[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFR15A39KF33K28WMSBHWZ":3,"skill-same:01M6AFR15A39KF33K28WMSBHWZ":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6AFR15A39KF33K28WMSBHWZ","performing-deception-technology-deployment",null,"Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates. Use when SOC teams need early warning of lateral movement, credential abuse, or internal reconnaissance by deploying convincing traps across the network.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-deception-technology-deployment\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"deployment","performing deception technology deployment","deception","soc","ZeRO","network","reconnaissance","lateral-movement","honeytokens","teams","detection","honeytoken","t1078","t1566","honeypot","canary","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-deception-technology-deployment\ndescription: 'Deploys deception technology including honeypots, honeytokens, and decoy\n  systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity\n  alerts with near-zero false positive rates. Use when SOC teams need early warning\n  of lateral movement, credential abuse, or internal reconnaissance by deploying convincing\n  traps across the network.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- deception\n- honeypot\n- honeytoken\n- canary\n- lateral-movement\n- detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1078\n- T1685.002\n- T1685.005\n- T1566\n- T1021\n---\n# Performing Deception Technology Deployment\n\n## When to Use\n\nUse this skill when:\n- SOC teams need high-fidelity detection of post-compromise lateral movement with near-zero false positives\n- Existing detection tools miss advanced attackers who avoid triggering threshold-based alerts\n- The organization wants to detect credential abuse by planting fake credentials as honeytokens\n- Network segmentation gaps need compensating detection controls\n\n**Do not use** as a replacement for fundamental security controls (patching, EDR, network segmentation) — deception is a detection layer, not a prevention mechanism.\n\n## Prerequisites\n\n- Network segments identified for honeypot\u002Fdecoy deployment (server VLANs, DMZ, OT networks)\n- Deception platform (Thinkst Canary, Attivo\u002FSentinelOne Hologram, or open-source alternatives)\n- SIEM integration for deception alerts (any interaction with deception assets is suspicious)\n- Active Directory access for honeytoken account and credential creation\n- Network team coordination for IP allocation and traffic routing\n\n## Workflow\n\n### Step 1: Map Attack Surface for Deception Placement\n\nIdentify high-value network segments where attackers would traverse:\n\n```\nDECEPTION DEPLOYMENT MAP\n━━━━━━━━━━━━━━━━━━━━━━━━\nSegment              Decoy Type          Rationale\nServer VLAN          Fake file server    Attackers enumerate SMB shares during recon\nDatabase VLAN        Fake DB server      SQL scanning detected in past incidents\nAD\u002FDC Segment        Honeytoken account  Credential theft detection\nExecutive Subnet     Fake workstation    Targeted attacks pivot through exec systems\nDMZ                  Honeypot web app    External attacker detection\nOT Network           Fake PLC\u002FHMI        Industrial threat detection\nCloud (AWS VPC)      Canary EC2 + S3     Cloud lateral movement detection\n```\n\n### Step 2: Deploy Thinkst Canary Devices\n\nConfigure Canary devices mimicking real infrastructure:\n\n**Windows File Server Canary:**\n```json\n{\n  \"device_name\": \"FILESERVER-BK04\",\n  \"personality\": \"windows-server-2019\",\n  \"services\": {\n    \"smb\": {\n      \"enabled\": true,\n      \"shares\": [\"Finance_Backup\", \"HR_Archive\", \"IT_Docs\"],\n      \"files\": [\n        {\"name\": \"Q4_Revenue_2024.xlsx\", \"alert_on\": \"read\"},\n        {\"name\": \"employee_ssn_export.csv\", \"alert_on\": \"read\"},\n        {\"name\": \"admin_passwords.kdbx\", \"alert_on\": \"read\"}\n      ]\n    },\n    \"rdp\": {\"enabled\": true},\n    \"http\": {\"enabled\": false}\n  },\n  \"network\": {\n    \"ip\": \"10.0.5.200\",\n    \"hostname\": \"FILESERVER-BK04\",\n    \"domain\": \"company.local\"\n  },\n  \"alert_webhook\": \"https:\u002F\u002Fsoar.company.com\u002Fapi\u002Fwebhook\u002Fcanary\"\n}\n```\n\n**Database Server Canary:**\n```json\n{\n  \"device_name\": \"DB-ARCHIVE-02\",\n  \"personality\": \"linux-mysql\",\n  \"services\": {\n    \"mysql\": {\n      \"enabled\": true,\n      \"port\": 3306,\n      \"databases\": [\"customer_pii\", \"payment_archive\"],\n      \"alert_on_login_attempt\": true\n    },\n    \"ssh\": {\n      \"enabled\": true,\n      \"port\": 22,\n      \"alert_on_login_attempt\": true\n    }\n  },\n  \"network\": {\n    \"ip\": \"10.0.10.50\",\n    \"hostname\": \"db-archive-02\"\n  }\n}\n```\n\n### Step 3: Deploy Honeytokens in Active Directory\n\nCreate fake privileged accounts that should never be used:\n\n```powershell\n# Create honeytoken service account\nNew-ADUser -Name \"svc_sql_backup\" `\n    -SamAccountName \"svc_sql_backup\" `\n    -UserPrincipalName \"svc_sql_backup@company.local\" `\n    -Description \"SQL Backup Service Account - DO NOT DELETE\" `\n    -AccountPassword (ConvertTo-SecureString \"FakeP@ssw0rd2024!\" -AsPlainText -Force) `\n    -Enabled $true `\n    -PasswordNeverExpires $true `\n    -CannotChangePassword $true\n\n# Add to a group that looks attractive (but monitor for any use)\nAdd-ADGroupMember -Identity \"Domain Admins\" -Members \"svc_sql_backup\"\n\n# Place cached credentials on decoy workstation\n# (Mimikatz\u002Fcredential dumping will find these)\ncmdkey \u002Fadd:fileserver-bk04.company.local \u002Fuser:company\\svc_sql_backup \u002Fpass:FakeP@ssw0rd2024!\n```\n\n**Monitor honeytoken usage in Splunk:**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\"\n(EventCode=4624 OR EventCode=4625 OR EventCode=4648 OR EventCode=4768 OR EventCode=4769)\nTargetUserName=\"svc_sql_backup\"\n| eval alert_severity = \"CRITICAL\"\n| eval alert_message = \"HONEYTOKEN ACCOUNT USED — Likely credential theft detected\"\n| table _time, EventCode, src_ip, ComputerName, TargetUserName, Logon_Type, alert_message\n```\n\n### Step 4: Deploy Canary Files and Documents\n\nPlant tracked documents that beacon when opened:\n\n**Canary Document (Word doc with tracking):**\n```python\n# Using Thinkst Canary API to create a canary token document\nimport requests\n\nresponse = requests.post(\n    \"https:\u002F\u002FYOURCOMPANY.canary.tools\u002Fapi\u002Fv1\u002Fcanarytoken\u002Fcreate\",\n    data={\n        \"auth_token\": \"YOUR_API_TOKEN\",\n        \"kind\": \"doc-msword\",\n        \"memo\": \"Finance backup folder canary document\",\n        \"flock_id\": \"flock:default\"\n    }\n)\ntoken = response.json()\ndownload_url = token[\"canarytoken\"][\"canarytoken_url\"]\nprint(f\"Download canary doc: {download_url}\")\n# Place this document in honeypot SMB shares and sensitive directories\n```\n\n**AWS Canary Token (S3 access key):**\n```python\n# Create AWS canary token — alerts when access key is used\nresponse = requests.post(\n    \"https:\u002F\u002FYOURCOMPANY.canary.tools\u002Fapi\u002Fv1\u002Fcanarytoken\u002Fcreate\",\n    data={\n        \"auth_token\": \"YOUR_API_TOKEN\",\n        \"kind\": \"aws-id\",\n        \"memo\": \"Canary AWS key in developer laptop .aws\u002Fcredentials\"\n    }\n)\naws_keys = response.json()\nprint(f\"Access Key: {aws_keys['canarytoken']['access_key_id']}\")\nprint(f\"Secret Key: {aws_keys['canarytoken']['secret_access_key']}\")\n# Plant in .aws\u002Fcredentials on developer workstations\n```\n\n### Step 5: Integrate Deception Alerts with SIEM\u002FSOAR\n\nAll deception alerts are high-fidelity — any interaction is suspicious:\n\n**Splunk Alert for Canary Triggers:**\n```spl\nindex=canary sourcetype=\"canary:alerts\"\n| eval severity = \"CRITICAL\"\n| eval confidence = \"HIGH — Deception asset triggered, zero false positive expected\"\n| table _time, canary_name, alert_type, source_ip, service, details\n| sendalert create_notable param.rule_title=\"Deception Alert — Canary Triggered\"\n  param.severity=\"critical\" param.drilldown_search=\"index=canary source_ip=$source_ip$\"\n```\n\n**SOAR Automated Response:**\n```python\ndef canary_triggered(container):\n    \"\"\"Auto-response for deception alerts — high confidence, no approval needed\"\"\"\n    source_ip = container[\"artifacts\"][0][\"cef\"][\"sourceAddress\"]\n\n    # Immediately isolate the source\n    phantom.act(\"quarantine device\",\n                parameters=[{\"ip_hostname\": source_ip}],\n                assets=[\"crowdstrike_prod\"],\n                name=\"isolate_attacker_host\")\n\n    # Block at firewall\n    phantom.act(\"block ip\",\n                parameters=[{\"ip\": source_ip, \"direction\": \"both\"}],\n                assets=[\"palo_alto_prod\"],\n                name=\"block_attacker_ip\")\n\n    # Create high-priority incident\n    phantom.act(\"create ticket\",\n                parameters=[{\n                    \"short_description\": f\"DECEPTION ALERT: Canary triggered from {source_ip}\",\n                    \"urgency\": \"1\",\n                    \"impact\": \"1\"\n                }],\n                assets=[\"servicenow_prod\"])\n\n    phantom.set_severity(container, \"critical\")\n```\n\n### Step 6: Maintain Deception Realism\n\nRegularly update decoys to maintain believability:\n\n- Rotate honeytoken passwords quarterly (update cached credentials on decoy workstations)\n- Update canary file modification dates to appear recently accessed\n- Add realistic network traffic to honeypots (scheduled SMB enumeration, DNS lookups)\n- Register honeypot hostnames in DNS and Active Directory to appear in network scans\n- Update canary document contents to match current business context\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Honeypot** | Decoy system mimicking real infrastructure to attract and detect attackers in the network |\n| **Honeytoken** | Fake credential, file, or data record that triggers an alert when accessed or used |\n| **Canary** | Lightweight deception device or token that alerts on any interaction (Thinkst Canary platform) |\n| **Breadcrumb** | Planted artifact (cached credential, bookmark, config file) leading attackers to deception assets |\n| **High-Fidelity Alert** | Detection signal with near-zero false positive rate because no legitimate user should interact with deception assets |\n| **Decoy Network** | Set of interconnected honeypots simulating a realistic network segment to observe attacker TTPs |\n\n## Tools & Systems\n\n- **Thinkst Canary**: Commercial deception platform offering hardware\u002Fvirtual canaries and canary tokens\n- **Canarytokens.org**: Free honeytoken generation service (DNS, HTTP, AWS keys, Word docs, SQL queries)\n- **Attivo Networks (SentinelOne)**: Enterprise deception platform with AD decoys and endpoint breadcrumbs\n- **HoneyDB**: Community honeypot data aggregation platform for threat intelligence sharing\n- **T-Pot**: Open-source multi-honeypot platform combining 20+ honeypot types in a Docker deployment\n\n## Common Scenarios\n\n- **Lateral Movement Detection**: Attacker enumerates SMB shares and accesses honeypot file server — immediate high-fidelity alert\n- **Credential Theft Discovery**: Mimikatz dumps honeytoken cached credentials — usage of fake account triggers alert\n- **Cloud Key Compromise**: Stolen AWS canary token used from external IP — detects supply chain or insider compromise\n- **Ransomware Early Warning**: Ransomware encrypts canary files on honeypot shares — early detection before production systems affected\n- **Insider Threat Signal**: Employee accesses honeypot \"salary database\" — indicates unauthorized data exploration\n\n## Output Format\n\n```\nDECEPTION ALERT — CRITICAL\n━━━━━━━━━━━━━━━━━━━━━━━━━━\nTime:         2024-03-15 14:23:07 UTC\nCanary:       FILESERVER-BK04 (10.0.5.200)\nService:      SMB — File share \"Finance_Backup\" accessed\nSource:       192.168.1.105 (WORKSTATION-042, Finance Dept)\nUser:         company\\jsmith\nFile Accessed: Q4_Revenue_2024.xlsx (canary document)\n\nAlert Confidence: HIGH — No legitimate reason to access deception asset\nFalse Positive Likelihood: \u003C1%\n\nAutomated Response:\n  [DONE] WORKSTATION-042 isolated via CrowdStrike\n  [DONE] 192.168.1.105 blocked at firewall (bidirectional)\n  [DONE] Incident INC0012567 created (P1 — Critical)\n  [PENDING] Tier 2 investigation — determine if workstation compromised or insider threat\n```\n","# Performing Deception Technology Deployment\n\n## When to Use\n\nUse this skill when:\n- SOC teams need high-fidelity detection of post-compromise lateral movement with near-zero false positives\n- Existing detection tools miss advanced attackers who avoid triggering threshold-based alerts\n- The organization wants to detect credential abuse by planting fake credentials as honeytokens\n- Network segmentation gaps need compensating detection controls\n\n**Do not use** as a replacement for fundamental security controls (patching, EDR, network segmentation) — deception is a detection layer, not a prevention mechanism.\n\n## Prerequisites\n\n- Network segments identified for honeypot\u002Fdecoy deployment (server VLANs, DMZ, OT networks)\n- Deception platform (Thinkst Canary, Attivo\u002FSentinelOne Hologram, or open-source alternatives)\n- SIEM integration for deception alerts (any interaction with deception assets is suspicious)\n- Active Directory access for honeytoken account and credential creation\n- Network team coordination for IP allocation and traffic routing\n\n## Workflow\n\n### Step 1: Map Attack Surface for Deception Placement\n\nIdentify high-value network segments where attackers would traverse:\n\n```\nDECEPTION DEPLOYMENT MAP\n━━━━━━━━━━━━━━━━━━━━━━━━\nSegment              Decoy Type          Rationale\nServer VLAN          Fake file server    Attackers enumerate SMB shares during recon\nDatabase VLAN        Fake DB server      SQL scanning detected in past incidents\nAD\u002FDC Segment        Honeytoken account  Credential theft detection\nExecutive Subnet     Fake workstation    Targeted attacks pivot through exec systems\nDMZ                  Honeypot web app    External attacker detection\nOT Network           Fake PLC\u002FHMI        Industrial threat detection\nCloud (AWS VPC)      Canary EC2 + S3     Cloud lateral movement detection\n```\n\n### Step 2: Deploy Thinkst Canary Devices\n\nConfigure Canary devices mimicking real infrastructure:\n\n**Windows File Server Canary:**\n```json\n{\n  \"device_name\": \"FILESERVER-BK04\",\n  \"personality\": \"windows-server-2019\",\n  \"services\": {\n    \"smb\": {\n      \"enabled\": true,\n      \"shares\": [\"Finance_Backup\", \"HR_Archive\", \"IT_Docs\"],\n      \"files\": [\n        {\"name\": \"Q4_Revenue_2024.xlsx\", \"alert_on\": \"read\"},\n        {\"name\": \"employee_ssn_export.csv\", \"alert_on\": \"read\"},\n        {\"name\": \"admin_passwords.kdbx\", \"alert_on\": \"read\"}\n      ]\n    },\n    \"rdp\": {\"enabled\": true},\n    \"http\": {\"enabled\": false}\n  },\n  \"network\": {\n    \"ip\": \"10.0.5.200\",\n    \"hostname\": \"FILESERVER-BK04\",\n    \"domain\": \"company.local\"\n  },\n  \"alert_webhook\": \"https:\u002F\u002Fsoar.company.com\u002Fapi\u002Fwebhook\u002Fcanary\"\n}\n```\n\n**Database Server Canary:**\n```json\n{\n  \"device_name\": \"DB-ARCHIVE-02\",\n  \"personality\": \"linux-mysql\",\n  \"services\": {\n    \"mysql\": {\n      \"enabled\": true,\n      \"port\": 3306,\n      \"databases\": [\"customer_pii\", \"payment_archive\"],\n      \"alert_on_login_attempt\": true\n    },\n    \"ssh\": {\n      \"enabled\": true,\n      \"port\": 22,\n      \"alert_on_login_attempt\": true\n    }\n  },\n  \"network\": {\n    \"ip\": \"10.0.10.50\",\n    \"hostname\": \"db-archive-02\"\n  }\n}\n```\n\n### Step 3: Deploy Honeytokens in Active Directory\n\nCreate fake privileged accounts that should never be used:\n\n```powershell\n# Create honeytoken service account\nNew-ADUser -Name \"svc_sql_backup\" `\n    -SamAccountName \"svc_sql_backup\" `\n    -UserPrincipalName \"svc_sql_backup@company.local\" `\n    -Description \"SQL Backup Service Account - DO NOT DELETE\" `\n    -AccountPassword (ConvertTo-SecureString \"FakeP@ssw0rd2024!\" -AsPlainText -Force) `\n    -Enabled $true `\n    -PasswordNeverExpires $true `\n    -CannotChangePassword $true\n\n# Add to a group that looks attractive (but monitor for any use)\nAdd-ADGroupMember -Identity \"Domain Admins\" -Members \"svc_sql_backup\"\n\n# Place cached credentials on decoy workstation\n# (Mimikatz\u002Fcredential dumping will find these)\ncmdkey \u002Fadd:fileserver-bk04.company.local \u002Fuser:company\\svc_sql_backup \u002Fpass:FakeP@ssw0rd2024!\n```\n\n**Monitor honeytoken usage in Splunk:**\n```spl\nindex=wineventlog sourcetype=\"WinEventLog:Security\"\n(EventCode=4624 OR EventCode=4625 OR EventCode=4648 OR EventCode=4768 OR EventCode=4769)\nTargetUserName=\"svc_sql_backup\"\n| eval alert_severity = \"CRITICAL\"\n| eval alert_message = \"HONEYTOKEN ACCOUNT USED — Likely credential theft detected\"\n| table _time, EventCode, src_ip, ComputerName, TargetUserName, Logon_Type, alert_message\n```\n\n### Step 4: Deploy Canary Files and Documents\n\nPlant tracked documents that beacon when opened:\n\n**Canary Document (Word doc with tracking):**\n```python\n# Using Thinkst Canary API to create a canary token document\nimport requests\n\nresponse = requests.post(\n    \"https:\u002F\u002FYOURCOMPANY.canary.tools\u002Fapi\u002Fv1\u002Fcanarytoken\u002Fcreate\",\n    data={\n        \"auth_token\": \"YOUR_API_TOKEN\",\n        \"kind\": \"doc-msword\",\n        \"memo\": \"Finance backup folder canary document\",\n        \"flock_id\": \"flock:default\"\n    }\n)\ntoken = response.json()\ndownload_url = token[\"canarytoken\"][\"canarytoken_url\"]\nprint(f\"Download canary doc: {download_url}\")\n# Place this document in honeypot SMB shares and sensitive directories\n```\n\n**AWS Canary Token (S3 access key):**\n```python\n# Create AWS canary token — alerts when access key is used\nresponse = requests.post(\n    \"https:\u002F\u002FYOURCOMPANY.canary.tools\u002Fapi\u002Fv1\u002Fcanarytoken\u002Fcreate\",\n    data={\n        \"auth_token\": \"YOUR_API_TOKEN\",\n        \"kind\": \"aws-id\",\n        \"memo\": \"Canary AWS key in developer laptop .aws\u002Fcredentials\"\n    }\n)\naws_keys = response.json()\nprint(f\"Access Key: {aws_keys['canarytoken']['access_key_id']}\")\nprint(f\"Secret Key: {aws_keys['canarytoken']['secret_access_key']}\")\n# Plant in .aws\u002Fcredentials on developer workstations\n```\n\n### Step 5: Integrate Deception Alerts with SIEM\u002FSOAR\n\nAll deception alerts are high-fidelity — any interaction is suspicious:\n\n**Splunk Alert for Canary Triggers:**\n```spl\nindex=canary sourcetype=\"canary:alerts\"\n| eval severity = \"CRITICAL\"\n| eval confidence = \"HIGH — Deception asset triggered, zero false positive expected\"\n| table _time, canary_name, alert_type, source_ip, service, details\n| sendalert create_notable param.rule_title=\"Deception Alert — Canary Triggered\"\n  param.severity=\"critical\" param.drilldown_search=\"index=canary source_ip=$source_ip$\"\n```\n\n**SOAR Automated Response:**\n```python\ndef canary_triggered(container):\n    \"\"\"Auto-response for deception alerts — high confidence, no approval needed\"\"\"\n    source_ip = container[\"artifacts\"][0][\"cef\"][\"sourceAddress\"]\n\n    # Immediately isolate the source\n    phantom.act(\"quarantine device\",\n                parameters=[{\"ip_hostname\": source_ip}],\n                assets=[\"crowdstrike_prod\"],\n                name=\"isolate_attacker_host\")\n\n    # Block at firewall\n    phantom.act(\"block ip\",\n                parameters=[{\"ip\": source_ip, \"direction\": \"both\"}],\n                assets=[\"palo_alto_prod\"],\n                name=\"block_attacker_ip\")\n\n    # Create high-priority incident\n    phantom.act(\"create ticket\",\n                parameters=[{\n                    \"short_description\": f\"DECEPTION ALERT: Canary triggered from {source_ip}\",\n                    \"urgency\": \"1\",\n                    \"impact\": \"1\"\n                }],\n                assets=[\"servicenow_prod\"])\n\n    phantom.set_severity(container, \"critical\")\n```\n\n### Step 6: Maintain Deception Realism\n\nRegularly update decoys to maintain believability:\n\n- Rotate honeytoken passwords quarterly (update cached credentials on decoy workstations)\n- Update canary file modification dates to appear recently accessed\n- Add realistic network traffic to honeypots (scheduled SMB enumeration, DNS lookups)\n- Register honeypot hostnames in DNS and Active Directory to appear in network scans\n- Update canary document contents to match current business context\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Honeypot** | Decoy system mimicking real infrastructure to attract and detect attackers in the network |\n| **Honeytoken** | Fake credential, file, or data record that triggers an alert when accessed or used |\n| **Canary** | Lightweight deception device or token that alerts on any interaction (Thinkst Canary platform) |\n| **Breadcrumb** | Planted artifact (cached credential, bookmark, config file) leading attackers to deception assets |\n| **High-Fidelity Alert** | Detection signal with near-zero false positive rate because no legitimate user should interact with deception assets |\n| **Decoy Network** | Set of interconnected honeypots simulating a realistic network segment to observe attacker TTPs |\n\n## Tools & Systems\n\n- **Thinkst Canary**: Commercial deception platform offering hardware\u002Fvirtual canaries and canary tokens\n- **Canarytokens.org**: Free honeytoken generation service (DNS, HTTP, AWS keys, Word docs, SQL queries)\n- **Attivo Networks (SentinelOne)**: Enterprise deception platform with AD decoys and endpoint breadcrumbs\n- **HoneyDB**: Community honeypot data aggregation platform for threat intelligence sharing\n- **T-Pot**: Open-source multi-honeypot platform combining 20+ honeypot types in a Docker deployment\n\n## Common Scenarios\n\n- **Lateral Movement Detection**: Attacker enumerates SMB shares and accesses honeypot file server — immediate high-fidelity alert\n- **Credential Theft Discovery**: Mimikatz dumps honeytoken cached credentials — usage of fake account triggers alert\n- **Cloud Key Compromise**: Stolen AWS canary token used from external IP — detects supply chain or insider compromise\n- **Ransomware Early Warning**: Ransomware encrypts canary files on honeypot shares — early detection before production systems affected\n- **Insider Threat Signal**: Employee accesses honeypot \"salary database\" — indicates unauthorized data exploration\n\n## Output Format\n\n```\nDECEPTION ALERT — CRITICAL\n━━━━━━━━━━━━━━━━━━━━━━━━━━\nTime:         2024-03-15 14:23:07 UTC\nCanary:       FILESERVER-BK04 (10.0.5.200)\nService:      SMB — File share \"Finance_Backup\" accessed\nSource:       192.168.1.105 (WORKSTATION-042, Finance Dept)\nUser:         company\\jsmith\nFile Accessed: Q4_Revenue_2024.xlsx (canary document)\n\nAlert Confidence: HIGH — No legitimate reason to access deception asset\nFalse Positive Likelihood: \u003C1%\n\nAutomated Response:\n  [DONE] WORKSTATION-042 isolated via CrowdStrike\n  [DONE] 192.168.1.105 blocked at firewall (bidirectional)\n  [DONE] Incident INC0012567 created (P1 — Critical)\n  [PENDING] Tier 2 investigation — determine if workstation compromised or insider threat\n```\n",{"name":5,"tags":46,"author":47,"domain":40,"license":15,"version":48,"nist_csf":49,"subdomain":54,"description":55,"mitre_attack":56},[27,26,38,35,39,31,34],"mahipal","1.0",[50,51,52,53],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates. Use when SOC teams need early warning of lateral movement, credential abuse, or internal reconnaissance by deploying convincing traps across the network.\n",[57,58,59,60,61],"T1078","T1685.002","T1685.005","T1566","T1021","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-deception-technology-deployment",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-deception-technology-deployment",{"tool":78,"command":79},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-deception-technology-deployment",{"tool":81,"command":82},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-deception-technology-deployment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-deception-technology-deployment\u002FSKILL.md",true,[86,91,97],{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-deception-technology-deployment\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",2160,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-deception-technology-deployment\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",7774,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-deception-technology-deployment\u002Fscripts\u002Fagent.py",[104,131,154,180,206,233],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":111,"publishedAt":41},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[110],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[112,113,114,115,116,40,117,118,119,120,121,122,123,124,125,126,127,128,129,130],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":41},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[137],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[139,127,140,141,116,142,40,119,143,28,144,145,146,147,148,149,150,151,152,153],"boot","TPM","validating tpm measured boot attestation","policy","verification","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":164,"publishedAt":41},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[160,163],{"categoryNo":161,"categoryName":162,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[148,165,166,167,168,40,169,170,143,171,172,173,174,175,34,36,176,177,178,179],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":187,"publishedAt":41},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[186],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[188,189,190,40,191,192,193,194,195,196,197,198,199,200,201,202,145,203,204,205],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":213,"publishedAt":41},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[212],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[214,215,216,40,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":240,"publishedAt":41},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[239],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[116,241,40,242,243,244,27,245,246,247,248,36,249,176,250,251,252,253,254,255],"triaging security incident","siem","file","ioc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]