How do I install the D3fend Deceive skill?

Run npx skillmds@latest add daemon-blockint-tech/d3fend-deceive in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is D3fend Deceive safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with D3fend Deceive?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is D3fend Deceive free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published D3fend Deceive?

daemon-blockint-tech (@daemon-blockint-tech) published this skill. Their other Agent Skills are listed on their SkillMD profile.

D3fend Deceive by daemon-blockint-tech

Name: D3fend Deceive
Author: daemon-blockint-tech

D3fend Deceive

Guides cybersecurity deception operations using MITRE D3FEND—honeynets, decoy objects, decoy personas, and decoy credentials. Covers honeypot deployment, decoy file planting, credential baiting, and deception environment design. Use when deploying honeypots, planting decoy data, baiting credentials, or designing deception programs—not for detection (d3fend-detect), hardening (d3fend-harden), or isolation (d3fend-isolate).

File contents

D3FEND — Deceive

When to Use

Deploying honeynets (connected, integrated, standalone)
Planting decoy objects (files, network resources, personas)
Distributing decoy credentials and session tokens
Publishing decoy information (fake releases, personas)
Designing deception programs and adversary engagement
Monitoring deception environment for adversary interaction

When NOT to Use

Building detection rules or SIEM content → d3fend-detect
System hardening or secure config → d3fend-harden
Network segmentation → d3fend-isolate
Active defense / threat intel → cybersecurity
Adversarial testing (red team) → ai-redteam / offensive-security-analyst

Core Workflows

1. Decoy Environments (Honeynets)

Type	Deployment	Use Case
Standalone	Isolated network segment	Research, early warning
Integrated	Blended with production	Insider threat, lateral movement
Connected	Linked to real systems	APT detection, TTP collection

See references/honeynets.md

2. Decoy Objects

Decoy files: Fake documents with tracking (canary tokens)
Decoy network resources: Fake shares, databases, services
Decoy personas: Fake user accounts with believable data
Decoy public releases: Fake credentials on dark web/pastebin
Decoy session tokens: Bait cookies/API keys with monitoring

See references/decoy_objects.md

3. Deception Program Design

Define objectives (detection, delay, intelligence)
Select deception layers (environment, object, persona)
Ensure believability and consistency
Monitor and collect adversary TTPs
Analyze and feed into threat intelligence

See references/deception_program.md

When to load references

Honeynets → references/honeynets.md
Decoy objects → references/decoy_objects.md
Deception program → references/deception_program.md

---name: d3fend-deceivedescription: Guides cybersecurity deception operations using MITRE D3FEND—honeynets, decoy objects, decoy personas, and decoy credentials. Covers honeypot deployment, decoy file planting, credential baiting, and deception environment design. Use when deploying honeypots, planting decoy data, baiting credentials, or designing deception programs—not for detection (d3fend-detect), hardening (d3fend-harden), or isolation (d3fend-isolate).---# D3FEND — Deceive## When to Use- Deploying honeynets (connected, integrated, standalone)- Planting decoy objects (files, network resources, personas)- Distributing decoy credentials and session tokens- Publishing decoy information (fake releases, personas)- Designing deception programs and adversary engagement- Monitoring deception environment for adversary interaction## When NOT to Use- Building detection rules or SIEM content → `d3fend-detect`- System hardening or secure config → `d3fend-harden`- Network segmentation → `d3fend-isolate`- Active defense / threat intel → `cybersecurity`- Adversarial testing (red team) → `ai-redteam` / `offensive-security-analyst`## Core Workflows### 1. Decoy Environments (Honeynets)| Type | Deployment | Use Case ||---|---|---|| Standalone | Isolated network segment | Research, early warning || Integrated | Blended with production | Insider threat, lateral movement || Connected | Linked to real systems | APT detection, TTP collection |**See `references/honeynets.md`**### 2. Decoy Objects- **Decoy files**: Fake documents with tracking (canary tokens)- **Decoy network resources**: Fake shares, databases, services- **Decoy personas**: Fake user accounts with believable data- **Decoy public releases**: Fake credentials on dark web/pastebin- **Decoy session tokens**: Bait cookies/API keys with monitoring**See `references/decoy_objects.md`**### 3. Deception Program Design1. Define objectives (detection, delay, intelligence)2. Select deception layers (environment, object, persona)3. Ensure believability and consistency4. Monitor and collect adversary TTPs5. Analyze and feed into threat intelligence**See `references/deception_program.md`**## When to load references- **Honeynets** → `references/honeynets.md`- **Decoy objects** → `references/decoy_objects.md`- **Deception program** → `references/deception_program.md`

Frequently asked questions