implementing-network-deception-with-honeypots
Makes your agent set up virtual traps (honeypots) to detect and alert about unauthorized network access attempts.
What it does
This tool helps create digital 'traps' on your network to detect and alert about intrusion attempts or suspicious activities. It simulates services to attract and record those trying to access them.
When to use it
- ✓To know if someone is trying to access your network without permission.
- ✓To discover if an attacker already inside the network is trying to move to other systems.
- ✓When planning network security to add more detection layers.
Example of what to ask your AI
“Set up a trap to detect SSH login attempts.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
You install special software (a honeypot) on a server. This software mimics common network services, like SSH or HTTP. When someone tries to connect to these fake services, the honeypot records the attempt and notifies you.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-network-deception-with-honeypotsOr download just the file:
curl -L https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/main/skills/implementing-network-deception-with-honeypots/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Implementing Network Deception with Honeypots
When to Use
- When deploying deception technology to detect lateral movement
- To create early warning indicators for network intrusion
- During security architecture design to add detection depth
- When monitoring for unauthorized internal scanning or credential theft
- To gather threat intelligence on attacker techniques and tools
Prerequisites
- Linux server or VM for honeypot deployment (Ubuntu 22.04+ recommended)
- Python 3.8+ with pip for OpenCanary installation
- Docker for T-Pot or containerized deployment
- Network segment with appropriate VLAN configuration
- SIEM integration for alert forwarding (syslog, webhook, or file-based)
- Firewall rules allowing inbound connections to honeypot services
Workflow
- Plan Deployment: Select honeypot types and network placement strategy.
- Install Honeypot: Deploy OpenCanary, Cowrie, or T-Pot on dedicated host.
- Configure Services: Enable emulated services (SSH, HTTP, SMB, FTP, RDP).
- Set Up Alerting: Configure log forwarding to SIEM and alert channels.
- Deploy Canary Tokens: Place credential files, shares, and DNS entries.
- Monitor Interactions: Analyze honeypot logs for attacker activity.
- Tune and Maintain: Update configurations based on detection results.
Key Concepts
| Concept | Description |
|---|---|
| OpenCanary | Lightweight Python honeypot with modular service emulation |
| Cowrie | Medium-interaction SSH/Telnet honeypot capturing commands |
| T-Pot | Multi-honeypot platform with ELK stack visualization |
| Canary Token | Tripwire credential or file that alerts when accessed |
| Low-Interaction | Emulates services at protocol level without full OS |
| High-Interaction | Full OS honeypot capturing complete attacker sessions |
Tools & Systems
| Tool | Purpose |
|---|---|
| OpenCanary | Modular honeypot daemon with service emulation |
| Cowrie | SSH/Telnet honeypot with session recording |
| T-Pot | All-in-one multi-honeypot platform |
| Dionaea | Malware-capturing honeypot for exploit detection |
| Splunk/Elastic | SIEM for honeypot alert aggregation |
Output Format
Alert: HONEYPOT-[SERVICE]-[DATE]-[SEQ]
Honeypot: [Hostname/IP]
Service: [SSH/HTTP/SMB/FTP/RDP]
Source IP: [Attacker IP]
Interaction: [Login attempt/Port scan/File access]
Credentials Used: [Username:Password if applicable]
Commands Executed: [For SSH honeypots]
Risk Level: [Critical/High/Medium/Low]
FAQ
What is a honeypot?
It's a 'decoy' system designed to attract and detect attacks by simulating a vulnerable target.
What types of traps are there?
There are 'low-interaction' ones that only simulate the service, and 'high-interaction' ones that are complete systems.
What are Canary Tokens?
These are fake files or information scattered across the network that trigger an alert when accessed.
Details
Original description by the author
Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.
Popularity
- GitHub stars
- 35k
- Ranking position
- #5917
- License
- Apache-2.0
- Updated
- 8/31/2026
Comments
- …
More skills from this repository
abusing-dpapi-for-credential-access
Gives your AI agent ready-made instructions for a specific task, so it does it better and faster.
mukul975/Anthropic-Cybersecurity-Skills
abusing-shadow-credentials-for-privesc
Teaches your AI agent to write clear, well-structured text.
mukul975/Anthropic-Cybersecurity-Skills
achieving-cmmc-level-2-compliance
Helps your agent prepare an environment for CMMC Level 2 compliance. It implements security requirements and manages necessary documentation.
mukul975/Anthropic-Cybersecurity-Skills
acquiring-disk-image-with-dd-and-dcfldd
Helps your agent create exact copies of hard drives. This is useful for ensuring no information is lost or altered during investigations.
mukul975/Anthropic-Cybersecurity-Skills
Similar skills
django-security
Helps your agent implement security practices in Django applications. It focuses on authentication, authorization, and prevention against common attacks, ensuring more secure code.
affaan-m/ECC
laravel-security
Helps your agent secure Laravel applications against threats. Implements security practices for authentication, authorization, and common attack prevention.
affaan-m/ECC
module-regression
Helps your agent manage changes in large projects. Ensures code changes in one part don't break other parts.
affaan-m/ECC