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-20 14:30:59 +03:00
mukul975
efca3ec611
Mapped every skill to NIST CSF 2.0 subcategory IDs (GV/ID/PR/DE/RS/RC functions) based on subdomain and content analysis. Restores 11 skills corrupted during prior rebase, re-enriching with ATLAS, D3FEND, NIST AI RMF, and CSF 2.0 fields. All 754 skills now carry structured mappings for all 5 security frameworks: - MITRE ATT&CK (in tags) - MITRE ATLAS v5.5 (atlas_techniques) - MITRE D3FEND v1.3 (d3fend_techniques) - NIST AI RMF 1.0 (nist_ai_rmf) - NIST CSF 2.0 (nist_csf)
87 lines
2.9 KiB
Markdown
87 lines
2.9 KiB
Markdown
---
|
|
name: implementing-network-deception-with-honeypots
|
|
description: Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral
|
|
movement, and attacker reconnaissance.
|
|
domain: cybersecurity
|
|
subdomain: deception-technology
|
|
tags:
|
|
- deception
|
|
- honeypot
|
|
- opencanary
|
|
- cowrie
|
|
- t-pot
|
|
- detection
|
|
- lateral-movement
|
|
- network-security
|
|
version: '1.0'
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
nist_csf:
|
|
- DE.CM-01
|
|
- DE.AE-06
|
|
- PR.IR-01
|
|
---
|
|
|
|
# Implementing Network Deception with Honeypots
|
|
|
|
## When to Use
|
|
|
|
- When deploying deception technology to detect lateral movement
|
|
- To create early warning indicators for network intrusion
|
|
- During security architecture design to add detection depth
|
|
- When monitoring for unauthorized internal scanning or credential theft
|
|
- To gather threat intelligence on attacker techniques and tools
|
|
|
|
## Prerequisites
|
|
|
|
- Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)
|
|
- Python 3.8+ with pip for OpenCanary installation
|
|
- Docker for T-Pot or containerized deployment
|
|
- Network segment with appropriate VLAN configuration
|
|
- SIEM integration for alert forwarding (syslog, webhook, or file-based)
|
|
- Firewall rules allowing inbound connections to honeypot services
|
|
|
|
## Workflow
|
|
|
|
1. **Plan Deployment**: Select honeypot types and network placement strategy.
|
|
2. **Install Honeypot**: Deploy OpenCanary, Cowrie, or T-Pot on dedicated host.
|
|
3. **Configure Services**: Enable emulated services (SSH, HTTP, SMB, FTP, RDP).
|
|
4. **Set Up Alerting**: Configure log forwarding to SIEM and alert channels.
|
|
5. **Deploy Canary Tokens**: Place credential files, shares, and DNS entries.
|
|
6. **Monitor Interactions**: Analyze honeypot logs for attacker activity.
|
|
7. **Tune and Maintain**: Update configurations based on detection results.
|
|
|
|
## Key Concepts
|
|
|
|
| Concept | Description |
|
|
|---------|-------------|
|
|
| OpenCanary | Lightweight Python honeypot with modular service emulation |
|
|
| Cowrie | Medium-interaction SSH/Telnet honeypot capturing commands |
|
|
| T-Pot | Multi-honeypot platform with ELK stack visualization |
|
|
| Canary Token | Tripwire credential or file that alerts when accessed |
|
|
| Low-Interaction | Emulates services at protocol level without full OS |
|
|
| High-Interaction | Full OS honeypot capturing complete attacker sessions |
|
|
|
|
## Tools & Systems
|
|
|
|
| Tool | Purpose |
|
|
|------|---------|
|
|
| OpenCanary | Modular honeypot daemon with service emulation |
|
|
| Cowrie | SSH/Telnet honeypot with session recording |
|
|
| T-Pot | All-in-one multi-honeypot platform |
|
|
| Dionaea | Malware-capturing honeypot for exploit detection |
|
|
| Splunk/Elastic | SIEM for honeypot alert aggregation |
|
|
|
|
## Output Format
|
|
|
|
```
|
|
Alert: HONEYPOT-[SERVICE]-[DATE]-[SEQ]
|
|
Honeypot: [Hostname/IP]
|
|
Service: [SSH/HTTP/SMB/FTP/RDP]
|
|
Source IP: [Attacker IP]
|
|
Interaction: [Login attempt/Port scan/File access]
|
|
Credentials Used: [Username:Password if applicable]
|
|
Commands Executed: [For SSH honeypots]
|
|
Risk Level: [Critical/High/Medium/Low]
|
|
```
|