pinkpixel-dev/implementing-network-deception-with-honeypots
SKILLS/implementing-network-deception-with-honeypots/SKILL.md
Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.
$ install --global
skillsauthnpx skillsauth add pinkpixel-dev/skills-collection-2 implementing-network-deception-with-honeypotsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 29, 2026, 4:23 AM299.8s3 files scanned
SKILL.md
- name:
- implementing-network-deception-with-honeypots
- description:
- Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.
- domain:
- cybersecurity
- subdomain:
- deception-technology
- tags:
- [deception, honeypot, opencanary, cowrie, t-pot, detection, lateral-movement, network-security]
- version:
- 1.0
- author:
- mahipal
- license:
- Apache-2.0
Implementing Network Deception with Honeypots
When to Use
- When deploying deception technology to detect lateral movement
- To create early warning indicators for network intrusion
- During security architecture design to add detection depth
- When monitoring for unauthorized internal scanning or credential theft
- To gather threat intelligence on attacker techniques and tools
Prerequisites
- Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)
- Python 3.8+ with pip for OpenCanary installation
- Docker for T-Pot or containerized deployment
- Network segment with appropriate VLAN configuration
- SIEM integration for alert forwarding (syslog, webhook, or file-based)
- Firewall rules allowing inbound connections to honeypot services
Workflow
- Plan Deployment: Select honeypot types and network placement strategy.
- Install Honeypot: Deploy OpenCanary, Cowrie, or T-Pot on dedicated host.
- Configure Services: Enable emulated services (SSH, HTTP, SMB, FTP, RDP).
- Set Up Alerting: Configure log forwarding to SIEM and alert channels.
- Deploy Canary Tokens: Place credential files, shares, and DNS entries.
- Monitor Interactions: Analyze honeypot logs for attacker activity.
- Tune and Maintain: Update configurations based on detection results.
Key Concepts
| Concept | Description | |---------|-------------| | OpenCanary | Lightweight Python honeypot with modular service emulation | | Cowrie | Medium-interaction SSH/Telnet honeypot capturing commands | | T-Pot | Multi-honeypot platform with ELK stack visualization | | Canary Token | Tripwire credential or file that alerts when accessed | | Low-Interaction | Emulates services at protocol level without full OS | | High-Interaction | Full OS honeypot capturing complete attacker sessions |
Tools & Systems
| Tool | Purpose | |------|---------| | OpenCanary | Modular honeypot daemon with service emulation | | Cowrie | SSH/Telnet honeypot with session recording | | T-Pot | All-in-one multi-honeypot platform | | Dionaea | Malware-capturing honeypot for exploit detection | | Splunk/Elastic | SIEM for honeypot alert aggregation |
Output Format
Alert: HONEYPOT-[SERVICE]-[DATE]-[SEQ]
Honeypot: [Hostname/IP]
Service: [SSH/HTTP/SMB/FTP/RDP]
Source IP: [Attacker IP]
Interaction: [Login attempt/Port scan/File access]
Credentials Used: [Username:Password if applicable]
Commands Executed: [For SSH honeypots]
Risk Level: [Critical/High/Medium/Low]
Related Skills
pinkpixel-dev/implementing-rapid7-insightvm-for-scanning
development
VerifiedTrustedCommunity
Deploy and configure Rapid7 InsightVM Security Console and Scan Engines for authenticated and unauthenticated vulnerability scanning across enterprise environments.
1SKILL.mdUpdated May 29, 2026
pinkpixel-dev/implementing-ransomware-kill-switch-detection
testing
VerifiedTrustedCommunity
Detects and exploits ransomware kill switch mechanisms including mutex-based execution guards, domain-based kill switches, and registry-based termination checks. Implements proactive mutex vaccination and kill switch domain monitoring to prevent ransomware from executing. Activates for requests involving ransomware kill switch analysis, mutex vaccination, WannaCry-style domain kill switches, or malware execution guard detection.
1SKILL.mdUpdated May 29, 2026
pinkpixel-dev/implementing-ransomware-backup-strategy
testing
VerifiedTrustedCommunity
Designs and implements a ransomware-resilient backup strategy following the 3-2-1-1-0 methodology (3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, 0 errors on restore verification). Configures backup schedules aligned to RPO/RTO requirements, implements backup credential isolation to prevent ransomware from compromising backup infrastructure, and establishes automated restore testing. Activates for requests involving ransomware backup planning, backup resilience, air-gapped backup design, or backup recovery point objective configuration.
1SKILL.mdUpdated May 29, 2026
pinkpixel-dev/implementing-purdue-model-network-segmentation
testing
VerifiedTrustedCommunity
Implement network segmentation based on the Purdue Enterprise Reference Architecture (PERA) model to separate industrial control system networks into hierarchical security zones from Level 0 physical process through Level 5 enterprise, enforcing strict traffic control between OT and IT domains.
1SKILL.mdUpdated May 29, 2026