What it does. Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-network-deception-with-honeypots, or copy the skill folder into ~/.claude/skills/implementing-network-deception-with-honeypots/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-network-deception-with-honeypots/SKILL.md

SKILL.md (verbatim)

name: implementing-network-deception-with-honeypots
description: Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie
  to detect unauthorized access, lateral movement, and attacker reconnaissance.
domain: cybersecurity
subdomain: deception-technology
tags:
- deception
- honeypot
- opencanary
- cowrie
- t-pot
- detection
- lateral-movement
- network-security
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- DE.CM-01
- DE.AE-06
- PR.IR-01
mitre_attack:
- T1078
- T1190
- T1059
- T1021
- T1550

Implementing Network Deception with Honeypots

When to Use

• When deploying deception technology to detect lateral movement
• To create early warning indicators for network intrusion
• During security architecture design to add detection depth
• When monitoring for unauthorized internal scanning or credential theft
• To gather threat intelligence on attacker techniques and tools

Prerequisites

• Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)
• Python 3.8+ with pip for OpenCanary installation
• Docker for T-Pot or containerized deployment
• Network segment with appropriate VLAN configuration
• SIEM integration for alert forwarding (syslog, webhook, or file-based)
• Firewall rules allowing inbound connections to honeypot services

Workflow

1. Plan Deployment: Select honeypot types and network placement strategy.
2. Install Honeypot: Deploy OpenCanary, Cowrie, or T-Pot on dedicated host.
3. Configure Services: Enable emulated services (SSH, HTTP, SMB, FTP, RDP).
4. Set Up Alerting: Configure log forwarding to SIEM and alert channels.
5. Deploy Canary Tokens: Place credential files, shares, and DNS entries.
6. Monitor Interactions: Analyze honeypot logs for attacker activity.
7. Tune and Maintain: Update configurations based on detection results.

Key Concepts

Tools & Systems

Output Format

Alert: HONEYPOT-[SERVICE]-[DATE]-[SEQ]
Honeypot: [Hostname/IP]
Service: [SSH/HTTP/SMB/FTP/RDP]
Source IP: [Attacker IP]
Interaction: [Login attempt/Port scan/File access]
Credentials Used: [Username:Password if applicable]
Commands Executed: [For SSH honeypots]
Risk Level: [Critical/High/Medium/Low]

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

Network Deception with Honeypots Reference

OpenCanary Installation

# Ubuntu/Debian
sudo apt-get install python3-dev python3-pip python3-virtualenv libssl-dev libpcap-dev
virtualenv canary-env && source canary-env/bin/activate
pip install opencanary

# Docker
docker pull thinkst/opencanary
docker run -d --network host -v /path/to/config:/etc/opencanaryd thinkst/opencanary

OpenCanary CLI

# Generate default config
opencanaryd --copyconfig

# Start daemon
opencanaryd --start

# Stop daemon
opencanaryd --stop

# Check status
opencanaryd --status

# Run in foreground (debug)
opencanaryd --dev

Configuration File (/etc/opencanaryd/opencanary.conf)

{
    "device.node_id": "honeypot-dmz-01",
    "ssh.enabled": true,
    "ssh.port": 22,
    "ssh.version": "SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3",
    "http.enabled": true,
    "http.port": 80,
    "http.banner": "Apache/2.4.41 (Ubuntu)",
    "http.skin": "nasLogin",
    "smb.enabled": true,
    "smb.filelist": [{"name": "passwords.xlsx", "type": "xlsx"}],
    "ftp.enabled": true,
    "ftp.port": 21,
    "ftp.banner": "FTP server ready",
    "mysql.enabled": true,
    "mysql.port": 3306,
    "rdp.enabled": true,
    "rdp.port": 3389
}

Available Service Modules

Log Format (JSON, one per line)

{
    "dst_host": "10.0.0.50",
    "dst_port": 22,
    "src_host": "10.0.0.100",
    "src_port": 45321,
    "logtype": 3001,
    "node_id": "honeypot-dmz-01",
    "utc_time": "2025-03-01 14:30:00.123456",
    "logdata": {"USERNAME": "admin", "PASSWORD": "password123"}
}

Log Type Codes

Cowrie SSH Honeypot

# Docker deployment
docker run -d -p 22:2222 cowrie/cowrie

# Session replay
bin/playlog log/tty/20250301-143000-abc123.log

Syslog Forwarding

{
    "logger": {
        "class": "PyLogger",
        "kwargs": {
            "handlers": {
                "syslog": {
                    "class": "logging.handlers.SysLogHandler",
                    "address": ["siem.example.com", 514]
                }
            }
        }
    }
}

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.