skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-deception-technology-deployment

Deploys honeypots, honeytokens, and canary decoys to detect lateral movement and credential abuse.

954|172|Updated Mar 13, 2026
Search Tags:#detection#honeypot#lateral movement#siem#SoC#deception#honeytoken
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-deception-technology-deployment
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-deception-technology-deployment
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/soc-operations/performing-deception-technology-deployment
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-deception-technology-deployment

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SOC teams often miss attackers who bypass perimeter defenses and move laterally inside the network, because threshold-based detection tools generate noise or fail to trigger. This Skill deploys deception technology — honeypots, honeytokens, and canary files — that produces high-fidelity alerts with near-zero false positives, since no legitimate user should ever touch a decoy asset.

Core Features & Use Cases

  • Decoy Deployment Planning: Maps network segments (server VLANs, DMZ, OT, cloud VPCs) to appropriate decoy types such as fake file servers, database servers, and PLC/HMI decoys.
  • Honeytoken Creation: Creates fake Active Directory service accounts, cached credentials, AWS canary keys, and tracked Word documents that alert on any use.
  • SIEM/SOAR Integration: Wires deception alerts into Splunk notable events and automated SOAR responses including host isolation, firewall blocking, and P1 incident creation.
  • Use Case: An attacker dumps credentials with Mimikatz and finds a planted honeytoken account; the moment they attempt to use it, a critical alert fires and the source workstation is automatically isolated.

Quick Start

Ask the AI to plan and deploy deception decoys and honeytokens across your network segments with SIEM alerting and automated isolation response.

Frequently Asked Questions about performing-deception-technology-deployment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deploy honeypots to detect lateral movement in a network?▼

Deploy decoy systems such as fake file servers and database servers in segments attackers traverse, using platforms like Thinkst Canary. Plant breadcrumbs like cached credentials and mapped drives on real hosts so attackers pivot to the decoys, and route any interaction to your SIEM as a critical alert.

What is a honeytoken and how does it detect credential theft?▼

A honeytoken is a fake credential, account, or file that triggers an alert when used. Create a fake AD service account, plant its cached credentials on decoy workstations, and monitor Windows events 4624/4625/4768/4769 for that username — any use indicates credential theft.

Thinkst Canary vs open-source honeypots — which should I use?▼

Thinkst Canary provides commercial hardware and virtual canaries plus canarytokens for documents and AWS keys with minimal setup. Open-source options like T-Pot combine 20+ honeypot types in Docker and suit teams wanting full control and no licensing cost.

Why does my honeypot generate false positive alerts?▼

False positives occur when a honeytoken account is included in real logon scripts, GPOs, or backup jobs, or when its password expires. Baseline event logs for the honeytoken username before going live and confirm zero legitimate events during the baseline window.

Can deception technology replace EDR or network segmentation?▼

No. Deception is a detection layer, not a prevention mechanism, and should not replace patching, EDR, or network segmentation. It complements these controls by providing high-fidelity alerts when attackers bypass preventive defenses.

Related Skills

Explore More Software Engineering Skills→
UnitOneAIUnitOneAI
44

segmentation

Map network zones and validate policy enforcement points against Zero Trust frameworks.

Official
Intermediate
afoxnyc3afoxnyc3

incident-response

Triage Azure Defender alerts and correlate sign-in logs into incident timelines.

Community
Advanced
jassicsjassics
6

alert-triage

Automate SIEM/EDR alert triage with validation, enrichment, and verdict decisions.

Community
Intermediate
HmbownHmbown
105

mislead

Deploy honeypots and decoy assets to detect unauthorized probing.

Community
Advanced