Can I use this for Active Directory security?

Yes, this skill includes specific workflows for planting fake credentials and service accounts in AD to catch credential harvesting tools like Mimikatz or unauthorized LDAP queries.

What is deception technology in cybersecurity?

Deception technology involves deploying decoys like honeypots, honeytokens, and breadcrumbs to detect and confuse attackers who have bypassed traditional security layers like firewalls and EDR.

Which platforms does this skill support?

The skill provides guidance for popular platforms including Thinkst Canary, Canarytokens.org, Attivo Networks, and various open-source honeypot frameworks.

Does deception technology replace traditional security controls?

No, deception is an additional detection layer. It should be used to complement fundamental controls like patching, network segmentation, and EDR, not replace them.

How does this skill reduce false positives in a SOC?

Since legitimate users have no business interacting with deception assets, any interaction generates a high-fidelity alert with a near-zero false positive rate, indicating a likely compromise.

Cybersecurity Deception Technology Deployment

Name: Cybersecurity Deception Technology Deployment
Author: micsapp

bymicsapp

0•

セキュリティとテスト

Deploys honeypots, honeytokens, and decoy systems to provide high-fidelity detection of lateral movement and credential abuse.

This skill empowers security operations teams to implement advanced deception technology strategies, effectively setting traps for attackers who have bypassed perimeter defenses. It provides comprehensive workflows for deploying virtual canaries, planting fake credentials (honeytokens) in Active Directory, and creating tracked documents to detect unauthorized access. By focusing on high-fidelity alerts with near-zero false positive rates, it enables SOC teams to catch internal reconnaissance and lateral movement early in the attack lifecycle while integrating directly with SIEM and SOAR platforms for automated response.

主な機能

010 GitHub stars

02Tracked document (Canarytoken) generation and placement strategy

03Active Directory honeytoken and fake privileged account creation

04Automated deployment workflows for Thinkst Canary and open-source honeypots

05Detailed mapping of high-value network segments for strategic decoy placement

06SIEM/SOAR integration for automated incident response and host isolation

ユースケース

01Detecting ransomware activity before it impacts production file systems

02Monitoring for credential theft and unauthorized usage of fake service accounts

03Early detection of lateral movement within sensitive server VLANs

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills performing-deception-technology-deployment

For use in Claude.ai and ChatGPT

主な機能

010 GitHub stars

02Tracked document (Canarytoken) generation and placement strategy

03Active Directory honeytoken and fake privileged account creation

04Automated deployment workflows for Thinkst Canary and open-source honeypots

05Detailed mapping of high-value network segments for strategic decoy placement

06SIEM/SOAR integration for automated incident response and host isolation

ユースケース

01Detecting ransomware activity before it impacts production file systems

02Monitoring for credential theft and unauthorized usage of fake service accounts

03Early detection of lateral movement within sensitive server VLANs

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills performing-deception-technology-deployment

For use in Claude.ai and ChatGPT