mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-25 22:00:58 +03:00
mukul975
cb8d79e068
- Add validated mitre_attack frontmatter to all 754 skills (286 distinct techniques), verified against MITRE ATT&CK v19.1 via the official mitreattack-python library: 0 revoked, deprecated, or invalid IDs - Curate precise per-skill technique IDs for forensics, malware-analysis, threat-intel, and red-team skills (e.g. DCSync -> T1003.006, Kerberoasting -> T1558.003, Pass-the-Ticket -> T1550.003) - Reconcile v19.1 tactic restructuring: Defense Evasion split into Stealth (TA0005) and Defense Impairment (TA0112); revoked T1562.* family and T1070.001/.002 remapped to active equivalents (T1685.*) - Normalize word-split tags across 35 skills (remove filename-derived stopword tags, add semantic cybersecurity tags) - Add api-reference.md for 3 skills that were missing it - Update README ATT&CK section with accurate v19.1 tactic distribution
93 lines
3.0 KiB
Markdown
93 lines
3.0 KiB
Markdown
---
|
|
name: implementing-network-deception-with-honeypots
|
|
description: Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie
|
|
to detect unauthorized access, lateral movement, and attacker reconnaissance.
|
|
domain: cybersecurity
|
|
subdomain: deception-technology
|
|
tags:
|
|
- deception
|
|
- honeypot
|
|
- opencanary
|
|
- cowrie
|
|
- t-pot
|
|
- detection
|
|
- lateral-movement
|
|
- network-security
|
|
version: '1.0'
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
nist_csf:
|
|
- DE.CM-01
|
|
- DE.AE-06
|
|
- PR.IR-01
|
|
mitre_attack:
|
|
- T1078
|
|
- T1190
|
|
- T1059
|
|
- T1021
|
|
- T1550
|
|
---
|
|
|
|
# Implementing Network Deception with Honeypots
|
|
|
|
## When to Use
|
|
|
|
- When deploying deception technology to detect lateral movement
|
|
- To create early warning indicators for network intrusion
|
|
- During security architecture design to add detection depth
|
|
- When monitoring for unauthorized internal scanning or credential theft
|
|
- To gather threat intelligence on attacker techniques and tools
|
|
|
|
## Prerequisites
|
|
|
|
- Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)
|
|
- Python 3.8+ with pip for OpenCanary installation
|
|
- Docker for T-Pot or containerized deployment
|
|
- Network segment with appropriate VLAN configuration
|
|
- SIEM integration for alert forwarding (syslog, webhook, or file-based)
|
|
- Firewall rules allowing inbound connections to honeypot services
|
|
|
|
## Workflow
|
|
|
|
1. **Plan Deployment**: Select honeypot types and network placement strategy.
|
|
2. **Install Honeypot**: Deploy OpenCanary, Cowrie, or T-Pot on dedicated host.
|
|
3. **Configure Services**: Enable emulated services (SSH, HTTP, SMB, FTP, RDP).
|
|
4. **Set Up Alerting**: Configure log forwarding to SIEM and alert channels.
|
|
5. **Deploy Canary Tokens**: Place credential files, shares, and DNS entries.
|
|
6. **Monitor Interactions**: Analyze honeypot logs for attacker activity.
|
|
7. **Tune and Maintain**: Update configurations based on detection results.
|
|
|
|
## Key Concepts
|
|
|
|
| Concept | Description |
|
|
|---------|-------------|
|
|
| OpenCanary | Lightweight Python honeypot with modular service emulation |
|
|
| Cowrie | Medium-interaction SSH/Telnet honeypot capturing commands |
|
|
| T-Pot | Multi-honeypot platform with ELK stack visualization |
|
|
| Canary Token | Tripwire credential or file that alerts when accessed |
|
|
| Low-Interaction | Emulates services at protocol level without full OS |
|
|
| High-Interaction | Full OS honeypot capturing complete attacker sessions |
|
|
|
|
## Tools & Systems
|
|
|
|
| Tool | Purpose |
|
|
|------|---------|
|
|
| OpenCanary | Modular honeypot daemon with service emulation |
|
|
| Cowrie | SSH/Telnet honeypot with session recording |
|
|
| T-Pot | All-in-one multi-honeypot platform |
|
|
| Dionaea | Malware-capturing honeypot for exploit detection |
|
|
| Splunk/Elastic | SIEM for honeypot alert aggregation |
|
|
|
|
## Output Format
|
|
|
|
```
|
|
Alert: HONEYPOT-[SERVICE]-[DATE]-[SEQ]
|
|
Honeypot: [Hostname/IP]
|
|
Service: [SSH/HTTP/SMB/FTP/RDP]
|
|
Source IP: [Attacker IP]
|
|
Interaction: [Login attempt/Port scan/File access]
|
|
Credentials Used: [Username:Password if applicable]
|
|
Commands Executed: [For SSH honeypots]
|
|
Risk Level: [Critical/High/Medium/Low]
|
|
```
|