D3-DHN
Decoy Honeypot
Deploy fake systems and services to detect, deflect, and study adversary behavior.
D3FEND / Deceive
Implementation
- Deploy honeypots mimicking production systems
- Monitor all honeypot interactions
- Isolate honeypots from production
- Capture attacker TTPs
- Feed intelligence into detection rules
Tools
- Thinkst Canary
- T-Pot
- Cowrie
- OpenCanary
- HoneyNet Project
ATT&CK mappings
3