When to Use
- Deploying honeynets (connected, integrated, standalone)
- Planting decoy objects (files, network resources, personas)
- Distributing decoy credentials and session tokens
- Publishing decoy information (fake releases, personas)
- Designing deception programs and adversary engagement
- Monitoring deception environment for adversary interaction
When NOT to Use
- Building detection rules or SIEM content →
d3fend-detect - System hardening or secure config →
d3fend-harden - Network segmentation →
d3fend-isolate - Active defense / threat intel →
cybersecurity - Adversarial testing (red team) →
ai-redteam/offensive-security-analyst
Core Workflows
1. Decoy Environments (Honeynets)
| Type | Deployment | Use Case |
|---|---|---|
| Standalone | Isolated network segment | Research, early warning |
| Integrated | Blended with production | Insider threat, lateral movement |
| Connected | Linked to real systems | APT detection, TTP collection |
See references/honeynets.md
2. Decoy Objects
- Decoy files: Fake documents with tracking (canary tokens)
- Decoy network resources: Fake shares, databases, services
- Decoy personas: Fake user accounts with believable data
- Decoy public releases: Fake credentials on dark web/pastebin
- Decoy session tokens: Bait cookies/API keys with monitoring
See references/decoy_objects.md
3. Deception Program Design
- Define objectives (detection, delay, intelligence)
- Select deception layers (environment, object, persona)
- Ensure believability and consistency
- Monitor and collect adversary TTPs
- Analyze and feed into threat intelligence
See references/deception_program.md
When to load references
- Honeynets →
references/honeynets.md - Decoy objects →
references/decoy_objects.md - Deception program →
references/deception_program.md