D3fend Deceive

D3FEND — Deceive

When to Use

• Deploying honeynets (connected, integrated, standalone)
• Planting decoy objects (files, network resources, personas)
• Distributing decoy credentials and session tokens
• Publishing decoy information (fake releases, personas)
• Designing deception programs and adversary engagement
• Monitoring deception environment for adversary interaction

When NOT to Use

• Building detection rules or SIEM content → d3fend-detect
• System hardening or secure config → d3fend-harden
• Network segmentation → d3fend-isolate
• Active defense / threat intel → cybersecurity
• Adversarial testing (red team) → ai-redteam / offensive-security-analyst

Core Workflows

1. Decoy Environments (Honeynets)

See `references/honeynets.md`

2. Decoy Objects

• Decoy files: Fake documents with tracking (canary tokens)
• Decoy network resources: Fake shares, databases, services
• Decoy personas: Fake user accounts with believable data
• Decoy public releases: Fake credentials on dark web/pastebin
• Decoy session tokens: Bait cookies/API keys with monitoring

See `references/decoy_objects.md`

3. Deception Program Design

1. Define objectives (detection, delay, intelligence) 2. Select deception layers (environment, object, persona) 3. Ensure believability and consistency 4. Monitor and collect adversary TTPs 5. Analyze and feed into threat intelligence

See `references/deception_program.md`

When to load references

• Honeynets → references/honeynets.md
• Decoy objects → references/decoy_objects.md
• Deception program → references/deception_program.md

Deception Program

Program Design

Objectives

Deception Layers

Layer 1: Decoy environment (honeynet)
Layer 2: Decoy objects (files, credentials)
Layer 3: Decoy personas (fake users)
Layer 4: Decoy indicators (fake data in recon)

Believability

• Match naming conventions of real assets
• Include realistic data (synthetic, not real)
• Maintain consistent backstory
• Update decoys to match environment changes

Monitoring & Collection

Legal Considerations

• Employee monitoring disclosure
• Data privacy laws (GDPR, CCPA)
• No entrapment beyond scope
• Clear authorization and policy

Integration with Incident Response

1. Deception alert triggers 2. Validate not false positive 3. Initiate incident response 4. Collect intelligence from decoy 5. Contain and evict from real systems 6. Update deception based on learnings

Decoy Objects

Technique Coverage

Decoy Types

Decoy Files

• Fake documents with tracking (canary tokens)
• Planted in likely attacker targets
• Alert on open/access
• Example: salaries_2025.xlsx with embedded tracker

Decoy Network Resources

• Fake SMB shares: `\\fileserver\finance$
• Fake database with fake PII
• Fake admin panels with logging
• Alert on any interaction

Decoy Personas

• Fake Active Directory accounts
• Fake email mailboxes
• Appear as high-value targets
• Monitor login attempts and email access

Decoy Credentials

• Honey passwords for password spraying detection
• Fake API keys planted in code repositories
• Fake session tokens in browser storage
• Alert on usage attempt

Decoy Public Releases

• Fake credentials posted to dark web/pastebin
• Track if attackers attempt to use them
• Identify compromised infrastructure

Implementation

Tools

• Thinkst Canary: Physical and virtual canaries
• Canarytokens.org: Free token generation
• Custom: Honey accounts, fake databases

Honeynets

Technique Coverage

Honeynet Types

Standalone

• Completely isolated network
• No connection to production
• Purpose: Research, threat intelligence
• Risk: None to production
• Tools: Honeyd, Modern Honey Network (MHN)

Integrated

• Decoy systems mixed with production
• Appears as legitimate infrastructure
• Purpose: Detect lateral movement
• Risk: Low (properly isolated)
• Tools: Canary tokens, Thinkst

Connected

• Bridge between honeynet and production
• Monitored path for attacker observation
• Purpose: TTP collection, early warning
• Risk: Managed through strict controls

Deployment Checklist

• [ ] Define objectives (detection, intelligence, delay)
• [ ] Select honeynet type based on risk tolerance
• [ ] Ensure no production data on decoy systems
• [ ] Monitor all honeynet traffic and interactions
• [ ] Establish alerting for any honeynet access
• [ ] Plan legal/HR coordination if employee accesses
• [ ] Document and review findings regularly

Tools

• T-Pot: Multi-honeypot platform
• Cowrie: SSH/Telnet honeypot
• Dionaea: Malware capture honeypot
• Conpot: Industrial control honeypot
• Canary tokens: File and credential bait